We're gonna start with a love letter from the lawyers. Then we're gonna go into our session.
Thank you, Tal. I will therefore read my love letter. This is our safe harbor. Before I respond, I need to get our safe harbor on record. Please note that our discussion today may contain forward-looking statements which involve uncertainties and risks. Our actual results may differ materially from those expressed or implied by these statements. Please see our SEC filings for more information on these risk factors.
Excellent. Today, I'm hosting François and Cooper from F5. I've been covering the company for many, many years, and I wanna focus on this session. We have a webcast also. I wanna focus on this session, on the big fundamentals. It's less about the quarter, less about kind of, I wanna actually focus the session on the big drivers for and how you drive growth for the next five years for the long-term investors.
That's basically the purpose. Maybe I'll start with a general question, François. If you can take us basically through how you see growth in your business. If you can give us kind of an overview of your business or your big buckets of the business, what's the current growth rate, where you have challenges, and where you have opportunities?
Great. Well, thank you, Tal. Thanks for having us. Let me just say a word about where we've been, and it will explain the kind of markets that F5 is exposed to today and where we see the growth. We used to be a traditional ADC company, and we have transformed to now a company that secures and optimize and delivers every application anywhere. That's really. Increasingly, when our customers interact with us, that's why they look to F5 as a partner that can secure and deliver their apps in any environment. With those capabilities, what markets are we exposed to? Of course, we continue to be exposed to the traditional ADC market. That is an extraordinarily sticky franchise that has a lot of durability, a lot of predictability. It supports traditional applications.
Traditional applications continue to grow, albeit there are, you know, I would say, single-digit growth in terms of the number of applications put in production. We continue to support that with our traditional ADC business. We have continued to gain share in this market, and because we have continued to invest in this area, we expect to continue to gain share in traditional ADC, which is hardware and software. Largely, I would say a lot of it on-prem, but increasingly with lift and shift, some of it in public clouds. We now also support modern applications, largely with NGINX and the addition of our F5 Distributed Cloud Services. Modern applications are growing quite rapidly, and NGINX is well- positioned as the technology that allows these modern applications to go in production and be secure and be networked, and be resilient.
This is an area where we have seen and continue to see very good growth. We are now also exposed to the application security market, both for hardware and software and for software as a service. We used to have a security footprint that was, I would say, limited with primarily web application firewalls. Today, we play in web application firewall, in Bot, defense against automated attacks, in DDoS, and in API security. We have a full application security stack, both for on-prem deployments and for SaaS deployments. Where we expect to see the fastest growth in this market is in the SaaS and managed services aspect of the business, you know, which we expect will contribute quite significantly in the future for F5.
I would say the fourth area, which is also an emerging area, is multi-cloud networking. Increasingly, applications are distributed for large enterprises between on-prem and one public cloud on on-prem to another public cloud. Networking these applications together, making applications talk with one another, and exposing one part of applications to the public internet, requires a lot of Layer 4 to 7 technologies, things like API gateways and ingress controllers and load balancers and things like that. We have packaged that in our SaaS platform and are starting to get quite a bit of traction in this multi-cloud networking market. Those are, you know, between traditional ADCs, modern applications, the whole application security and multi-cloud networking, those are, I would say, four of the core markets that F5 is exposed to, with different growth rates.
Perfect. Great setup, because I'm gonna outline my questions based on these four areas. traditional applications, clear. Your dominance is very clear as well. The only question is whether tools offered by cloud companies, because there is a trend where companies do lift and shift. They take the traditional application, run it in the cloud. Are the tools offered by the cloud companies, can they substitute the need for an ADC, or is the experience that companies maintain their ADC tools?
The companies maintain their ADC tools. I think we should separate. If you're building a new application in any public cloud, and it's a new nascent app, and you're building it in the public cloud, there are a lot of cases and reasons why using the native tools of the public cloud make a lot of sense. When you're talking about applications that either the same applications that become larger and go into, you know, production, maybe need to be in multiple environments h ave requirements for security and compliance, you know, significant, that's when the feature richness of ADC matters, and the fact that ADCs also are infrastructure agnostic, that matters, and you typically move to ADCs.
