Welcome back. For those that don't know me, Rishi Jaluria, I cover software here at RBC. I'm delighted to have with me from Fastly Kip Compton, who's the CEO, and Richard Wong, who is the CFO. Both relatively new team members here. Maybe let's just kick it off into gear with the evolution of the business. Fastly is obviously a very different business than the one that went public back in 2018. Maybe can you talk about the evolution of the business, kind of the focus on security, and how you envision this business evolving over the next several years?
Sure. I mean, a big part of our evolution has been the adoption of what we call platform strategy. I think I've only been with the company since the beginning of 2024. When the company went public, it was almost completely about CDN. There's a diversification story with the Signal Sciences acquisition and the subsequent build-out of our security portfolio. I think really the long-term strategy really is around the platform concept. The reason that we're focused on that is that we get feedback from our customers that that's incredibly valuable to them. Having everything on one platform that they need at the edge and having it work together out of the box and having a single unified support model, for instance, all is very meaningful to them. For our business, in turn, it reduces our cost of sales. It increases our differentiation.
We started to see progress with, as we've completed, in particular, the security part of the portfolio, or at least gotten more critical mass there. We've seen more wins that are starting out as multiple different product lines across our platform. We've certainly also seen cross-sell with our existing customers accelerating as well. Security's critical story right now. It's where we're focused on driving the next leg of growth outside of our core for the company. Behind that come things like compute, which is perhaps an even larger opportunity over time and is really going to benefit from being integrated with our platform.
Yeah. Awesome. That's a great place. Maybe let's start on security. Obviously, stand-out quarter for security coming out of Q3. Now it's crossed over above 20% of revenue, growing 30%. What's driving kind of that continued adoption across the entire security portfolio? How should we be thinking about what the kind of normalized growth profile of this business looks like going into next year and beyond?
It's a great question. I'll talk a little bit about what we're seeing driving growth, and then maybe Rich, you can comment on how we're thinking about growth rates going forward. I mean, it's not like I built the products, but my frame of reference is when I joined in early 2024. When I joined in early 2024, Fastly had a security portfolio that existed as one product, which was the web application firewall, which is a phenomenal product. It continues to win awards. I think it's seventh or eighth year in a row that we've won customer's choice from Gartner, which is kind of unprecedented. It's a great product, but it's one product. It addresses a bunch of use cases, and it's great. We really were lacking critical mass.
There's a market that I think it's Gartner, but that the industry analysts define called the web application API protection market. That comprises of more than the WAF. We embarked on a journey to build out that security portfolio so that we could fully address the different use cases in that web application API protection market or category. We added bot mitigation. We added DDoS. We added AI bot mitigation. Most recently, we added API discovery and inventory visibility. I think part of what's happening with the security growth is it benefits from being in the platform. Even as a category itself, we're just building out and we're able to address more and more use cases. We're able to avoid, for example, being disqualified in certain RFPs where they want that complete set of functionality.
What we're seeing is certainly strong growth on a small base with those new security products. We're also seeing continued strong growth in the WAF segment. Our hypothesis is that as we're completing this portfolio and driving towards critical mass, we're not just going to see the lift from the new products, but as a more complete solution together, it's a tide that raises all of our security product boats. Lastly, Rich can talk about the growth rates. We're also seeing the platform effect in these cross-sells. We talked about a large security deal in our most recent quarter that we announced, the third quarter. We talked about it as a security cross-sell in our top 10. It helped propel our security growth to 30% year- over- year.
We did not talk about it as much, but actually that customer for that use case also adopted compute. They were using delivery. They adopted security products and compute products to address a new use case. I think that illustrates the strength of the platform approach.
All right. Before I jump into the expected growth rate, I also would like to add that on security, we also had the go-to-market motion where Scott Levitt, the go-to-market president, he came from Akamai. He was also previously at Imperva, so he has the background in terms of selling security. Not only does he have that background, but he's done a great job building his leadership team where a lot of his leaders have also had a security background. We moved from a muscle like 15-18 months ago where we were very strong in selling network services to be able to do that cross-sell motion. By the way, there's industry expertise around selling security as well. In terms of the growth rate, we reported $34 million in security revenues for the quarter.
