Good day,
and welcome to the Palo Alto Networks fiscal second quarter 2019 earnings conference call. The base conference is being recorded. At this time, I'd like to turn the conference over to Jeff Tru. Please go ahead, sir.
Good afternoon, and thank you for joining us on today's conference call to discuss Palo Alto Networks' fiscal second quarter 2019 financial results. This call is being broadcast live over the web and can be accessed on the Investors section of our website at investors. Paloaltonetworks.com. With me on today's call are Nikesh Arora, our chairman and chief executive officer Kathy Banano, our Chief Financial Officer and Lee Klarich, our Chief Product Officer. This afternoon, we issued a press release announcing our results for the fiscal second quarter ended January 31, 2019.
If you would like a copy
of the release, you can access it online on our website. We would like to remind you that during the course of this conference call, management will make forward looking statements, including statements regarding our financial guidance and modeling points for the fiscal third quarter full fiscal year 2019, our competitive position and the demand and market opportunity for our products and subscriptions, benefits and timing of new products and subscription offerings, our ability to drive outsized growth rates and trends in certain financial results, operating metrics, mix shift, and seasonality. These forward looking statements involve a number of risks and uncertainties, some of which are beyond our control and which could cause actual results to differ materially from those anticipated by these statements. These forward looking statements apply as of today. You should not rely on them as representing our views in the future.
And we undertake no obligation to update these statements after this call. For a more detailed description of factors that could cause actual results to differ, please refer to our quarterly report on Form Ten q filed with the SEC on November 30th, 2018, and our earnings release posted a few minutes ago on our website and filed with the see on Form Eight K. Also, please note that certain financial measures we use on this call are expressed on a non GAAP basis, and have been adjusted to exclude certain charges. For historical periods, we have provided reconciliations of these non GAAP financial measures to GAAP financial measures in the supplemental financial information that could be found in the Investors section of our website located at investors.patelassenetworks.com. We would also like to inform you that we will be presenting at the Morgan Stanley Technology, Media And Telecom Conference in San Francisco on Wednesday, February 27th.
And finally, once we have completed our formal remarks, we will be posting them to our Investor Relations website under Quarterly Resorts. And with that, I will turn the call over to Nikesh.
Thank you, Jeff, and thank you everyone for joining us this afternoon for our fiscal second quarter 2019 results. I'll go briefly to our financials, give you a progress update on our fleet focus areas of securing the enterprise, securing the cloud, and securing to our Application Framework. And finally, I'll provide a little more color on the Demisto acquisition. Starting with the financials, I'm pleased to report that the team has delivered another outstanding quarter. Fiscal Q2 revenues of $711,000,000 represents year over year growth of 30% and non GAAP earnings per share increased by 44% to 1.51 dollars, $20.81.
We had a number of big wins this quarter, but there are a few I'd like to highlight. We continue to see success around the world in our next generation firewall business. People are getting more security conscious and want to deploy our firewall with the attached subscription. To note during the quarter, We did a large deal with a data center in Europe. I want your most prestigious car manufacturers and had a significant expansion of our hardware footprint among the largest online gaming companies in the world, as well as among the largest retailers in the world.
We're beginning to see proofs of our speedboat strategy. With our increased focus on GlobalProtect cloud service, we've had a few spectacular wins, one to secure 25,000 mobile users at a Global Financial Services company, and another to secure 8000 mobile users for 1 of France's largest aid on public services. We also won a very large BM Series deal several subsidiaries of 1 of the largest broadcasting companies in the United States. And we wanted to yield a secure 47,000 endpoints and 1 of the largest university health care systems in United States as well. Expanding more on our 3 strategy focus areas, First, let me talk about securing the enterprise.
Over the last 11 plus years, we transformed the network security market with our next generation firewall. We use the firewall as a platform to deliver tightly integrated security services. We've had great success with our attached subscriptions. The most successful ones having a tax rate of about 90%. Earlier this month, we announced the release of PanOS version 9.0, which added over 60 new features, including the policy optimizer, which helps team to place legacy rules with intuitive policies that provide better security our eager to manage.
