Great. Thank you. Good morning, everyone. My name is Brian Essex. I'm JPMorgan's large cap, mid cap software analyst. With me today, I'm very excited to have Check Point. To my right, we have Roei Golan, a CFO of Check Point. Very excited to have Check Point's new Chief Revenue Officer, Sherif Seddik. To my left is Kip Meintzer, the head of IR for Check Point. Before we kick it off, we'll pass it to Kip for a little safe harbor disclosure.
Thank you guys for all joining us this early morning. During the course of this presentation, there may be forward-looking statements. As with all forward-looking statements, they carry risks and uncertainties that could cause material differences from those that are expected. If you'd like a comprehensive view, but not exhaustive view, of all of these risks and uncertainties, you can, right before bedtime, take a read of our latest 20-F, and you'll get some good sleep, but you'll have access to the majority of those risks and uncertainties out there. As with all of these types of call-outs, we reserve the right to only update where required by law. With that, I'll throw it back to Mr. Essex, and he can begin.
Right. You didn't even need a cheat sheet for that.
I know.
You got it memorized.
too long.
Yeah, thanks, Kip. Maybe a great place to start, Sherif, if we could start with you.
Great.
You know, recently appointed to Chief Revenue Officer, so congratulations on that.
Thank you very much.
I would love to maybe hear a little bit about your background, and initial thoughts as you've taken the role, and what you think impact that you can have is and might do differently.
Great. Sherif Seddik. I'm originally from Egypt. I have a degree in communications and electronics engineering, so enough to know about technology that I always say nobody can tell me stories about technology. After graduating, I've been in the IT industry for more than 30 years now, with four companies. I started in Dubai with NCR at the time. Followed the 13 years after that, another 13 years with Microsoft in different roles, then seven years at Citrix, and now three years at Check Point. I'd say what's unique about my career is that particularly in the early part of my career, I kept moving between emerging markets and mature markets. I've lived and worked in eight countries.
Throughout my career, while predominantly in sales and sales leadership, I've deliberately chose to do other roles along the way. I did product management at a certain point of time. I led the consulting businesses at certain point of time. Probably the most common theme in all my roles has been around really driving change. I've done things like turnarounds, transitioning businesses to subscription and SaaS models, launching new products and incubation businesses. That's really the common theme. Probably most interestingly, my last role at Microsoft was running the enterprise business in Western Europe, which is a $3.5 billion business. At Citrix, I started running the EMEA business for five years.
The last two years, I was running commercial strategy and go-to-market strategy worldwide, where I was responsible for go-to-market design, all the strategic partnerships for the company with the hyperscalers and the larger systems integrators, running sales enablement, all of the back-end sales programs, et cetera. Here at Check Point, I started at EMEA President. After a year, got promoted to Head International, and now just two weeks ago, in this role. I think what I bring to the role is a mix of really experiences with large and similar-sized companies, so knowing how to build business systems and go-to-market models to scale. Also the fact that I've done strategy roles and execution roles, so I really can straddle both.
When designing new programs, et cetera, I really understand what's the level of detail. I'm really excited about the opportunity ahead for us. I think the way the market is going positions our four pillars that we chose to be in in a unique way that really adapts to the challenges that companies face with AI and the transformation of AI, et cetera. We have massive opportunities, very excited about helping the company realize them.
Great. Great, thank you for that. How should we think about, I guess the depth of, change within the organization? You know, there was a lot of focus, particularly on the earnings call about the, you know, changes around the, you know, go-to-market motion of the company and, you know, how disruptive that was to parts of the business. How deep does that go and, you know, how long do you think that this transition period lasts for the business?
This process all started in the middle of last year, kind of with our transition and strategy as well around the four pillars and the desire to move to multi-pillar selling, et cetera. We did a review of our go-to-market model and said, is that go-to-market model will enable success for us in multiple of years? Being successful in all of the different parts of the stack that we want to operate in, focusing on building sustainable double-digit growth, and we realized that our go-to-market hasn't had really a significant change for four or five years before. And when we looked at where the market opportunity lies as well, we realized we need to do a significant change if we are to build towards that growth. There are really three objectives of the go-to-market.