It was a $5 million sequential increase, 30% year- on- year. I would say that we look at the size of the security market and the growth rate of the security market, growth rates roughly like 13-14% year- on- year. Given our sizing and our position in the market, we do think we're going to grow faster than the market. In security, we haven't provided guidance on where we think it's going to be in 2026 and beyond, but we definitely think that given where we are in our product portfolio being more complete, we should be growing faster than the market.
Yeah. Yeah. The one thing I'd take is it was a question that came up a lot with that deal that propelled our growth. First of all, some people said, "Oh, tell us about the one-time deal." No, it's a win. We expect the business to continue going forward as our business model. That's something that we fully expect to carry forward. The other question a lot of people had was, "Okay, wow, you got this deal that you're talking about and your growth spiked. What would the growth have been without that deal?" Our growth would have accelerated even without that deal. We are seeing a broad acceleration, I would say, punctuated by now the ability, demonstrated ability to cross-sell security in our top 10 accounts.
Yeah. Maybe tacking on that, right? Obviously, you got a lot of inbounds on that big win you had with multi-product across all your product lines. Maybe on not talking about that specific customer, but how repeatable is that sort of motion right now that you've got Scott Levitt in here? You have more product depth than I think you had in the past, so better products and better go-to-market. Just how repeatable is that in these sort of large customers?
Yeah. I mean, first of all, it's a great call out that Rich made and you made on Scott. I mean, we talked about our go-to-market transformation, and he really has completely changed the game for us there. We're really excited about that. Each of those large customers is somewhat unique. I want to be careful about what we say about the repeatability of that type of deal. The types of use cases we're addressing, they all have in one form or another. We have interest from other large customers and similar use cases. It is certainly our goal to look at how we can replicate that success. I think it's very interesting because as we last year in 2024, we saw some difficult market dynamics. We increased our focus on essentially an extremely high-touch model with our top customers.
We do have a revenue concentration risk, and we improved the way that we manage that risk with this incredibly high-touch model. We are very, very close to those large customers, and in turn, they're close to us. I think that's one of the things that positioned us for this win, by the way, is there's a set of relationships and trust between the companies that helped a lot. As we're working with those customers, it's interesting because when you broaden that relationship into security, you actually, we believe over time, help to mitigate that concentrated revenue risk to some degree because you reduce the volatility in a given account. We are expanding our customer base outside of the top 10, which obviously helps. We are also building broader relationships that should have more revenue predictability inside the top 10.
Yeah. Okay. Great. I'm going to throw out a question that we just discussed before this, and it's a little spicy, but you had one of your major competitors report an outage. I know this because I couldn't use ChatGPT yesterday morning. Fastly's had outages. Others have had outages. AWS has an outage all the time. Just any thoughts on what you saw yesterday and maybe lessons from your own outages in the past you've seen that you can kind of share?
Yeah. I mean, we had a, I mean, everyone has outages. I mean, if somebody tells you that they can create software and guarantee that there are no bugs in them, you should be careful about what they're saying. We have a certain amount of respect and humility there. We have put an extraordinary amount of effort into engineering resiliency into our systems. We did see during that event a couple of things. We did see some of our customers move traffic onto our network so that they could continue serving their customers. We also saw, I mean, it's not that unusual, but we thought just the timing was sort of interesting. We also saw some DDoS attacks on our infrastructure, which, I mean, every day we have DDoS attacks and we mitigate them without it impacting our customers. That's what happened in this case as well.
The timing of that was interesting. It may have been some bad actors figured that if our competitor was having trouble, a great time to try to take down other players at the same time. We're not sure. Yeah, it's interesting. It happens. Customers care a lot about reliability, and it's top of mind for all of us.
Yeah. That's great. Maybe let's get into kind of the AI story here because I'm sure you're hearing the same thing I am, but post Q3, there's a lot of investment interest in Fastly as an AI enabler. And you have your products that you've built in that, the AI accelerator. You've had AI integration with MCP server. Maybe can you talk about maybe both, right? Like your own AI products that you're building and kind of what role that can play, but also your ability to just provide infrastructure for things like AI edge inferencing.
