As we get everybody up on stage, I'll read a short disclosure. For important disclosures, please see the Morgan Stanley Research disclosures website at morganstanley.com/researchdisclosures. If you have any questions, please reach out to your Morgan Stanley sales representative.
Welcome everybody. I am Meta Marshall. I cover the networking space here at Morgan Stanley, and we're delighted to have F5 Networks here with us today.Frank Pelzer , CFO, and Kara Sprague, EVP and GM of Application Delivery and Enterprise. My record of nailing last names is continuing. All right.
Over the past few years, F5 has had a bit of a renaissance, not only from internally within the portfolio, but also just as ADCs went from being viewed as mature to kind of being viewed as a very relevant market. You know, what Maybe just, like, remind investors, like, what has kind of caused this resurgence of the core ADC?
Well, before I respond, I need to get our safe harbor on record.
Okay.
Please note our discussion today may contain forward-looking statements which involve uncertainties and risks. Our actual results may differ materially from those expressed or implied by these statements, and please see our SEC filings for information on these risks.
Okay.
Great question. Yes, it's true that ADC is only a piece of what F5 does today.
Yep.
Over the last several years, we've expanded significantly into security, predominantly application security. We now have a broad portfolio that includes things like web app and API protection. That includes WAF, API security, denial of service, anti-bot.
We also have SSL termination, traffic break and ex-inspect, as well as Identity Aware Proxy solutions for customers. It's a quite broad set of security capabilities. Our security business has now surpassed $1 billion annually. It's been a big push, and that's now about a third of our total revenue.
Okay.
You asked specifically about ADC and what's driving the resurgence in ADC. I think the important thing for folks to understand why is ADC seeing this kind of renaissance is to understand what is an ADC and what does it do.
Mm-hmm.
The best analogy that I've come up with in my five years at F5 is ADC is the beating heart of an application infrastructure for companies. It basically drives traffic, it filters traffic, it steers that traffic to where it needs to go, and it also transforms that traffic if it needs to. If you think about any application and, you know, average person has 50 to 70 web apps sitting on their phone, you're interacting with mobile applications in your browser every day. Those all have some sort of ADC technology that they're sitting behind them.
Got it. Okay. I'm always one to love the analogy, so I like that. We'll definitely turn back to the security business as we go throughout. You know, I think another impressive thing that you guys have done over the last 5 years is just positioning for new and existing workloads 'cause people would've thought kind of the ADCs as more relevant to kind of premise data centers. Where do you think customers are in figuring out what their end state is going to be with these workloads and kind of application framework.
Mm-hmm
... you know, or does, you know, I know you don't necessarily... You're agnostic to what decision they make, but just where are you seeing them in this kind of decision framework?
Okay, as you might expect, customers are existing along a spectrum.
Yep.
You've got some customers that even today remain strongly convicted that their future is 100% public cloud.
Mm-hmm.
You've still got those customers that you meet with that are talking to you about how they're starting to dip their toes into the water of public cloud and meaning they haven't even moved anything.
Yeah.
Big, big spectrum. What I have seen as a major shift, however, in the composition of those customer attitudes in the last 18 months, is the majority of our customers who 5 years ago were telling us, "Public cloud is where we're going. You guys are a data center dinosaur. You're going extinct...
Yeah
... and public cloud's gonna eat your lunch," are now saying, "Our future is hybrid and multi-cloud.
Mm-hmm.
We see a persistent need for investment in some of our on-prem infrastructure. We have workloads that we believe are better served on prem, that are lower cost on prem or for whatever other reason we wanna keep on prem.
Our average customers are adopting about 2.8 public clouds. They're deploying applications in those multiple public cloud environments. They're increasingly deploying applications in edge environments.
Mm-hmm.
That's the big change that we're seeing. That change is not just something that we're hearing in our sales conversations or that our channel partners reiterate with us. You see this also in the data points.
We're seeing quarter-over-quarter growth numbers coming down in public cloud, which indicates that there's a bit of a stabilization going on in the market. You're seeing increasing anecdotes and reports from individuals and companies that are repatriating workloads and have extensive cost models about why they see on-prem as a less costly solution for them than running workloads in a public cloud. The third area I would point to is you see increasing investment from organizations and large enterprises in SRE practices.
Mm-hmm
... which enable their on-prem operations to run as smooth and as agilely as a public cloud might.
Got it. I mean, understanding that we're moving towards this multi-cloud future and kind of this hybrid opportunity, what can F5 do to kind of take advantage of that? Is it, okay, you know, now that you've given me this heart example, it's like is this your GCP and this is AWS, and you're just kind of adding more limbs to kind of the beating heartbeat? Or what can you guys do to kind of help people along with this hybrid journey?