I'm excited about our new DNS security subscription. This is our first new Adapt subscription since 2011. The subscription utilizes machine learning and predictive analytics to full actively block malicious domains and stop attacks in progress. The only serves with this level of capability to be integrated with the firewall. This concludes our practice of reducing the number of disparate point products and making security better, easier and more effective.
They're working hard on future subscription than our software releases, providing our customers more integration for their cyber security solutions in enterprise. We believe an acceleration firewall will continue to serve as a platform for security services in the enterprise. We also have expanded our hardware family, our new PA 7000 series, features throughput capability to 2 times the nearest competitor, and will be especially useful to customers at large data centers and high volumes of encrypted traffic. Additionally, we announced availability of Arcadia Series, As we discussed in last quarter's conference call, the service provider market has become a lot more interesting to us with the adoption of IoT in the advent of 5G. Where security will be a primary concern.
Our new K2 Series aggressive this market simplifying operations by offering unprecedented visibility, automation and consistent protection. And finally, we continued our investments in advanced endpoint protection. With tracked 6.0, which we announced earlier today, endpoint security just got a lot better. The new behavior threat prevention engine allows Traps prevent attacks based on their behavior. Craft 6 total also introduces container security protections and its data collection for XDR, which I'll talk more about later.
We're proud to serve close to 4000 Traps customers, almost half of whom manage Traps on the cloud. Turning to our 2nd focus area of the cloud. We continue to be laser focused on delivering technology that enables our customers in the cloud journey by delivering the broader set of security capabilities across all clouds and cloud configurations. As of the second quarter, approximately 8000 customers are using our cloud off The Speedpay speed will be created around cloud and the acquisition of RedLock last quarter is already showing positive results. We have exceeded the original forecast for our RedLock business by more than 50%.
This is a great example of the power of combining a best in class product follow-up on network's execution and distribution. Additionally, our in line cloud security VM Series was recently expanded includes support for the Oracle Cloud and initial trials of the Alibaba Cloud. We improved performance of the product by up to two point five times and added many new and enhanced capabilities for operating in both public and private cloud environments. We're very pleased with our continued progress with VM Series and success we're seeing with numbers. The 3rd focus area of our strategy is harnessing the power of advanced AI and machine learning.
Started this strategy with the announcement of application framework 18 months ago, and are proud to announce application framework 2.0, which is now called Cortex. We believe Brazil Security will be managed in the future. Cortex is a significant evolution of the Application Framework. It is the industry's only open integrated AIB's continued security platform. Cortex has been deployed in the public cloud, allowing us to leverage its features and scale and rapidly deployed AI.
We're also announcing the first application available for Cortex called Cortex XDR, built to empower SOC analysts. Cortex XDR enables teams to stop associated attacks and adapt their defenses to prevent future trials. Cortex XDR goes far beyond traditional EDR than only works on endpoint data. It breaks down the silos created by legacy technologies to offer the first ever detection, investigation, and response product that natively integrates network endpoint and cloud data. It reduces the signal to noise ratio that has been plaguing security hours.
It accurately uncovers threats using machine learning, simplifies investigations automation, and stops attacks before damage is done. To price integration with existing and closing points. Quarter XDR is being launched in conjunction with Traps 6.0, our new endpoint product that I've mentioned before. Lovecraft is enhanced for even better endpoint protection. Using its behavioral threat protection engine, it stops advanced threats in real time by stitching together a chain of events to spot malicious activity.
By combining recorded HDR, customers can use Traps to extend their prevention capabilities to include detection and response across the entire digital infrastructure from a single agent. The more powerful cash product access the ultimate data collection center for Cortex as well, collecting the most comprehensive data in this in the industry. We're confident in the uniqueness of our approach. So to make sure our customers can take full advantage of Cortex XDR, we have decided today to include endpoint protection free of charge when they purchase Cortex XDR. Yes.