For traditional applications that already exist, that started on-prem, whether you're moving them to a public cloud or keeping them on-prem or moving them to a private cloud, 99.9% of the time, you're gonna want to remain on ADCs. Because if you don't do that, you'd have to refactor these applications, which is enormous amount of work with questionable ROI.
For most large enterprise that have applications in production, they will remain in ADCs, and they will lift and shift the BIG-IP Virtual Edition to be under the application if it goes into the public cloud or if it goes in a private cloud. That is, in part, why the BIG-IP franchise of F5 is so sticky.
Yeah.
In addition to that, I think one of the things that has changed over the last few years is we have invested in bringing the superpowers of the cloud to on-prem. You know, we're we have new generation of hardware and software, as you know, that is coming into the market, our rSeries and VELOS platforms.
What those bring is things like the ability to automate scaling an application quickly, the ability to do upgrades much faster, and to deploy new applications much faster. You know, hitless upgrades are on the horizon. Those kinds of things are some of the things that customers want from the benefit of the public cloud. We are bringing these things to an on-prem experience, which, you know, allows customers to have a better experience and operationalize platforms and consume more on-prem as well.
Got it. The second area that you spoke about was modern applications or cloud-native applications. These are built completely different way, in the sense that there is, first of all, architecturally, there's Kubernetes, there is containers i n terms of building blocks, a lot of open source. Explain us first the basics. Is this complexity making ADC more needed or less needed, or the functionality? Second, what is your role in this world of modern applications? How did it change from traditional applications?
Couple of big changes from traditional applications. Modern applications, as you say, are typically, they are container-native.
Yeah.
They are typically built in these microservices environment, and they are therefore, often more distributed.
Yeah.
The components of these modern applications can live in different places. If you want to provide application services to these applications, you need also lightweight application delivery that is in container form factors. That's the first big difference with traditional ADCs. Think of the traditional ADC as a 15-wheeler and a modern ADC for modern applications as a sports car.
Yeah.
Right? It's two completely different form factors of software. You know, one is GB, the other one is MB. I mean, it's just that order of magnitude different in terms of the size of it. That's part of the reason we purchased NGINX, was to be able to insert in these, in these environments. The other thing that is different in modern application is because they are increasingly distributed, there's a lot of east-west traffic in these applications. That east-west traffic goes through APIs, and APIs need to be secured. API security is emerging as a, an important practice in modern applications, and of course, we have a, you know, a very significant play in this area. I would say the NGINX.
One of the things on modern application is, Kubernetes is used as the technology that orchestrates the containers, helps you deploy containers and orchestrate them. When you wanna go into production, these different containers or microservices actually need to have resiliency for the application. You need to be able to network them together. You need to be able to secure them. If you don't have NGINX, you're gonna use four or five different technologies to do that. NGINX now is the technology that brings all of your networking and security together, to be able to deploy and roll out and scale your applications into production.
Right.
The thing about modern applications is they can scale quite rapidly, and you need to have underlying technology that scales horizontally. We just did a, you know, this quarter, we did a renewal for one of the large collaboration platforms that's built on NGINX. You know, this is a deal that was signed three years ago. We just renewed it, but the renewal was 10x the size of what we did three years ago just because of the scaling of that modern application, and that's what we're seeing in this environment.
This is more software centric, etc . Your software revenues declined last quarter. The growth is less than expected before. What are the underlying drivers in this segment?
Do you wanna start that?
I mean, what we've seen in the last couple of quarters is a lot of the kind of macro pressures that we've seen on the hardware side are also manifesting on the software side in relation to large new software projects. These are typically net new projects, multimillion-dollar opportunities, where budgets are being either constrained or they're being delayed.
What we've seen in a number of cases is, we've had opportunities with customers that have been sized, and we've effectively won the deal, where the customers decided they needed to either downsize the deal or delay it until they either have the budget or the operational capacity. Because there's a lot of change happening within some of the operational teams. That has led to a reduction in the near term of the closed deals. But what we have been seeing is the level of engagement with customers, the pipeline activity, has continued to grow. We are confident that over time, that growth opportunity will continue to rise.
Right.