One was around how do we accelerate growth? How do we put resources behind where we believe the growth is gonna come from? And we believe the growth is gonna come for us from large enterprise customers, from increasing our new logo acquisition, and obviously, as you've all seen in the results, our SaaS and subscription businesses have been seeing very healthy growth, and we wanted to fuel and double down on that growth. We invested in these three areas and transitioned resources to those three. Second thing was around as more of our business transitions to subscription and SaaS, thinking of the whole customer journey becomes very, very important. We also moved resources to our customer success organizations.
We wanted particularly in the territory part of our business to focus sellers on new business, so we increased the staffing of our renewal businesses to look after the renewals exclusively. The third thing that we've tried to do with it is how do we improve the efficiency and build scalable models? We moved resourcing, for example, to marketing funds and partner programs as ways for us to scale the business. We also looked at the efficiency of our sellers across geographies, et cetera. It was really a whole review, and the results were pretty deep. Roughly a third of our people were in a new role. Even many of those that are in existing roles, particularly our account managers and partner managers, as we focused on fewer larger customers and fewer larger partners, they had new sets of accounts.
All of these things resulted in that disruption. Right. However, we are absolutely convinced that it is the right model to take us forward. We believe now that we've really exited the disruption phase and are into execution phase. We're starting to see acceleration in our funnel generation across the different pillars, including firewall. I think we're on a good trajectory now to start seeing the benefits of the change. How many of those changes were just shuffling seats within the organization versus hiring new talent from outside the organization? I'd say about 50/50 roughly. One of the other things we're doing at the moment, we do have an accelerated hiring path.
We still have a number of, in all of these different roles, customer success, specialist sales, and generalist sellers, an accelerated path. It was about 50/50. We didn't just move seats. We really did a strong evaluation process of the people who are changing, are they the right people for those roles?
How should we think about the disruption in the quarter? I mean, it was very heavily weighted towards product, at least in the results. Was it a function of, you know, the pipe was disrupted and product just gets converted faster? I mean, the product is converted faster, so maybe that saw it sooner. Or was there something unique about the dynamics around the Quantum Firewall platform that just made it more susceptible to disruption as you made those changes?
I'll start and then I'll let the give Sherif. I think that the product, which is the firewall appliances. Most of the changes as Sherif mentioned was in the generalist teams. I mean of course we added many people to the other pillars, to the specialists, but most of the changes of the roles that we are talking about, we are talking about account managers that change their roles to be, I don't know, a specialist or even territory managers. That was mainly affecting the account managers that are working on firewall business.
Renewals, it's less affected because in renewals in the end it's renewal, so you don't need I mean, it was less affected. On new business, when we are looking on new business and the final generation, that usually the main quarter that was affected is Q2. You're looking on our guidance for the second quarter.
Right.
'Cause Q1 was slightly less what we expected. Was less than what we expected. In the end, the main impact is Q2. Why? Because of this disruption and the changes we did see, we did see that the pipeline, the execution took more time than what we expected.
We see that there were delays with pipeline generation in the beginning of the year. We're starting to see, the, this pipeline that's usually affecting Q2 and Q3, it's not affecting Q1. Most of the firewall net new business, the sales cycle there is between five to nine months, I would say. Sometimes even more than that. That's mainly affecting the Q2 and Q3. That was the effect that of, because of we did see less pipeline that was generated in the first month, I would say even in the first two months.
Two months. Mm-hmm.
two months of the year. That have direct effect on our Q2 numbers. Also some on Q3 numbers. Therefore, I mean therefore we provided this updated guidance.
Right
That's affected mainly the product, because it's new business. On the other pillars we did actually well. Again, also there were changes in the other pillar. I mean, the specialists we did, we added many people there. I think that the disruption was less there than in mainly on the core business on the generalist.
When you say new business, it's not necessarily new logos, it's.
It's new logo and net new project. Incremental, not just the appliance.
New appliance.
Yeah, not just replacing old appliances with new appliances .
Would that not include a refresh?
It's both refresh, but it's mainly the effect of the pipeline.
Yeah.
It's net new. It means existing customer that now buying, doing expansion.
Expand. Mm-hmm.
Data centers, that's the main effect.
New logos, but both of them.
Got it. Sherif, maybe touch on the makeup of salespeople. The hunters, the more seasoned people that we're hiring, chasing after new logos and that approach.
