All right. I think we're gonna go ahead and get started. Good afternoon and welcome to the final session of the day. My name is Doug Bruehl, and I have the privilege of being joined by Dana Gerner, CFO of Cellebrite, and Andy White, from Investor Relations. You know, to start off, can you give us sort of a broad update on the business since you were here a year ago, both sort of from the product front as well as the sales environment that you've been seeing?
Yeah, sure. Hi, nice having you, all of you here. I would start by saying that we are operating in a very healthy environment and a very healthy market. Our main customers are law enforcement agencies and government agencies globally, working mainly in the U.S., more than 50% of the business, and then EMEA, around 35%, and APAC and South America. We see this market as a very stable market. We see the funds coming into this market in a very consistent manner, we enjoy being the leader in the digital intelligence market, which is actually serving the entire investigation workflow from the moment a digital device is collected and until the results of the collection and analysis of this data is submitted to the investigators and then to the prosecutor for determining how to proceed with this case.
We have around 10% of the business being a private sector business, whereby our solutions are used for internal investigation in large corporations, mainly, misconduct, IP thefts and as such, and around 50% of that are used for e-discovery purposes by service providers to the private sector and of course, the large corporation themselves when they have an internal unit to deal with that. That's in a nutshell.
Great. Thank you for the update. Kinda shifting to your recurring revenue growth, most of it is coming from expansion opportunities now. Given your high penetration rate among governments and the mid large federal segment, how does this affect the long-term TAM that you're seeing?
Indeed, we have a very respectful list of customers. We are serving more than 7,000 customers globally, and slightly higher than 5,000 of them are coming from the public sector and around 1,700 coming from the private sectors. We have the largest names on the federal side, state and local side, and a long list of small law enforcement agencies. When we are speaking about these customers, we actually find ourself in a situation whereby though we are penetrated in all these names, the additional opportunity of penetration there is much bigger than, you know, we can actually see. In principle, we started the forensics lab.
We put our first step into these customers. These customer needs are constantly growing day in, day out by the mere fact that 90% of the data which is used into investigation is digital data, and most of it is coming from mobile phones, which is our specialty. While we do have the logo or the customer, we don't necessarily fully penetrate it into their entire buying centers. Many of those customers have additional departments, field offices, and other operation whereby we still did not touch the needs of these internal customers.
We are stepping outside of the forensics lab in the past few years, stepping into what we call the bridge between the forensics lab and the investigator, the ability to share in a compliant and audit trail manner the results of a digital collection and analysis with investigators and prosecutor, which is a big pain currently as police is scrutinized for its transparency with the community. We provide the analytic tool for the investigators to be able to go through enormous amounts of digital evidence, which is collected, and find this needle in the haystack, this golden evidence that will lead them into closing the case.
From a penetration perspective, we are more penetrated in the TAM related to the collection and review, but we are really scratching the surface, and this is really working in the green field when it comes to the sharing and review of data between the forensics lab and its internal customers, and then after the analysis of the data.
Great. I think that makes sense. You discussed churn on your last earnings call, which has been about 9% on average over the past few quarters. Can you help us understand the different drivers of both license downgrades and cancellations that you're seeing in any given quarter?
Yeah, for sure. I would say that our churn is built out of churned licenses with customers that are still retaining their business with us, between customers that stop doing business with Cellebrite, and with customers that Cellebrite, for business reasons, ethics reasons, and sometimes even legal reasons, decide not to continue business, doing business with them. In our last earning call, we mentioned around 2% of the business is coming from the last group of customers. Cellebrite, over the past years, have implemented legal, ethical, and business screening of customers and countries whereby we do business and is stepping out from the long tail of countries in places like Africa or some places in South America or Asia Pacific voluntarily. By that churning the license there.
This is our own business deciding to focus on the main regions that we want to do business with, which is North America and Western Europe. The other two components are very small law enforcement agencies. If you think about the U.S., there are around 18,000 law enforcement agencies. Vast majority of them are extremely small. In many of them, there are not even the capabilities to entertain and investigate digital information, which is collected during investigation. In those of them that do have the budgetary capabilities, not all of them can repeat and utilize and put their hands on these budgets year in, year out. Some of them, because of budgetary reasons, may resort to cheaper solutions or to receiving services for the nearest county, larger forensics lab or FBI field office and so forth.