It's just a matter of timing as to when some of these deals close. What we have seen is really good resilience on the renewal side of the business. That renewal opportunity continues to grow. These are the large multi-year subscriptions we've booked in prior years. They've come up for renewals, we've seen renewal rates in line with what we've seen from day one. That gives us again a lot of confidence in the long-term trajectory of the software business.
The renewals are on BIG-IP or on NGINX?
It's both.
Right.
Francois alluded to one large NGINX opportunity. Actually, that kind of back to the prior question, that's where we've been seeing a lot of opportunity with customers. We talked about traditional applications and modern applications. It's not always an either/or. A lot of times you have customers that are looking to modernize traditional applications. You might have, for example, a large retail application where you're adding a loyalty program, and that traditional retail application may be a more data center-based application that's supported by BIG-IP. As you're adding these modern components, you leverage NGINX just for the agility and simplicity that the NGINX application services provide. We're seeing more and more customers that are purchasing both BIG-IP and NGINX together in our flexible consumption agreements because of how they're seeing their applications evolve.
It's not just the new application that needs NGINX, but it's the continued growth in their existing applications as they add more modern components.
Right. Is there a way to know if this is just about economic slowdown? The alternative concern is that when the company is migrating from BIG-IP to NGINX, the demand is just lower for whatever reason. Maybe there are alternatives or maybe inherent, I mean, tools that the cloud has. How do we know this is about the current times, which, as investors, we don't care about it? Meaning, we care now, but not in the long run. How do we know it's about the current times and spending, and it's not about competitive losses, conceptually, competitive?
Yeah. I mean, a lot of it's just the conversations we're having with customers, the kinds of opportunities that we're seeing in our pipeline, but we still have not really seen, in most cases, any of this migration from BIG-IP to NGINX. The customers aren't, as François said, they don't refactor existing applications. It's very operationally intense effort, and there's a low ROI. It's, it's more about the timing of as they either replace the existing BIG-IP operating system with the next generation or as they expand what they do with their applications, leveraging both BIG-IP and NGINX.
Right.
We're not really seeing that migration.
We're seeing, I mean, you know, in terms of the concern of, is there something other than the macro? You know, we monitor that closely. First of all, we monitor our win rates, and our win rates against, you know, competition are as they have been in the past. There's been no material change there. We monitor the service attach rate. We're seeing customer are sweating their assets a little longer. Boxes that are three or four years old, that typically they would refresh, we see them becoming four and a half years old because customers are holding on to them or trying to increase the capacity. What we see is, it's really scrutiny on projects that customers want to do but can't do in the mean. I'll do a good example.
In our March quarter, in the financial services sector, which is, you know, it was a, you know, very acute anxiety, in part after the fallout of the SVB situation. We had a, you know, a large, 8-digit deal, that was, you know, postponed indefinitely. You could look at that and say, "Wow, maybe that's a competitive issue and an architectural issue.
Right.
The customer turned around, 3 weeks later and said: "You know, we can't do this thing immediately. We will come back to this big transformational project, but for now, I'm gonna buy some hardware so we can meet my capacity. Right? This is what we're seeing that really tells us that, you know, the, we are at the heart of the architectures that customers want to build for the future, but we're in the middle of this short-term situation where customers are delaying projects.
One thing that has changed fundamentally from six years ago in our business is this: six years ago, and I actually remember having these conversations with you, Tal, when I joined F5, we were hearing a lot of, "Hey, all of our applications are gonna be in the public cloud. They're going from a single location called a data center to another single location called the public cloud, and 100% of them will be there in six years." Whether or not we want to buy hardware or do anything with a vendor that has a history on-prem, maybe there's a question mark on that. Fast-forward to where we are today. That hasn't happened.
Yeah.
Right? it, and actually, it isn't happening, meaning what has happened and is happening is for most large enterprises. Remember, F5 is a company that's focused on large enterprises, not SMBs.
Right.
For large enterprises, what's happening is more and more of their applications are distributed in multiple infrastructure environments: private clouds, traditional data centers, and multiple public clouds. That gives them a lot of flexibility of choice of infrastructure. There's a lot of benefits of that. To secure applications across this environment consistently and to make these applications perform across these environments consistently is incredibly complex, and it is very manual.