Okay, you took the analogy somewhere I hadn't gone before.
Sure. Got it.
I'm not sure. I'll have to think more about that one before I commit to that.
All right.
If you use the beating heart example.
Yeah
... right? What do you do when you have to replace a heart?
Right.
Right. You make sure that the traffic is still flowing through something.
Mm-hmm.
You redirect it through something alongside, but it's a very costly, very expensive procedure, and a lot of people aren't jumping whole hog to replace their hearts.
Yeah.
It's a good analogy for how sticky and how critical this technology is in a customer's application environment.
Mm-hmm
... and why there is such an extensive need for customers to have deep trust of the vendors.
Yeah
... supply them with these capabilities. That's why we see our expansion of our opportunity set. We moved into modern apps a few years ago with the acquisition of NGINX. We've extended our security portfolio to include more things with the acquisitions of Shape Security and Threat Stack. We've also added additional capabilities in cloud delivery and CDN through the Volterra acquisition and Lilac Cloud.
Mm-hmm.
As we've expanded all of that, our addressable market and our TAM has expanded beyond, you know, what is the narrow focus of software and hardware-based ADC, which is, you know, just a few billion dollars. We now see an addressable market that's tens of billions of dollars across all of that, and we have retained the customer trust and reliance on us.
Mm-hmm.
They know that we are the place to go to secure and deliver applications.
All right. We'll step away from the heart analogy. The... I mean, I guess the question really is, you can address all of the different types of workloads and you can address the kind of security use case, but is there still a pain point that your customer has as they move to this kind of multi-cloud-?
Absolutely
... universe that you can help address?
Absolutely. Okay, let's think about what customers are doing today or what they have been doing over the last five years when they declared they're all-in on public cloud. Many of them had on-prem data centers. Many of them had a half-baked, or half-done, process to migrate into some sort of private cloud environment, so they still have some legacy stuff, some private cloud. Then they started throwing a bunch of workloads into a public cloud-
Mm-hmm
... usually the easiest workloads to move and migrate. Then their developers got wind that they could use public cloud and said, "Hey, I want this other one over here, and I want this other one over here." Now you see most organizations when you ask them, "Okay, well, where are your applications?" They've got their on-prem traditional stuff. They've got a private cloud going on. They've got some sort of co-location facility. They've got multiple public cloud, and they've got Edge.
What they've done, because in one regime or another, they were going all in on one of these solutions, is they've siloed the operations for each of those, and that includes siloing their policy, including, for example, something as simple as the signatures that they apply to the web app firewall in the applications in that environment.
Along comes something like a Log4j, right? Happened earlier this year, and you ask customers, "How did you deal with it?" Well, they had to go custom lock down every single door and every single environment. That cost a lot of time. It was very difficult because they don't have transferable skill sets across all of these different operating environments, and it creates vulnerability for the organization.
Got it.
I hope that's a useful example of.
Yeah
... why this kind of fragmentation and inconsistency in siloing is creating vulnerability and cost and complexity. What we suggest customers do, you know, now that we're at this point where they're taking a step back and considering how do I, how do I rationalize my public cloud spend, is think about how do you rationalize your public cloud and operational spend across all of these environments,
Invest in a single set of capabilities, invest in a single set of policies, and deploy those things with consistency across all of your applications and APIs, regardless of what environment they're running in.
Okay.
That's what F5 does.
Yep. Got it. Maybe for you, Frank?
Yeah.
A part of these broader architectural changes we're seeing, you know, has caused your software growth to kind of be a, an area of strength over the past couple of years. There's been a lot of volatility on a kind of quarter-on-quarter basis. Given the full portfolio is being used across these broader implementations, like, is there a disservice that's almost done sometimes of focusing just on the software number? Just how do you judge, how to kind of express to investors the health of the business, going forward?
No, it's a great question, Meta. I think, let's go back in time.
Yep.
You know, when I joined the business in 2018, we had just had our analyst and investor day a month before. We split out for the first time that software and hardware from the product portfolio, and I think we were right around, you know, high single digits, low double digits in terms of the % of our product revenue coming from software.
At the time, I think there was a lot of discussion around F5 as will we be a going entity? You're a hardware company in a software world, you know, it should decline. It's just how steep is it going to get to 0 at some point as more workloads move over to the cloud, and will you be relevant? We needed to set up some metrics and some benchmarks that we reported to.