All of the churn that we are seeing is coming from those small agencies. We are very proud by the mere fact that our federal customers and our strategic and large customers, we do not have churn with. It's actually for the past years, we are seeing zero churn with our most larger customers. The last part of the churn is coming from customers that are reducing their business with us. They are still a Cellebrite customers. In most cases, Cellebrite is still their main go-to. Cellebrite solutions are their still main go-to tools when they need to do a collection and analysis of mobile data or cloud data.
From either budgetary resources or because they are working in a manner of opening a task force for a certain period of time, licensing solutions for this task force, task force achieving their target, closing the task force, shelving the licenses. We see ups and downs between those customers, and that is also part of the churn that we are experiencing.
You know, and I would just add that, you know, as you look forward, you know, as Dana outlined, you know, there are a couple of areas where, you know, I think through a combination of seeing the voluntary churn, you know, the countries that we've elected to withdraw from new sales activities, for example, that should largely dissipate as you move into the second half of next year. The steps that we've taken from a inside sales perspective and how we approach smaller customers can, you know, hopefully result in some modest improvement in, you know, that other element of churn.
Great. I think that makes sense. Then, shifting to everyone's favorite, you know, tech topic of 2023, you know, you've had AI as a part of Pathfinder for a few years now. How has that development continued, and how do you expect to expand into other product offerings?
I would actually say that we started implementing AI capabilities in one of the most popular solution of Cellebrite, which is the Physical Analyzer. It's the solution that actually takes all the collected data, decode it, and make it readable and to the examiner in the lab. Since most of the digital sources create a huge amount of data, also the examiner in the lab, as tech-savvy as they are, they need something to help them go and screen through this enormous amount of data. We've introduced quite a lot of homegrown solution around image resolution, face recognition, language capabilities, geolocation and so forth to help them sort through this amounts of data. Pathfinder is meant to be used by investigators.
Investigators, detectives are usually not as tech-savvy as examiners, and the need there to further take the ability to use AI to help them answer their main questions of the investigation of who and where and how is critical, especially because investigators are not dealing with one source of digital data. They might have 10 phones, three CCTV footage, and four computers when they need to go through all the digital data in the investigation. The challenge there are much bigger. There we are using much deeper AI capabilities to help them sort through this data and flush out, as we said before, the golden evidence maybe.
Sure. No, you know, a lot of that capability is somewhat similar to what's packaged inside of the Physical Analyzer. You know, I think you use a much different model, in terms of how you make it work for an investigator. Whether you're looking at images, you know, you think about the different image types and the time and impact you can make for an investigator if they're focused on something like child exploitation, for example, having to manually sift through images like that would be very draining. You can make a big improvement in their overall efficiency. You can look, audio, you can, you know, detect screams, gunshots, things of that nature.
The way that you build your model, the way that you train your model, and the customer's ability to influence that also in terms of how they train those models, becomes very impactful to the overall workflow and efficiency of an investigation. Just the amount of data contained on multiple devices is enormous, and so being able to sift through that as quickly and as efficiently as possible is key.
Great. Thank you. Then sticking with the product ecosystem, what does the roadmap in terms of development look like over the next few quarters?
I believe that we are challenged by few things, and we are still learning them. The first thing is the fact that we have introduced to the market from the first time a phone was encrypted, I think it was somewhere in 2013 or 2014, the ability to overcome the encryption of the phone, and then after also the locking on phones. These capabilities are very unique. They involve deep research of vulnerabilities and the ability to transform these vulnerabilities into exploit. That means that we can use that in a constant and very efficient manner through many transactions. Were packaged for many years, at a separate solution called Premium, sold initially only to vetted agencies.
We've been investing heavily in protecting, those capabilities, both on the software and hardware, measurements, so we can actually deploy them to the wider populations of our customers, because everyone needs the ability to overcome unlock and do a full file system of all the data that is being kept on the phone, not just what the operating systems allows it. Our research shows around 65% of phones arriving to a lab are actually locked, Every customer needs it. We've been able to increase the footprint of this solution to around mid-teens of our customer base UFED, install base, which means that we have still a lot to grow there.
We are doing it through dynamic models and dynamic pricing, and I think our very challenge is to get it to the last user at the smallest lab to cater both their needs and their technological capabilities. This is one thing, and we believe that collection review is huge growth engine still in Cellebrite because the challenges are growing and changing dynamically. If we look at the rest of the offering, our Guardian, our investigative data management and sharing is a really hardly scratching the surface. This is meant both to the forensics lab to be able to manage their entire processes within, but also to share in an audit trail and controlled manner the data collected with the investigators.