F5 is essentially the only company that is infrastructure agnostic and can provide the security and delivery for all these environments and increasingly automate that. That is a position that we are basically beginning to occupy in the industry that is very unique, and it's a position of architectural strength. It comes from the technology assets that we've built together, both organically and through the acquisitions we've made.
Two related questions. One is on pricing and one is on competition, both related to one another, is how is the pricing and competition environment, both in legacy BIG-IP and in the new NGINX environments?
I, so in the traditional ADC market, the competitive intensity, I would say, hasn't changed. Because we have organically invested more consistently than we feel other players in the place, we feel that we're in a very strong position, both on hardware and software across any environment. It's in part because of what I shared earlier about these new platforms that are coming and what we've done there, the operational experience is different. You know, when we go into these deals, if you look at even if you look at the discounting practices we've had, I would say we are probably discounting less this year than we were in prior years.
To give you a sense of the competitive intensity, and that despite the fact that prices went up last year, but, you know, related to the supply chain thing.
I think we feel very good about the competitive intensity. In the case of NGINX, it's a different paradigm, and it frankly, there's a lot of dependency on which application we're talking about. Do we have expectations that application is going to scale? NGINX often starts with deals that are smaller size, so frankly, therefore, have less scrutiny initially, but then can scale quite rapidly. It's a more dynamic and different pricing environment than on BIG-IP.
Is NGINX and substituting BIG-IP, or is it a new opportunity? The reason why I'm asking it, is because there is quite a big price difference, at least at the beginning, there's a price difference. If NGINX is substituting, we might see a decline in the average price until volumes pick up, and if it's not, then it doesn't have an impact. How do you view NGINX? How customers view NGINX, substitution or complementary?
Totally complementary. I mean, 99% complementary, I should say.
Yeah.
It's very rare that we have an opportunity where customers, "I don't know if I should use BIG-IP software or NGINX.
Right.
The environments are different. If a customer has a traditional applications it's BIG-IP. If they wanna add a modern component to that application, typically it's NGINX that augments BIG-IP. If they're building a new modern application, in a public cloud or anywhere, and they need the networking and security, typically that's NGINX. Now increasingly, we have customers that don't want to own any software. They want us to provide all of this capability as a service, and that's F5 Distributed Cloud Services.
Got it.
Which is, you know, we introduced 15 months ago, but is gaining rapid traction.
How important is it, the cloud service? How important is it to the customer, and how important is it to you?
Let me illustrate your question w ith an example. I was just in India 2 weeks ago, and I was meeting with one of the largest private sector banks in India, who are an F5 customer. They started using F5 BIG-IP hardware on-prem to protect, some of their core banking applications. T hey lifted and shifted some applications in the public cloud. They went and used F5 BIG-IP software in the public cloud. More recently, they had another 200 applications, which they had not protected in the past, but they now needed to protect.
They wanted an as-a-service offering. They looked at competition of other folks who would do SaaS security, but they chose F5 Distributed Cloud Services because they wanted the same WAF engine to on-prem cloud and protecting these applications. F5 is the only player in the industry that can provide the security across all these form factors in a consistent way, and in the future, give a single pane of glass through which you can see that.
F5 Distributed Cloud Services is really important to us to answer your question, because we see a number of our customers that, for some applications, want to consume the technology as a service. They have this problem of the complexity of networking applications between cloud. F5 Distributed Cloud Services automates all that for them. It is both really important to us and increasingly important for our customers to solve their multi-cloud complexity and their, you know, application security issues.
Right. Cooper, the profitability of the cloud service is higher or lower than a BIG-IP or the competitive kind of the alternative?
Well, right now, it's, just based on scale, it's a operating margin. There's infrastructure that we invest in. As we scale the revenues, you'll see those margins continue to go up. It is a software-based solution, over time, we think those operating margins can approach the same levels we've seen at the BIG-IP level. In the early days, it's an area where we are investing in.
Got it. Okay, I'll stop here. Just before I move on, I just to see if there is any question from the audience. No? We're good. I'll continue. By the way, in my 20 years career, I've never asked a question and someone raised their hand, so I'm just saying.
You still do after 20 years.