We gave people a timeframe of Horizon 1 and Horizon 2, which was from FY, you know, 19 to the year that we just had in FY 22. We said, "Hey, these are the aspects of what we wanna see," 20% software growth exiting, you know, Horizon 1 around 25% and then doubling that by the time we get to Horizon 2.
We actually updated that in November of 2020. Part of that transformation effort that digital transformation that everybody has been experiencing did lead to a lot of growth in software, maybe even more than we expected, and we exited last year at 51% of our revenue coming from software.
For the last four or five years, as a measure for our transformation, we thought it was really important and a very important disclosure. We're certainly not done with that transformation effort. We wanna continue to grow, but I think it's probably less important for the investors.
Yeah
... to focus, you know, only on that software growth, since we've got a much broader portfolio, since part of our value proposition is to meet customers where they are, whether it is software or hardware, whether it's perpetual or subscription, or utility-based pricing. It's wherever they are and wanna consume, we wanna be able to provide that for them. As the portfolio has broadened, as the consumption opportunities have broadened, we think it's probably more critical today to look at our EPS growth in the double digits that we have.
Yeah
... we've made commitments to. The Rule of 40 is our North Star, to try to find that balance between growth and margins on an overall basis. The cash that's being generated by the business ultimately, you know, is the measure of the stock.
Got it. I mean, part of some of that software volatility has just been that you guys have traditionally employed kind of an ELA type of agreement
Yeah
... for a lot of your software products. You know, why has this been kind of the approach taken, and why keep that versus kind of more subscription that could be.
Yeah
Bring a little less volatility to that line?
Yeah. It's really kind of the way customers wanna consume. Despite the visibility that maybe we see as a business.
Yeah
... investors could see, it's really the way that our customers wanted to set up those agreements. We initially started talking about them in terms of ELA, but I think ELA have adopted, a philosophy in the market of a all-you-can-eat type consumption model...
Yeah
... which is not the way actually our agreements work. We've changed the name of that to a Flexible Consumption Program, and really talked about it that way for the last couple of years, where customers basically sign up for a commitment in usage and can vary that between the products that are part of that agreement.
There's a true up feature for our Schedule B and a true forward for our Schedule A, which is the vast majority of our contracts. It does give customers a budget certainty within their model to say, "This is what I'm gonna spend this year," and they're locked into it. Now we'll measure that at the end of the year and true forward to a new rate of consumption, and then they can budget that.
It gives them a lot of certainty as to what their budget's gonna be for the year. It also gives them flexibility to consume products in the way they want within that, within that construct. It's been a really a way that customers want to consume our products.
Mm-hmm.
It may be, you know, a little less straightforward in terms of revenue recognition for everybody else.
Yeah
... and a little more volatility, but we're making that trade to allow customers to consume it the way they want. I mean, we offer that, but we also offer perpetual, and we offer SaaS-based solutions, you know, for a number of our products. We've got a very, you know, we've got a very broad mix within our revenue recognition.
Got it. You know, I think people can understand the competitive landscape when it comes to the ADC market and kind of the more traditional market. As you broaden out into security, edge, you know, a lot of different areas, I guess, who or what are you running most as kind of an alternative solution?
In the security side, I'll focus mostly on our web app and API protection offerings.
Yeah
... the players that we would run into more often is Akamai and Imperva, Cloudflare .
Okay.
The reason why we win in scenarios against those players is we have best-in-class security efficacy.
Mm-hmm.
It's about, you know, different customers measure that in different ways. It could be about reducing the number of false positives, capturing the more complex, bot opportunities, but our technology captures all of this.
A second thing that we differentiate on is what Frank was just describing, which is this choice that we offer to customers in terms of extreme flexibility and deployment options as well as consumption options, whereas those players are all, cloud-based subscription only.
Mm-hmm.
We can extend for customers, you know, across their on-prem and public cloud deployments. We can offer them hardware, packaged software, SaaS and managed services. We can offer perpetual if they need that.
Got it. You know, we spoke kind of kicked off starting about the core ADC market and just kind of the resurgence that market has seen. You've noted that there's kind of been share gain opportunities as maybe the competitive landscape has become a little less focused. Is there a way to think about how you extend the growth period we've seen kind of on the hardware side? Just what growth opportunity you see within that market that's maybe just not pure market growth?
In terms of share gain opportunities, we're seeing that on both the hardware side and the software side.
Okay.
We are seeing that for a couple of reasons. One, our continued investment in innovation in our systems business. We are in the middle of a right now a refresh cycle in our appliances, so we have come out with our rSeries appliance line. They've been out for about 15 months now.
Mm-hmm.