Yeah, I think so historically we've had our account managers handle both existing customers and prospects. What we've done in the current model, particularly with the focus on very large enterprises, we said for our strategic segment, the largest customers and the very large prospects, we are now going with a hunter-farmer model in that space. As a result we are hiring, the hunter profile is a profile we didn't have, and we're doing a lot of hiring and expansion on that. In the major space we still have the mixed model. That's another change.
The other change that we've done also on the specialist side, wherever we have the scale, we've assigned the specialist to either work on the strategic and major, or the partner-led motion, et cetera. That was another mix in terms of historically our specialist works across all sides of customers. Wherever we have the scale now, we've separated them.
We're putting a lot of focus, as I said, on large enterprise, and separating the motion between a new customer acquisition and existing customer expansion. I think in terms of where we're seeing the disruption and the changes, et cetera, for particularly on Q1, is when you look at our specialist teams, the impact of the change is increasing the number of resources. The teams were relatively stable in Q1, so that's why the subscription businesses continue to see growth.
Our subscription businesses generally have a faster sales cycle as well, because the firewall projects, data center projects tend to be very complex and long. That's why the impact is a little bit less on the subscription businesses for Q1 and Q2, while for firewall we're expecting to start seeing the uptick again from the latter part of Q3 into Q4.
We are putting in place a number of strong initiatives around further accelerating beyond the pipeline increase that we're already seeing. We are launching a very strong competitive displacement program.
We are launching a program on the AI data center. We see that as a huge opportunity for us. We've already had some wins. We're seeing an increased pipeline. And the third thing is something that we are evolving into more focus on vertical use cases. We're starting with industry and manufacturing vertical, where we have identified three use cases that again, we're building strong pipeline on. A few things in terms of not just changing the go-to-market structure, but how we go after things.
Maybe if I could peel back a layer on a couple of those comments. One is, how should we think about the timing of the disruption that you saw? Is that if these changes started earlier last year or in the middle of last year, is that when this disruption started, or is the disruptive impact more of a, like, 4Q, 1Q, and then that kind of hit the, like, near term level?
Yeah.
Particularly considering, like, the sales cycles, the duration of the cycles that you see on the product side.
Yeah, I'll walk you through the process. In Q3 last year was really all about the analysis phase. The consulting phase around that.
Okay.
At that stage, it was a relatively small group of people that were working on that. By the end of Q3, we had the new design in place, and then Q4 we were all working around the change management. We started to bring field leadership into this in the middle of Q4 of last year.
Okay.
You could say to some degree there was in the latter part of Q4, not field disruption. Obviously the management teams were thinking part about executing on Q4, part about preparing for the change. The change was launched to the field on the January 6th. That's why, as Roei mentioned, like pipeline generation in January and February were really disrupted.
Got it.
People were learning the new roles, their new territories. Who are their new teammates, what's the new way of working that we're expecting. February we started to see an uptick in funnel generation. March was very strong. April even stronger from a year-over-year comparison.
We're starting to see signs, of that, okay, now we're starting to get out of the disruption mode, and into execution mode. The pipeline generation increase that we're seeing is across our product portfolio.
It's also showing that we're starting to hit the areas that we wanna hit. For example, pipeline for new logos is growing faster than our overall pipeline. Which was a big focus of us, how do we increase new logo acquisition?
Right. Mm-hmm.
We're starting, as I mentioned, to see a pipeline increase in AI data centers, which is our target motion, our AI security pillar. What we're seeing is not just pipeline increase, but pipeline increase in the areas that we were strategically designing the change to do. That's giving us confidence, again, that the changes are starting to land. As with any change of this magnitude, it will take two quarters for it all to-
Right
to kind of, to get back to smoothness again. We're expecting that at the end of Q2.
Okay, that's helpful. You know, you mentioned competitor displacement program. What are some of the aspects that you're leaning into with that program? Is it, you know, more aggressive pricing or, you know, sales incentives or better channel compensation? How do you think about the major levers in that program?