Until now, most of it is shared through PDFs or thumb drives, which can be lost, copied, shared with others without the control of the lab, examiners themselves, which feel very responsible for the data. The data should not be tampered or changed, otherwise cannot be used as evidence in court. We provide solution to bridge this relation between examiners and investigators. We only launched it December 21, end of December 21. We started selling this solution in 22. It requires change of mode of operations of the labs. It requires a lot of education, and we are at the very early adoption. Those who adopted it use it very nicely and constantly, so we feel very comfortable in our ability to grow through the introduction of this solution.
Of course, the Pathfinder, the investigative analytics, what every detective in the modern world needs because they cannot manage digital investigation in a manual manner. Everywhere we walk into our field of expertise and customer base, we see the ability to grow and grow substantially.
Great. Great. Thank you. Then sort of turning to a strategic, you know, way you look at revenue, how are you viewing private enterprise, as a whole market?
Private, until a few years ago, was something that Cellebrite was not fully focused on. We've done sales there, but they were sporadic in the way that they've been done, and mainly by customers approaching us. We have acquired a company called BlackBag, in early 2020. This company complemented our offering of mobile and cloud with computer forensics. Computer forensics and computer is actually the number one tool when you go into corporate investigation and e-discovery. While mobile phones is actually the number one tools you go to in criminal investigation. We are very proud to say that we established a private sector business unit. The person who used to be the CEO of BlackBag is now managing this unit as the, our general manager of the private sectors.
We believe that currently we have great solutions for them on the collection of data. There is still more to go there through either partnership or through inorganic growth, because after you collect the data, you need to process it, and you need to review it and analyze it, and this is a place where we don't play yet. Of course, when we are collecting data, and we also collect data remotely as employees are working from home now from both mobile and computers, you can use these capabilities to do more and help in malware detection, incident response and so on. We believe that the private sector being currently around 10% of the business with the right inorganic investment can grow to be much more fundamental in our business.
Yeah. I think the only thing I'd augment that with is that we've taken steps over the past year to, you know, really focus the sales organization on larger accounts, service providers like the large accounting firms, large consultancies that work with mid-size and smaller enterprises. You know, I think that in combination with a new sales leader is starting to make a very tangible difference in the effectiveness of the top line performance. We've seen that accelerate into the high teens in the first quarter. You know, growing off a small base, but moving in the right direction. You know, it would take a lot to move the needle in terms of, you know, the mix between public and private sector.
You know, I think standing on its own, it's, you know, pointed in the right direction in terms of the growth trajectory that it's on.
Great. Makes sense to me. Then shifting to competitive dynamics, you know, for competitive opportunities, which companies are you seeing most, and how are your win rates coming out of those?
We are working in a multi-vendor environment, and I think this is a great advantage for every company that is working in our market because our customers will, in most case, when they can afford it, will use more than one solution in their in their forensics lab. That is done because they cannot be attached to one vendor. That is done because in high-profile cases, they need to go through a validation process using additional tools. We are very proud by the mere fact that our tools are primary tools with our existing customers. If you look at their entire install base, most of it will be Cellebrite and then other solutions. These, our solutions will be the go-to tool when they need to do their work.
We are seeing a wide variety of competition on the forensics side, whether it's by providers of mobile collection capabilities by different companies. Most of them are dealing better with the legacy phones and much less with phones which require unlock and collection of the entire data from the phone, and especially the more newer phones. In principle, there is only one company that we see that can constantly provide some solution around iOS and very small capability around Android that can compete with us there. We are seeing companies who are competing with us on the decoding and an analysis of data coming mainly from the computer side.
Since most of the data is coming from mobile, we have the advantage of expertise and capabilities, and we are doing, in our perspective, and also by our customers' usage rates, a much better work. As I said, we are assuming that our you know, share on the mobile collection is review in those forensics lab is around 40%, and it's taking into a consideration the number of competitors there. It shows our strength and capabilities in this market. Stepping out of the forensics lab into the investigation world, especially where we are playing, which is both the share and review of data to the investigators and the investigative analytics, there are not many solutions which are targeted to our customer audience.