We're declaring our newly developed advanced Trapsix product as free is purchased with Cortex XDR. We believe that for true comprehensive investigational advanced attacks, the data is critical. Customers can now deploy one single endpoint agent that prevents to text and responds to attacks across an entire digital infrastructure. And to help us roll out Cortex XDR, we're also announcing partnerships with 5 managed security service providers partners who will deliver 24x7 threat monitoring protection and response services to our customers. We are excited about these partnerships with Pricewaterhouse, critical start, onto it, video and trust ways.
They will provide important service to our customers and demonstrate industry confidence in our corded platform. These are all exciting changes, and I cannot thank our product team enough for stepping up the challenge of integration and speed in solving our customer's problems. Lastly, I'd like to provide more color on Demisto. Last week, we announced the proposed acquisition of Demisto. Demisto is a leader in the evolving space called SOAR.
We believe that Demisto's multi vendor orchestration capabilities and unique analytics and playbooks will help our customers further automate significant parts of their security operations and allow them to turn their attention to solving unique and complex threats. It is still already a partner of Cortex. Now we'll integrate even more tightly into our plans for AI and ML on Cortex. Demisto has an ambitious plan in 2019 with billing projections of approximately $50,000,000 to $55,000,000. Facilitate and support achievement of this plan, we will have Demisto operate in a separate speedboat under the leadership of Slavic Marco, which is their CEO, leveraging the broader Palo Alto Networks distribution engine.
At the same time, Slavic will work closely with regards to me to accelerate the next step for customer solutions. As I mentioned in the call, we had last week, the addition of Demisto, we now have made a couple of acquisitions in the last 6 months. While we continue to evaluate companies, my primary focus is on making sure these acquisitions are successful and we are delighted with both customer reaction and our initial results. In closing, as we approach RSA next week, we know there will be a robust debate about whether the endpoint of the firewall is in center security. In our mind, this debate is looking at security through 2 narrow lens.
We believe the future of security is about data. It's about data. It's about machine learning from that data and orchestrating and automating responses. And for customers who are struggling to manage too many disconnected security point products, we believe that our platform grows to security with high levels of integration, Anil Dixon, automation is the answer for the future of security. We believe Cortex is the future.
And with that, I'll turn the call over to Kathy.
Thank you, Nikesh. Before I start, I'd like to note that except for revenue and billing figures, all financial figures are non GAAP and growth rates are compared to the prior year periods unless stated otherwise. All current and prior period financials discussed are reflected under ASC 606 as we adopted the new standard as of August 1 2018. In the second quarter, we once again added new customers at a rapid pace while also driving robust expansion business. Our top 25 customers, all of which made a purchase in Q2, spent a minimum of $35,600,000 in lifetime value, a 39% increase compared to the same period last year.
In the second quarter, total revenue grew 30 percent to $711,200,000. By geography, Q2 revenue grew 27% in the Americas, 38% in EMEA, 35% in APAC. Q2 product revenue of $271,600,000 grew 33% compared to the prior year. Q2's fast based subscription revenue of $249,700,000 increased 36%. Support revenue of $189,900,000 increased 21%.
In total, subscription and support revenue of $439,600,000 increased 29 percent and accounted for 62% of total revenue. Our nonattached offerings continue to show strong momentum, and we exited the 2nd quarter with run rate billings of approximately $383,000,000, growing approximately 60% year over year. Q2's total billings of $852,500,000 increased 27% year over year. The dollar weighted contract duration for new subscription and support billings in the quarter was approximately 3 years. For the first half of fiscal 2019, billings of $1,600,000,000 increased 27% year over year.
Product billings were $514,900,000, up 33% and accounted for 32% of total billings. Subscription billings were $646,700,000, up 30%. Support billings were 400 $49,400,000, up 17%. Total deferred revenue at the end of Q2 was $2,500,000,000, an increase of 32%. Q2 gross margin was 76.3%, an increase of 30 basis points compared to last year.