There are three levers in that program. One is really focusing on use cases where we believe we have strong differentiation against the competition, and giving our sellers and our partners kind of the playbooks of saying, "These are the use cases where we believe we have a high opportunity." The second thing that we've done is around the partner incentives. We've put in different levels of partner rebates and partner acceleration on that, but also in terms of, like, pre-approved pricing levels to speed up the process. The third element is around the customer offer itself. The customers care about the most with a transition like this is how are you gonna sort of safe harbor me to the other side?
We've included prepackaged services as part of that to make sure that the customer transition, we've created tooling, for example, to automate the transition of policies and rules from other vendors' platforms to our platform. That's another important part of that. The third element that we believe this year is also gonna be helpful is we've now put in CapEx and OpEx models for the customers. As you know, different industries are more CapEx or OpEx. Now we believe we have a compelling offer whether you're CapEx focused or OpEx focused. We try to cover all of the different elements.
And what would make a competitive displacement success? Right. On the pricing side, is that affected at all about, you know, how you go to market and competitively price against your peers?
We've done a full analysis on kind of pricing and what are the pricing points for these different displacements. We've already, in a way, pre-approved discount levels to get this pricing from day one that we believe would get us to that. We also wanted to make sure that that aggressive pricing does not seep back to our normal pricing, so we have a number of policies around proof of displacement.
Right
things like that to make sure that we are ring-fencing, the pricing around that model.
Got it. Got it. Very helpful. You mentioned data center business and AI data centers, and I know one of your peers calling out that as an opportunity as well. How large are data centers as a percentage of your total business?
Significant.
Yeah, I mean, so significant meaning, like.
Significant.
a third or
No, more than a one-third. I mean from the total firewall business, not of the total business.
Okay. Well, the total firewall business.
Yeah. Yeah, yeah
um, you know-
It's the majority of our business today is data centers in firewall.
Yeah, yeah. How do you how should we think about how you're positioned for AI data centers? And, you know, do you have a lot of visibility into AI data centers as opposed to data centers that customers may also be running AI inferencing on? How are you seeing that market play out?
I think So first of all, we're starting from a position of strength because the data center is the area, and as Roei mentioned, where the majority of our business is, where we already have a lot of differentiation. As we evolve to the AI data center models, we think we have even further differentiation, and that comes from a couple of things. One is, first, our partnership with NVIDIA. As you know, AI data centers are running nearly at 100% capacity all the time.
Yeah.
Latency is a huge issue for these data centers. They are running multi-tenancy. They are running multi workloads. The fact that we have our partnership with NVIDIA, where we put our firewall effectively on the DPU addresses many of these issues. It first of all, it addresses the latency issue because you're on chip.
The second thing is also because you are on the DPU, not the GPU, you're leaving the GPU to do its work. You're not affecting the capacity from a GPU perspective. It's not just that. That's just one factor of it. It's when you combine that with the rest of our product portfolio where the magic happens. If you look, for example, if you look at the training side, it's only the firewalls on the DPU that work. On the inference side, you add the AI guardrails through our acquisition of Lakera. That again provides another layer of security.
On the data center side with the traffic increase, the fact that we have our Maestro model, which is the best scalability in the industry again, helps us through that. You come in and you include our WAF solution that addresses security for how do you address the access to the user's access to application, et cetera.
Right.
You take the different parts of our portfolio, and it's really a compelling, complete, differentiated solution. We've already seen wins in different parts of the world. We had wins in Asia. We had wins in the Middle East. We're in discussions with some massive opportunities in Americas.
In Western Europe. We really see this as an opportunity for us. We now have a standardized architecture, again, standardized services for delivering it, et cetera.
How large are these deals relative to the rest of the deals that you see in your pipeline?
There are, they are among the larger sizes inside of the deal again. The other thing is some of them as well become opportunity openers for other opportunities.
Yes. Mm-hmm.
We've won a deal recently in Asia, and these guys are providing services for, you know, application and AI application development for companies in that specific country. What they've become now is now they've utilized our services, but they are including them as part of what they sell to their customers.
Here is the security package to secure the application, the AI applications and the LLMs you're building on our factory. The deal itself is bigger, but it has a multiplying effect from that point of view as well.
Do you have a sense of, you know, within the AI data center opportunity, I mean, how far along are we with data center build-outs? Has this been happening for quarters? I think we've seen a lot of CapEx spend. Are we at the point where you've seen some of these data centers get built out, they've kind of figured out what they need, so now is when we're starting to see more demand on the security side to follow that initial spend?