Yeah, absolutely. One of the nice things about being a platform business is that your customers innovate on top of your platform, and they bring you use cases, and they find ways to use your products. That has been the case for a long time with Fastly. Developers have found functions that belong at the edge or have a tremendous benefit from being at the edge. We have talked about that over time. I think a recent example of that on AI for a customer who has talked about it publicly is Shutterstock. You might not think about it, but they had a very large image library that they wanted to use for training. They realized something about Fastly, which is we are close to all of our users. Everyone thinks about, "Oh, it is close.
I can stream to my device, and I can deliver applications and so forth. We are also close to all of the major clouds, though, because we build out that performance and work with those players to have really great interconnect with them because the backends are there. In the case of this training data set, they actually thought about the other way around, which is we want to be able to do training in all of the major clouds. We need a high-performance storage solution where we can access that training data with great performance and good economics no matter what cloud we are in. They turned to us and our Fastly Object Storage product and implemented on top of that. We continue to see that sort of thing. We have some customers doing some inferencing using our Compute@Edge product.
We see more and more interest in those types of workloads, as you'd expect, and customers kind of finding what makes sense at the edge. Questions come up about GPUs and what we're doing there, although honestly, I've received more questions from investors on this topic than I have from customers. What we're finding is that a lot of the use cases that people are looking at today, the significant compute resources that we already have in our global network, are able to address them. We provision space and power so that we can deploy GPUs in the future should they become necessary. We want to be very thoughtful about our capital budget and land that the right way. You mentioned AI integration with MCP. I mean, I think that I'll wrap there.
I mean, that's a very interesting opportunity because right now, the typical pattern, ChatGPT wasn't working well for me either yesterday, oddly enough. The big global pattern is you or your application calling an API in a data center with a model. Could be ChatGPT, could be something else. As you go to Agentic, you're talking about multiple different models that are almost certainly not necessarily in the same data center. All of a sudden, the ability to route and cache context and broker things among those clouds looks like it may become much more prevalent. We certainly have customers who are looking at the edge as a place that would be ideal to do that, again, because of the connectivity that we have to all of those clouds, as well as the low-latency connectivity to the users.
I think there's a lot of interesting use cases, and we're going to be laser-focused on which ones make sense at the edge where the power of our global network and our platform can really make a difference.
Yeah. No, that sounds great. You brought up CapEx, so maybe I'll dive into that. You talked about CapEx at about 10-11% this year, which would imply a little bit of a spike in Q4. Can you talk about, number one, what's causing, where are these investments going? As you're maybe relatively early in some of these opportunities, how should we think about steady-state CapEx over the next couple of years?
Yeah. We previously, prior quarter, had guided to about 10% of revenues for CapEx. I think in the most recent earnings call, we said 10-11%. Our Q3 was a very strong Q3. We had a $10 million quarter-over-quarter revenue increase, and we guided up for Q4. I think when we look at capital spending, we want to instill the same operational rigor and discipline that we have across our entire business, which is really watching and making sure that we have the right level of capital investments for what we see coming down. I think given the strength of Q3 and the raise in Q4, we wanted to make sure that we have the capacity to make sure that the infrastructure is being used effectively and efficiently. We definitely brought in some CapEx in Q4.
We do think that we see the growth in Q4, which is why the guide was up. I think as we think about the longer-term metric, I do think that right now we're still thinking 10%-11% is the right level of investments for the business. Having said that, that number includes capitalized labor. I think that going forward, we may actually be a little bit more disciplined, will be much more informative around what's the infrastructure CapEx as a percentage of total revenues. Right now, that number is around 7%-8%. I think that we might start guiding just to focus on the infrastructure CapEx side so that investors get a pure, how much are you spending on infrastructure for the growth that you're seeing?
In particular on the capitalized labor side, it is the IUS or internal use software, which, I mean, we drive our R&D strategy to drive growth in the company and solve our customers' problems, not with an eye towards how it shapes the quarter-to-quarter variances in IUS. We follow the accounting rules. That does, to Rich's point, introduce some variance in that capital number. I am not saying that is what drove the Q4 thinking, but that is something that we want to clean up in some of the numbers that we talk about because we do not try to actively manage the IUS number. We drive an R&D strategy for the company, and that falls out of it.