Due to operating expenses were $367,500,000, or 51.7 percent of revenue, which represents a 220 basis point improvement year over year. Operating margin was 24.6 percent, an increase of 250 basis points. We ended the 2nd quarter with 5856 employees. Non GAAP net income for the 2nd quarter grew 49% to $147,000,000 or $1.51 per diluted share. Our non GAAP effect tax rate for Q2 was 22%.
On a GAAP basis for the second quarter, net loss declined by 90% to $2,600,000 or $0.03 per basic and diluted share. Turning to cash flows and balance sheet items. We finished January with cash, cash equivalents, and investments of $3,600,000,000. During the quarter, we completed our $1,000,000,000 share repurchase program which was effective through December 31 2018. We repurchased approximately 1,900,000 shares of common stock at an average price of approximately $178 per share.
On February 22nd, our board of directors approved a new $1,000,000,000 share repurchase program. The new repurchase authorization will expire on December 31 2020. Turning to cash flow, q2 cash flow from operations, of $275,400,000 increased 13%. Free cash flow for the quarter was $251,900,000. This figure was impacted by approximately $15,000,000 of imputed interest expense associated with redemption of the 2019 convertible debt.
Adjusting for this and other cash charges, Free cash flow in the quarter was $271,400,000, up 21% at a margin of 38.2%. Capital expenditures during the quarter were $23,500,000 DSO was 50 days a decline of 9 days from the prior year period. Turning now to guidance and modeling points. For fiscal Q3 'nineteen, We expect revenue to be in the range 23 to 25% year over year. We expect non GAAP EPS to be in the range of $1.23 to one $0.25, which includes expenses related to the proposed Demisto acquisition using approximately 99 to 101,000,000 shares.
Before I conclude, I'd like to provide some additional modeling points. Our Q3 non GAAP EPS guidance includes a net increase in M and A expense of approximately $5,000,000 or 0.04 per share attributable to the proposed Demisto acquisition. 50 to $55,000,000. Our EPS guidance also includes an expected $0.01 impact due to US tariffs on Chinese origin goods. We expect our non GAAP effective tax rate to remain at 22%.
CapEx will be approximately 20 to $25,000,000. To help you model billings for the remainder of the year, We are comfortable with current consensus including acquisition related operating expenses, we expect an adjusted free cash flow margin of approximately 36%. This fiscal 2019 number is adjusted for one time items consisting of the previously communicated $97,000,000 related to the settlement of 2019 convertible debt and between $35,000,000 to $40,000,000 of cash flow associated with our new headquarters in Santa Clara.
Yes, ma'am. K. Our first question comes from Walter Pouchard. City.
Hi. Could you give us an update on, service provider? Sounds like you're still pretty excited about that opportunity. I don't know if you're willing to express other percent of the revenue or whatnot, but curious as an update on that and then kind of product related follow-up?
Hi, Walter. Thanks for your questions. Look, as I had mentioned when we launched K2, and we talked about it last quarter, we believe the tweaks to the 5 g opportunity, the unique opportunity, and the whole focus on IoT or you have been talking to a whole bunch of telcos, the service providers or service providers out there. And there's a twinkle on their eye when we start talking about the B2B use case for 5G wire, they would not have cared as much. I shouldn't say that for them, but they were not as focused on individual consumers and the ability to hack their phones, those are provide security.
But as it comes to B2B use cases, providing bandwidth at the edge, we are very concerned of making sure that there will be customers that are secured now going from all the way from their devices or their cars or whatever they choose to implement a health care device to the rig back to their cloud. And we believe our firewall is unique positioned to solve that problem for them in the K2 firewall space. So we're very happy with a lot of conversations we're having. We're beginning to start seeing requests for integrating that in some sort of testing with them. So all I'd say is, you know, early days, but we're happy with with the direction the conversations are taking.
And then and then maybe for Cathy, on on the endpoint side, I guess that's in a market where
the an early high security solution arguably till now. Should should we think about seeing
a, a pretty significant ramp in that in that revenue here as we go into the second half of your facility or getting the other quickly some of those new relationships and so forth, or is that is that maybe 2 underships that we should think about that as more
of a fiscal 2020 driver?