We also have a refresh opportunity for the chassis form factor that we have. That's called VELOS. It's replacing VIPRION. In both VELOS and rSeries, you know, there's significant amount of innovation that we're bringing to market that is very compelling for customers because frankly, there hasn't been a lot of innovation coming from other competitors.
A couple things I would point to is that these systems are now much more highly automatable. Fleet management is much more simplified. There's a compelling TCO argument for just that, in addition to the fact that they are multi-tenant, they can host multiple tenants.
On the software side, our reasons for share gain there is because of this proposition of saying, "Look, if you wanna deploy our hardware on-prem and get hardware acceleration for critical workloads there, but then have consistency in your policy and deployments in other places," that's what you get by deploying our software, either on-prem or in public cloud, and that's what you get by using our SaaS and managed services capabilities.
Got it. I mean, having looked at F5 for a long time, you know, we started to kind of get into this refresh cycle story. You know, you just talked about iSeries, rSeries, you also talked about VIPRION. Just how is this refresh cycle maybe different than kind of refresh cycles of old?
Okay. This is the first time we've done a refresh cycle for our chassis. The last refresh was, you know, some decade plus ago.
Mm-hmm.
In terms of rSeries for the appliances, the last refresh we did was in the 2016, 2017 period. Quite a lot has changed. I'll name four things. One, our overall product business has now surpassed 50% software.
When you look at what or try to estimate what would be the kind of financial impact of a refresh cycle and how it shows up in our metrics, it's much more muted now because it represents, you know, at this point, a minority of the product business. A second difference is that the rSeries introduction came at the same time as we were seeing unprecedented disruptions in our supply chain.
Mm-hmm.
We've been navigating a number of component shortages that impact, you know, some of them impact the iSeries, so the previous line, as well as others impact the rSeries. That is inserting, a new freshness-
Yes
...in the refresh process. I talked about there's innovations. Historically, our appliance refreshes have been very focused on just improved price for performance.
Mm-hmm.
With rSeries, we're introducing some fundamentally new value propositions. I talked about the automatability, I talked about multi-tenancy. The fourth thing I would highlight is that, in this refresh cycle, our primary competitor in the hardware ADC space has been taken private and is showing signs that they're reducing investment and support for perpetual models and for the hardware business. There's a different competitive dynamic out there.
Got it. I'm gonna pretend that I haven't been here for the past two cycles. All right. You know, you just mentioned supply chain challenge. Have some of the supply chain challenges pushed customers towards virtual solutions, or is it really just still a, "That has nothing to do with the decision process, it's really how their cloud transitions are going"?
Yeah, I think the natural way to say this would be, if hardware isn't available, let me just pick the software solution. The reality is there's a lot of application infrastructure that needs to change in order to do that. The work and the planning required, the execution of that is actually longer than the supply chain, even in the worst of times, the supply chain environment. I think it certainly probably sparked the idea of we need to invest more time in thinking about this in case there's another situation like this.
Yeah.
For people who are starting from a standing stop, you know, now I can just automatically flip a switch and pick up a virtual edition, it isn't likely to happen that way, and we haven't seen it happen that way. For people who are starting down that path, maybe they were far enough down where they could make that change, but it really wasn't a meaningful driver for our software business in the last couple of years.
Got it.
Just to put some numbers on that.
Yeah.
You know, in the worst of the supply chain, situation, the lead times on our products at the worst case got into the 26 to 28 week period, which as Frank is saying, if you're a company and you've been investing in hardware, you're gonna need more than 6 months in order to rethink your application, and solution topology.
Yeah
... in a way that would make sense for deploying these technologies in a virtual form factor. You can't just replace one for one.
Got it. I mean, you started off talking about almost a third of revenue kind of comes from your security-based...
Mm-hmm
...portfolio today. You have a unique position in the traffic flow and layer four to seven visibility. Security seems like a natural area where you can kind of add to that portfolio. Just I think today, investors normally think of your security portfolio as just WAF. Just how broad is that portfolio today, and where can you kind of continue to take that?
Yeah, the portfolio is much broader than just WAF.
Mm-hmm.
We, we have a best-in-class web app firewall that does get a lot of attention because it is, you know, ranked among the top in the industry. In addition to that, we have API security that is related to the WAF, but there are different capabilities required for that around API discovery and other types of threats that attack APIs.
We, with the Shape acquisition, we brought in a very, very powerful machine learning-based capability and anti-bot. It's really more of a traffic profiling capability, so it's able to detect, is this a human interacting with me, or is this a bot? It passes the Turing test. Then, second thing it can do is it good traffic or bad traffic? Like, are they trying to do something malicious?