Of course, of course. Maybe turning to gross margins, you're knocking on about 63% gross margins in Q3. Can you talk a little bit about what structural factors have really helped you sustain this above 60% type gross margin? As we think about greater security and compute mix and bringing AI into it, just how should we be thinking about gross margins against steady-state basis?
Yeah. In Q3, we reported 62.8% gross margins. We had about $1.6 million in tailwinds that really helped that number. If you exclude that $1.6 million tailwind, we are about 61.8% in terms of gross margins. I think the improvement in gross margins you have seen over the past kind of few quarters is really driven by a lot of really good work that our traffic engineering team does. They are really spending a lot of time on optimizing the network, making sure that we have the best customer experience. Our customers have the lowest latency, but also at the same time, how do we do those traffic optimizations so that our network is just much more efficiently utilized? I think you are seeing the benefits of some of that. I think your part around security and compute, we do think that is more SaaS-like.
It's going to carry slightly better gross margins. I think that as you see the mix change, you'll see some improvements on that. What I'm talking about for 2026 and beyond, I think that we are putting more CapEx investments in for Q4. We should just think about the 2025 gross margins on an aggregate full-year basis and assume some operating leverage. Kip and I are very big on making sure that we operate the business with discipline and with the focus towards getting operating leverage both on gross margin and the operating income margin side. Compare the full year 2025 and just expect operating leverage and gross margin leverage from that. Yep.
Yep. Okay. No, that's great. You called out some early traction in APAC or APJ. Maybe can you talk a little bit about where you've seen that success, what's working out there? As you think about your own investments and priorities, again, for next year and beyond, how are you thinking about sales capacity and partnerships and everything to grow that business?
Yeah, absolutely. I mean, we've talked about what we call our international expansion, which for clarity, because it caused confusion at moments, that's not going to affect our capital budget, for instance. We've already operated a global network. When we say international expansion, we're really referring to, as you did, specifically to go to market expansion. Scott and I, as we were reviewing the business, we found ourselves, as many, I think, U.S.-based companies do, under-indexed outside the U.S. We felt like we were too under-indexed outside the U.S. Given the quality of our platform and its global reach, we felt like there were significant opportunities that we weren't capturing because we hadn't put enough emphasis on go to market outside the U.S. This is true in Europe, but it was even more strongly true in APJ. We brought in a phenomenal new leader in APJ.
She is based in Singapore. We had previously had one leader for all international, and he is based in Europe. He's great. He is running Europe for us now, and she is running Asia-Pac. She has brought in some new leaders, is making some changes, and we're already seeing increased traction with some of our existing customers with upsells, as well as new opportunities coming in. I think our view is that that will become more of a factor, of course, as we get into 2026, as that team has additional heads that we've provided them and has the right leaders in place and our customers respond. I'm very excited about that. I was just in Japan, I guess it was earlier this month. Yeah, it was earlier this month. We had a fantastic customer event and met with a bunch of enterprise customers in Japan. I'm excited about how opportunities there are developing.
Yep. Yep. That sounds great. I want to turn now to net retention. We saw that improve again this quarter out to 106%. Just what drove that improvement? As we think about the trajectory from here, do you see more room for NRR expansion as you think about capitalizing on new go-to-market initiatives and having more that you can sell within the platform?
Yeah. I would say that over kind of the past 12-15 months, we've done a much better job around focusing on the customer and what the customer needs. I think that as we think about our delivery business, our security business, there are greater upsell opportunities because as you get closer to the customer, you really know what they need and you do a better job into kind of doing the upsell. I think Scott's also introduced, as we spoke earlier, about the cross opportunity around security, having a broader portfolio. Definitely NRR is definitely being improved because of that greater focus on the opportunity with existing customers. I think where can it go? I do think that we are continuing to make those investments. I think that the environment that we're in is definitely a better environment than in 2024.
I think 106% is a good number. It could be better than that. I think that we're focused on making sure that existing customers are being served. I don't know where it's going to go. We don't necessarily guide on NRR, but I do think the opportunity is there to be better than 106.
Yep. On the network side, you saw network services with stable traffic and pricing, improving trends. I think you said 11% year-over-year growth there. I guess number one, how has that environment changed that you've seen a little bit more stabilization relative to what we've seen in the past across the entire industry, not just you? As we think about trends going forward into 2026, just how should we be thinking about that business?