We think that the investment cycle is only starting.
Yeah.
In the, in the initial phase until now, it's mainly been the hyperscalers, and et cetera. What we're now seeing is, large enterprises are getting to the game because of privacy issues or data sovereignty laws that they have to apply to. Governments are getting into that again for data sovereignty reasons and all of that. You're seeing new types of players that are coming in into the AI data center. We, we think the cycle is just gonna accelerate because of that.
We think, frankly, many people still don't know what they need.
Yeah.
They know they need something, but they don't know what they need and that's why having this standardized architecture that says, like the discussions we have with the customer is, "You're embarking on this journey. These are the things that you need to think about. This is how our technology. It's also a very, very consultative sale.
That we're doing because we're helping customers understand, here are all of the things that in the AI world you need to deal with that are different from what you used to deal with before.
Right. Roei Golan, how does this line up with, you know, the Quantum product cycle? I mean, we're pretty well into that now.
Yeah.
That was, I think, one of the issues this quarter, your comps last year were more meaningful. From a product cycle perspective, is there another cycle in the wings? You know, how do we think about the cyclicality of that firewall business.
Yeah
the most recent
I know that we like to call it a cycle, I think in the end, we, of course, we had last year it was a strong year. I would say we did have a lot of refresh projects.
last year and I think also two years ago. When I'm looking today on what we have just with our install base, even without accelerate, I mean, gaining new logos, acquiring new logos. I think the potential it to grow in firewall is there. This is even without AI data centers. We've talked a lot about data, AI data centers. I think there is a lot of potential even for our current install base. They still didn't replace, I mean, active customers, they still didn't replace their old appliances. They expect to replace it in this quarter or in the remaining of the second half of the year.
Again, I think the guidance right now takes into account that we're gonna see some decline in Q2 and probably also in Q3, but that's mainly because of internal disruption. Definitely we do expect to see back to growth in product from Q4 and afterwards. And again, that's based on our internal metrics, based on what we see. As Sherif mentioned, the pipeline generation, we see very strong generation in the last month, the last few weeks. We do feel more positive with the firewall back to growth from Q4.
Got it. I know on the earnings call, you know, I think Nadav was pretty adamant about macro not having an impact this quarter. He was very focused on the disruptive-.
Yeah
aspects of the quarter. How is customer spending overall? You know, are you starting to see access to budgets outside of traditional IT budgets? Maybe part B of the question is, have customer I guess spending intentions changed since Mythos and GPT-5.5 emerged and people started freaking out a little bit?
I would say it's a good question. I think that, of course, that there will be more spending on AI, but I actually, and again, Sherif can also comment about what he sees, but I don't see the AI security budget going down. I think that security will continue to go up, of course, in terms of priority. I think that network security is a top priority.
I mean, you're gonna see more volume of data that's going through the network because of the AI. I don't see our network security. I think that actually the budget for network security should go up. Again, right now, I think Nadav mentioned it's not a macro. I mentioned in the beginning of the year when I gave the guidance for the full year in February, I mentioned that there might be some changes in customer behavior because of the rising cost of the memories.
Yeah.
In the end, it's something that we also see today, the memories. It's crazy what's going on there with the, I mean, the inflation of the pricing. I have to say that right now I don't see, I mean, I don't see it across the board customers sweating their asset because of memories, because of the memories cost. It might happen, but right now I think we've been very clear that what happened in Q1 and the, the reflection and the guidance for the- I mean, the update of the guidance for the full year was not as a result of macro.
Got it.
Yeah, I'd say what we're seeing with customers is definitely an increased focus on cybersecurity and how to reprioritize within the cybersecurity space.
It's definitely becoming more top of mind, board issue for sure, more than ever before. Have I seen that as a result of that, the purses are open and someone is saying, 'Now your cybersecurity budget is 30% more,' et cetera? We haven't reached that stage.