Most of the solutions are, I would say, general ones, so their capabilities are not at the same level that we are bringing our solution, which is dedicated to investigators and to the sources that are coming into investigation, but they are there. Where, when we are competing on a very large deals, the deals that we've announced last year in Europe, one of our competitors was Palantir, which is actually not an analytics solution, it's a fusion solution. We are seeing specific solutions targeting analysts, specific solution targeting large organizations, and those who are more specified on the computer side of the market.
Great. Then sticking with competition, one of your competitors, Magnet, was acquired earlier this year. How will a combination of Magnet with Grayshift affect competition for public contracts?
Magnet and Grayshift were collaborating for years now. Magnet was the distribution arm for Grayshift for most of the years that they've been working together. They are complementing each other by the fact that Magnet is specializing in computer forensics, they are very good at collection and review of computers' data. They can do some review of mobile data, not at the same quality that we are doing because of our intimacy with the data. We, on the other hand, are excellent in mobile and are doing fairly well computers. Grayshift is complementing what Magnet is doing with the new high-profile phones of iOS or Apple. They can do some Android, they are years behind us in their breadth and depth of capabilities around Android.
They can give some solution to the mobile. They do not do the decoding and review of mobile. When we look at Cellebrite brings the entire package, including cloud collection and analyze, including the ability to analyze data that is collected from infotainment systems in cars, drones, and so forth. Nevertheless, they are good companies, well-managed. They have nice technological assets. You know, you should never underestimate your competition, right?
You know, I amplify that just by saying, you know, they're very credible competitors, you know, with very strong core competencies in each of their respective domains. I think that when you think about, you know, some of the capability that Grayshift may have, for example, in the iOS, and with Apple, you know, we are an industry first provider for iPhone 14, for iOS 16, and that first mover sort of leapfrog advantage that we have right now, we can see that translate into higher usage by our customers. They are, you know, we're a primary platform, and the number of shops where we are, you know, the primary for both Android and iOS is increasing.
That will hopefully, you know, leave us in a very good position when it comes time for those customers to renew, for them to expand their licenses, and, you know, for them to look to us for other data types, whether that's computers, whether it's cloud, et cetera.
Okay, great. Maybe we'll squeeze in one more before we open it up for Q&A. Shifting to customer profiles, how does the average customer size affect the number of subscription products in use as well as the opportunity for account expansion?
I'll start with the long tail customers, those around 3,500 customers that we serve globally, most of them in the U.S. Their average spending with us is slightly below $20,000. Also from technological point of view, they cannot deal with the most advanced capabilities in many cases, and they are buyers of our UFED and Physical Analyzer. Some of them are actually buying also our more advanced collection capabilities, and in rare cases working with them, they can even afford to bring the Guardian into their offering. All of them are actually customers of our training academy, which we forgot even to mention. We have a very nice portion of around 10%-12% business, which is composed 66% of training academy.
We are certifying anything between 8,000-12,000 examiners and investigators a year. We are certifying them to testify at court as experts, and we're recertifying them every second year. Everyone who is using our UFED solutions most likely has been trained on our solution and retrained again and again because we are all the time bringing more capabilities. Around 35% of our services relate to our Cellebrite Advanced Services for those small customers that actually cannot deal with or cannot afford the more advanced capabilities, and they need to overcome unlocks of phones.
They can send those phones to any of our Cellebrite offices around the globe that provides a forensics lab capability by helping them overcoming the unlock of the phone and do full file extraction and bring the information back to them so they can analyze because we don't want to touch the data itself. When we look on what we call mid-high and strategic customers, those are doing business with us anything between an average $50,000-$250,000 ARR per year. These are the customer where we can actually sell our entire offering. These are customers that we are seeing amazing expansion with the new offering of the Guardian and the Pathfinder and of course the advanced capabilities because, one, most of them can put their hands on the right funding.
Second, they have the capabilities, and they have the understanding how much it can efficientize their workflow. Our very important customer group, which is the federal government, in the U.S., it's around slightly less than 50% of the business here. These are huge customers, and they're spending with us can move from hundreds of thousands ARR to millions of dollars ARR.
Okay, great. Thank you. At this point, is there any questions from the audience? Feel free to raise your hand.
As I understand about your business, most of this, the revenue is coming from collect and review part of your offering and analytics is still in the nascent stage. There, how do you see the adoption picking up on the analytics side, and what estimations of growth do we see for coming from that part of the product offering? Second question is around understanding your scope for expansion in the medium term. Like as I understand, ARR for your subscription revenue is the key driver of growth for the company. What drives the expansion within the existing accounts? Is it price increase? Is it seat increase? How do we see that shaping up over the medium term?