Really, really powerful for profiling traffic and determining, you know, do you block it, do you redirect it somewhere else? In addition to that, we have something called SSL termination, which does traffic break and inspect. So we have customers, for example, that they are unencrypting every single packet that comes into and out of their DMZ.
Mm-hmm
...in order to inspect that for malicious stuff, do other transformations on it, and then pass it along its, on its way. We have identity and access solutions, which enable customers to basically say, "Only individuals with these access rights have access to this application."
That's like, that's what we call an Identity Aware Proxy solution. On the service provider side, we offer layer four firewalls, which include layer four DoS, anti-denial of service, as well as CGNAT type capabilities.
Okay, got it. Frank, maybe turning to kind of the operating profile of the business.
Yeah.
You know, you guys had probably one of the leading operating profiles kind of across tech, you know, 5 years ago.
Yeah
has come down a fair amount as you've just invested in acquisitions, doubled down to sell those efforts. Particularly as we go into a tougher macro period, just how do you think about working to optimize the structure of the company for this environment and still invest in kind of the growth opportunities laid out?
Absolutely. Absolutely. I think the biggest, you know, Again, let's go back in time. When we take a look at the change of, you know, what was an 85%-86% gross margin to where it is today, and maybe a 36%-38% operating margin and where it is today.
Yeah
... the first hit was to the operating margin. It was because of the dilutive acquisitions that we did, to that. It was incredibly important for us to add, those capabilities, because of probably the lack of investment that we had had for the past 10 years. We just didn't have time to do all of that organically.
Okay
... needed to acquire. Largely, you know, with the first three acquisitions, we really built up the reach and the role that we serve for our application services through those, you know, NGINX, through Shape, and through Volterra.
We've tacked on a few others since, but nothing as meaningful to, you know, the architectural capabilities that we have today in relation to those. We have certainly seen operational leverage improvements from that 2021 timeframe to where we are today on the OpEx side. Take a look back 5 quarters ago and what happened on the gross margin side of the picture was very much supply chain related.
Okay.
Where we had been, you know, getting by through a challenging supply chain, but there's still broker market opportunities that were starting to take a little bit of a hit to the gross margin profile on our system side, froze up completely about a year ago, where there was no broker market.
We were unable to ship. That impacted our revenue, and we still had a certain amount of cost components in there that then started to bring down the systems. A quarter or 2 later, you know, the broker market starts to open up a bit, but at prices that were, you know, hugely inflated from the expectations that we had had going into any given year.
We were able to get, you know, some critical components faster than a 52-60-week lead time, but it required expedite fees. All of that is still working through the components that go into the box that we are making today and shipping out today. As we get through the end of this year, that will probably start to normalize as well.
Through both, you know, gross margin improvements on the system side, continued gross margin improvements on the software side because the economies of scale of SaaS business, they continue to grow and get better. And then operating leverage that we will continue to find in the business, by looking at, you know, overlap in the product areas, by looking at efficiencies in sales and marketing and G&A.
All of those are reasons why we believe, you know, we will get to that Rule of 40 and balance out that growth with the operating margins, you know, regardless of the environment that we set in.
Got it. Maybe just a last question as we wrap up. You know, it's certainly been the topic of the conference is AI, and just what are you doing within your own portfolio to kind of bring more automation, more intelligence kind of to your product portfolio into simplifying kind of customer networks, or just capitalizing on it within F5?
I would describe this in three areas. One is just using AI across F5 functionally in terms of exploring opportunities. There's obvious applications for generative AI in providing customer support. There's applications in the marketing domain around content generation and, basically helping simplify content generation for our team members there, as well as in the engineering side, increasing applications for using generative AI to build at least a first copy of code that they would use.
We are exploring all of those paths operationally. A second place I would point to is in the products themselves. We have been, for a long time, been using machine learning and advanced analytics techniques to do some of the sophisticated traffic profiling that we do.
We're also looking at extensions of that kind of technology to drive more insight and more automation based on that insight, which starts getting into the realm of what we've talked about with our adaptive applications vision, which is enabling applications to be much more responsive and adaptive to their environments that don't require as much manual intervention.
That will be very reliant on those kinds of AI-based and machine learning techniques. The last thing I'd say with regard to AI is, you know, I think we're seeing evidence in the market so far, we talked about it being the topic du jour, but there's evidence that this is gonna drive a huge renaissance and a re-resurgence in application growth and application and API growth.
Hopefully, if you take one thing away from this fireside chat, is that F5's business is inextricably tied to the growth and explosion of apps and APIs. We see that as net good for us.
Got it. All right. Well, perfect. With that, we're at time. Frank, Kara, thank you so much for being here today.