Yeah. The 11% year-over-year growth in the last quarter, that's our third accelerating quarter of revenue growth for the network services side of the business. I think we're seeing a very good environment on the traffic and traffic growth side. I think when we look at the traffic patterns of our customers, very healthy traffic patterns. We see a very healthy, even pricing environment. I think it's very nice to be in 2025 compared to what we saw in 2024. There's just a lot more rationality, a lot more balance between supply and demand of the traffic. I think that it's a definitely good environment in Q3. We see the same environment in Q4. We are very happy with what we see. The total market for this is probably around 6%-7% year-over-year growth.
Given where we are and the investments we've made here, the fact that we have a better product and we're smaller, we should be growing faster than the market for sure. 11% is, I feel good about that in this past quarter and opportunities there.
Yep. Okay. Got it. Got it. I want to go back to within security, you obviously WAF has been a great building block, but you talked about some of the success you've had on bot mitigation. You brought up AI bot mitigation, right? Kind of with the whole debate on AI search and so much more traffic going through, whether it's ChatGPT, Perplexity, whatever have you. How do you think about the opportunity for Fastly in there? Especially as companies are worried about their own data, training all of these models, et cetera. Just what does that opportunity look like? Where are the investment opportunities for?
No, I mean, it's a great call out. Our customers, particularly ones who have ad-supported sites, not videos less of a factor, but ad-supported sites, think typical news site, things like that, are very concerned about this because obviously if you're able to crawl that data, put it in the LLM, and the end user gets their data from the LLM, the ad's not viewed. Over time, that's probably going to have an impact on your ad revenue. We've deployed a couple of solutions to this problem depending on how customers want to approach it. One is our AI Bot Mitigation product, as you mentioned. It gives them visibility and control of what's going on. They can choose to use that product to block AI crawlers, for instance.
That said, I think what we're seeing is that's not a favored solution long-term because what some of our customers have reported, and it certainly makes sense, is, yeah, if they block, then their results don't show up in the LLM, but that doesn't mean people will come to their site looking for it either. I think a more nuanced approach is needed. We worked with, I mean, the flip side of our revenue concentration is we work with a lot of the most sophisticated media companies. We work with them and others to create a standard called RSL for really simple licensing. It's a way that CDNs can communicate the licensing requirements to AI bots that's based on open standards. It's not proprietary to one player, including Fastly, by the way.
We are the first ones to implement it in our CDN, and we help write the spec. We think that's the sort of industry-level solution that's going to work across different ecosystems as opposed to any one proprietary solution. We feel good about that. I think there's things that we're helping our customers with there every day. Yep.
Yep. No, I think that's great. Maybe with the minute and a half we have left, somehow did not bring up competition outside of one specific customer, but just how would you shape out the competitive environment currently, right? We've seen consolidation in this space. We've seen players exit. We've seen players go out of business. Just what are you thinking about where things look from a competitive landscape now versus maybe how they were a couple of years ago? Just going forward, your ability to maintain your competitive advantage that you've been demonstrating.
Yeah. I mean, we feel strongly that we have the highest performing product, and our customers tell us that. Actually, some of Scott Levitt's focal points for the whole go-to-market team is we win when performance matters. That focus, I think, has really, really helped us. We are very confident in that technical advantage that delivers a better outcome and better user experience to our customers. Things have consolidated. I mean, we essentially have three large players. We do sometimes, people ask, who do we have the most competitive takeaways from? It's probably Akamai, to be transparent. Although in the security side, we'll sometimes be taking away from a security vendor.
Maybe somebody has an individual DDoS or bot product, and they're like, "Oh, Fastly has this. I'll consolidate. I'll get better performance, a simpler tech stack for my teams." It is a varied environment, but I do think, I mean, time will tell, but I do think perhaps that last year was a somewhat unique time as we had a number of players that we can now see were in the process of going out of business. Frankly, they were probably putting out pricing that did not make rational sense. The large sophisticated customers are certainly adept at leveraging that across their vendors.
Awesome. I think it's a great place to jump off. Kip, Rich, thanks so much for being here. Thank you, everyone.