I'm gonna be optimistic. I'll continue another 20 years. Security. I need to understand where you are and what is your value proposition. Security is a big, giant space. Define me the competitive edge that you have in the market, or where are you positioned in security?
Great. In security, we are focused as a company on an area called application security. I want to explain what that is. Understand that F5, the core thing to understand about F5 is that we understand application logic and application traffic at a level that's more granular than any other company on the planet.
When we go into security, that's the heritage we bring into security, is the understanding of what happens between Layer 4 and Layer 7. How do you manipulate application traffic to make it work, to make it secure? We didn't decide to go into security and go do all things in security. We said, we are going to bring this heritage of application fluency to being the best in the world at securing applications. The technologies that secure applications today are web application firewall.
They're a special type of firewall that understand application traffic in Layer 7. API security, because increasingly, application are decomposed, and there are billions. Enterprises deal with billions of API calls every single day, that if you don't secure them, it's a new attack surface that is a problem. Layer 7 DDoS, denial of service, attacks that are growing increasingly. One of the biggest problems at the moment for a lot of enterprise is BOT attacks, automated attacks on applications.
These 4 technologies now are part of a stack we call application security. We have a very strong position and a full stack in all 4 of them, and what we're seeing is customers want to consolidate. In the past, they may have bought these 4 things from 4 different vendors. It's these 3 vendors on-prem, it's these 2 vendors in the cloud, it's these other 3 vendors for CDN or at the edge. What we're seeing is, ideally, customers wanna have a single vendor that gives them this full security stack and ideally, the same across these environments. That's where we're positioned. This is where F5 is extraordinarily strong, and that's why we're seeing a lot of growth in this area.
What makes you positioned better than others for this?
Two things. One is very strong application fluency, so understanding of Layer 7 attack across all these vectors. API security, for example, like API attacks, you have to understand application logic to do that. To block them, you have to have an application heritage. Number one is that, and number two is the fact that we're unique in delivering that in any form factor. There's no other company you can go to that says, "Hey, I want my applications protected with the same stack in the cloud, in hardware, in software or in SaaS." You know, you have some edge players that will deliver that to you on SaaS and in their environment. You have maybe traditional ADC players that will deliver that to you.
In hardware, but you don't have any other player that can deliver that across the board. That's what makes us unique for large enterprises.
Got it. F5 started its roots in networking, between applications and networking. This is more in between applications and security. Is it the same buyer? Are you going through the same channels? Do you have to beef up your channels more on the security side? Speak about your go-to-market strategy.
Our go-to-market strategy has been, and most likely will always be focused on large enterprises and service providers. In large enterprises, it's, when I say that, it's really high tech, financial services, telco, retail, e-commerce, those large verticals. In large enterprises, our buyer personas are typically network operations and security operations a re really the two buyer persona that we spend a lot of time with.
The way we get to this buyer persona is through the F5 sales force, which is a high-touch sales force, and the several thousands of partners that we have that, you know, both fulfill and initiate opportunities for F5. In that partner community, the majority of them actually do sell security already and used to sell it with F5, but increasingly are now selling our security solutions. One of the things that is quite exciting for us, is the speed with which our partner community is actually embracing our Distributed Cloud Services and starting to sell SaaS to our customers.
Do you feel that the education of the channel, the readiness of the channel to sell your bigger portfolio, do you feel that you're at the right place, or is there more investment needed? Not in money, in terms of effort, i nvestment needed in order to bring the channel more aligned with your portfolio?
I think there is more investment needed. I think we're in the early stages of it. We're happy with what's happened, 'cause over 50% of the deals we have won over the last 15 months in the Distributed Cloud Services space have been opportunities that our channel partners brought to us. We're happy with their involvement, but it's very early days, and I would say probably today, 'cause we have thousands of partners. The majority of them, haven't yet, you know, won opportunities in this space, and some of them are not even aware. We have this offering. There's a ton of work that we need to do with our partners to accelerate the go-to-market and our presence in this space. I'd say we're probably 10%-20% of the way to where we want to be.
Great. We have the red light blinking here. It means that we ran out of time. Thank you so much.
Thank you, Tal.
Thank you.
Good conversation.
Excellent.
Thank you.
Okay.
Thank you.