I'll start by actually answering the latter questions, and then we can go back. Most of our expansion is coming from selling more to the same customer base. I invite you all to go into our investors deck, and we are showing there an ARR average, which shows currently price increase is a very small contributor to the growth compared to the increasing by selling more to the same customer base. You want to say something?
Yeah, no, I was just gonna say, I mean, we are doing some work right now with third-party advisory service to make sure that we're very thoughtful about capturing, best capturing the value of our product offering into the marketplace and how we price, how we package the solution, and how we differentiate, you know, the basic examiner offering UFED from our Premium capability. I think that there's some opportunity as we move forward. You know, we're seeing that, you know, our competition is quite aggressive with price, and that can create opportunity for us.
You're rightly saying that most of our renewals are coming from the collection review business because this is our largest install base and the offering that we are selling for the longest. It is very natural that this will be the largest contributor to our revenue. Of course, not to the ARR, because the ARR, it's actually maintaining our ARR. While we are seeing growth from the collection review and a very healthy one, as a percentage of the initial business, we are seeing higher percentage growth in the Pathfinder. The Guardian is really at a early stage, everything is growth there. I don't want to say anything, but the basis of which the investigative analytics grow is smaller than the collection review.
Although growing substantially in substantial percentage CAGR, the total contribution to the ARR growth is still small.
Also, I understand that you're free cash flow positive, you have healthy cash balance right now. Any focus on buying back, or would that be used for inorganic growth for scaling the computer analytics piece of business or other use cases?
Do you want to answer?
Sure, I'll start. In terms of use of capital, you know, I think that in the, you know, as we look forward, you know, we ended Q1 with over $220 million in cash and investments. You know, the first priority is to continue to support the growth of the business. We're a minimally capital-intensive business, which means that, you know, inorganic growth through M&A activity is certainly, you know, an area of high interest to us. Whether it's technology bolt-ons to the core products and capabilities that we have today. Opportunity potentially to expand into adjacencies that can further expand and increase our TAM would be of interest as well. You know, I think you'd mentioned share buyback.
You know, I think we wanna be very thoughtful around use of capital in the near term, with a highly concentrated ownership and limited liquidity. You know, I think that we're very, you know, we wanna be very careful that if we would repurchase shares, that it wouldn't result in, for example, a large shareholder who owns close to 50%, tipping them into a majority position. I think that there are very limited, you know, near-term opportunity for share repurchase. Over the longer term, you'd look at all of the different levers that this company has, given its cash flow, generation capabilities, whether that's share repurchase, dividend, and acquisition, as use of, you know, viable uses of capital.
Great. I think we have time for one more, and we had one on the on the left side.
Thanks. Sorry, I'm new to the company, basic question. Just to understand the technology, on the iOS and Android, what is the technology exactly? Just how important and defensible is it over the longer term?
I'm not a tech person, so exactly, I cannot say.
Yeah . I think I can better answer the second question. Look, we are doing it for many years. Cellebrite grew from understanding the operating systems of phones already since 2000. We've done it initially to support a mobile operator when you come with old phones wanted to transfer the entire information to target phones. This is our expertise, and we've been doing it and, you know, making it, getting better at it year- over- year. The biggest thing that Cellebrite is doing here is being able to attract and retain the vulnerability researchers and the decoders that we have as teams in Israel and globally, by the way.
It's a small community, and the ability to retain them as employees and not as lone wolves, I would say, is part of our expertise, and they deliver on a constant basis. There, there is no way to foresee the future, but we actually can provide a good track records of the ability to do so, and we believe that we'll be able to continue doing so in the future as well.
I mean, if you think about how the smartphone has evolved from minimal, if any, security to not only having, you know, a six, eight, 12-digit password, biometric, you know, scanner on it as well. You know, if you need to, for, to lawfully access that device, extract the data off of it, be able to then take the ones and zeros that you've removed from that device and basically decode it. Restructure that data into a format and structure that is useful to an examiner. That involves an awful lot of investment and very talented people to keep pace with the innovation that we see from the OEMs and the operating systems that ride on top of the phone.
All right. Well, we are unfortunately out of time. Dana, Andy, thank you so much for being here today. We really appreciate your time and your insights.
Thank you very much.
Thank you for inviting us.