There's definitely no sign on the horizon of the budgets being stable or reduced. What we're seeing is customers really thinking, "Okay, where do we need to invest based on the changes, based on what we're gonna see happening, like the, you know, that tsunami of vulnerabilities.
that's gonna happen. How do we react to that in terms of our processes so that we can prioritize? How or how do we change our patching processes, et cetera, in order to speed up? We think that that's bringing, again, for us, benefit. The whole topic of exposure management is becoming much, much more critical. We are finding ourselves in significantly more discussions around our exposure management portfolio than we have before. We have a number of unique assets. One is through the acquisition of Cyberint, we got a lot of external visibility.
Right.
You combine that with all of the telemetry that we see from our products, and you have an incredible basis of intelligence to start from. Through the acquisition of Veriti, the fact that we can then go and implement things across multiple vendors and not just our side of things. The fact that we are now developing capability to enable us, if the customer allow, that we, based on certain rules, can go and auto patch. Not, again, not just in our technology, but others. That's creating a lot of strength in that. Network security is becoming in fashion again.
Right.
In different things, because again, like, topics like segmentation, for example. Micro-segmentation become more critical than ever because you're saying, now, if you assume someone is gonna get there, how do you stop lateral movement? That's increasing, again, demand for firewall for segmentation purposes.
which had slowed down in the last couple of years at AI data center. We also feel that our choice of pillars to invest in is being vindicated by the changes. Whether AI security, the investments there, top priority, exposure management, top priority. People will need to rethink the network security posture where we have our prevention first ethos and a lot of the things that we had in the past. We're very positive about where the industry is going and where that allows us to position ourselves.
How are customers thinking about, I mean, obviously one of the themes that we're seeing, particularly over the past couple of months/year to date, is a collapse of the mean time to exploit.
Yep.
Right? Now speed is becoming even more critical. You know, not just in terms of finding the vulnerabilities, but, you know, quickly responding to those vulnerabilities or exploitable vulnerabilities. How do you view your platform? Is a tightly integrated platform an advantage in that situation? Maybe if so, how would you describe how that advantage plays out in terms of the ability to react in a faster way to some of those exploitable vulnerabilities?
Yeah, I mean, We get asked a lot about the topic of a unified platform versus we talk a lot about our open garden and open approach. I think it's important that we position that in the right way. We are not going away from platform and the benefit of platforms.
For each of our pillars, we're building a platform for that entire pillar.
Right.
If you look at the AI Defense Plane that we've launched around AI security, that's, again, a full platform that covers, you know, protecting your data center, to protecting the user use of, you know, generative AI, to protecting kind of your LLMs and agents and all that.
Full stack, full platform. If you look at workspace, again, we have email and collaboration, endpoint, mobile, SaaS.
SSE kind of part of that. Again, in each of these, we're building a platform. What connects underneath is our threat prevention protocols, et cetera, and then we're also building a unified management across all of these.
We're not going away from us building platform, but what we're saying is we're also realistic enough to understand that customers have install base, customers have choices, and that frankly, if we as a company, we wouldn't bet our cybersecurity on one company because that becomes an exposure in its own right. What we want is still if you use another vendor, we still offer you the best protection with that. Example, our workspace management plane. You go and it's built, and you get the best experience and the best protection if you use everything from our side.
If you use CrowdStrike for endpoint, you can still go and position, configure and say, "I'm using CrowdStrike. We will manage your entire workspace. Will it be as good as if the whole thing is from us? Of course not, because we don't control the whole stack, but we will still offer you significant capabilities to still have visibility across your entire workspace platform.
Where across your platform are customers saying, "All right, native integration with this product is the most important, so we're gonna beat a CrowdStrike at endpoint," or, "We're gonna beat a Tenable for vulnerability or exposure management"? Like, where do you get that leverage from being able to accelerate your time to react?
We build, obviously, integrations for us, but we are building predefined integrations with other vendors as well. For example, with Wiz and the partnership we have with them-
Right
on the CNAPP side, or with Illumio on the micro-segmentation side. We also look at the entire usage of customers, and we pick what are the most important platform to integrate with e ndpoint, CrowdStrike and Defender. So we'll, we-
Right
That's the majority. We're gonna focus there first.
Okay.
We have more than, how many now? I think 80.
Yeah
native integrations with competing products and some others.
Great. you know, with that, I think we're out of time. Sherif, Roei Golan, Kip Meintzer, thank you so much. I really appreciate it.
Thank you.
It's great to see you.
Great. Thank you.
Thank you, everyone.