Folic, we're very excited about the new Trap 6.0, and of course, CORTEX XDR, which will leverage Trap 6.0. We think that it's going to be a very compelling solution for our customers. And so we obviously have a lot of, a lot of confidence in our ability to drive drive acceptance of that product in the marketplace. In terms of what's gonna drive our overall revenue performance, you know, I I'm really not gonna start to get into those kinds of details, but we're we're very excited about Traps 6.0 and think that we, that it offers us a great potential for the
Our next question comes from Carl Kirsten, Deutsche Bank.
Thank you. Maybe one for Nikesh, one for Kathy. Nikesh, the the product revenue growth acceleration to 33 percent, I think, was super impressive. I'm wondering if you could just comment on where you saw strength either by, you know, appliance family or vertical, perhaps, maybe just give a little color on if there's any particular driver of that. And then, Kathy, the question for you is is really on the margin outperformance.
I don't think anybody was modeling a 250 basis point margin improvement. I'm I'm assuming that something occurred on the sales and marketing line. Maybe you could offer some color as to whether any expenses were deferred out 2Q into 3Q or if there's anything else unusual? Thank you.
Hey, Karl, thanks for the question. Look, I'd like to say that there's no specific driver, but a general level of activity we're seeing out of the marketplace. As we've talked about this in the past, that every time something happens in the market where a customer gets breached or somebody gets breached, there's a heightened sense of awareness and security. And what I can tell you is that The conversations are getting more and more up leveled in terms of preparedness of organizations for security, and we are seeing more and more security consciousness From a vertical perspective, we've always done better where people care more about security. You know, that has been strong for us, financial services, have been strong for us, but we're seeing that figured out into other verticals.
I have to say that, you know, generally, it's trends across the board. And, that's probably what has driven the revenue in the product front, this quarter.
Yeah. And I'll just, address the margins comments by saying they're very related. You know, the strong product mix that we saw in the quarter obviously drives higher revenue yield. So that obviously is helping our margins. But in addition, we have been driving leverage in the business and in Q2, we saw operating expense as a percentage of revenue declined by 220 basis points.
As I mentioned in my remarks, And you're right that sales and marketing is, driving that number and the leverage that we're seeing. And we've seen that for the last several quarters. Good leverage in terms of sales and marketing expense overall.
Our next question comes from Fatima UBS.
Good afternoon. Thank you for taking the questions. 1 for Nikesh and 1 for Kathy. Nikesh, one of the things that you've talked about and have been focusing on is, packaging your cloud solutions in a better way and also, taking steps to ensure the entire portfolio, which has expanded quite dramatically over the last couple of years, making sure the entire portfolio is sort of better integrated. So I wanted to understand sort of the the mile markers and progress you've made on that front and to what extent that has, been influencing deal sizes, deal trends, especially that, customer lifetime value metric that continues to to grow a pace.
And then a follow-up for Kathy, if I may.
Sure. Fatima, thanks for your question. Look, I think, I'm very excited that in 8 months, we've been able to create real focus around the three areas. I highlighted the enterprise side and, you know, expanding your question a little bit more on the enterprise side, as
I said in our prepared remarks, that
I I think this company had done a phenomenal job in building a firewall and putting subscriptions on top of firewalls. Basically, once you put a firewall at customer infrastructure, which is a hard decision because you're introducing a another piece in your infrastructure, which is now delivered to you by a cyber security vendor. It's incumbent upon us to provide more and more solutions to the customer, which can be triggered off the firewall. And I think the product is really valued in the last 8 months. And we built our first non attached sorry, attached subscription after 2011 in our DNS security service.
And the team is really charged without building more capability to our firewalls, you have 60,000 customers for firewalls. So, you know, the ability to take that to our customers, you don't need other appliance in your infrastructure. You don't need another solution. It all works off of our other networks, pain, management pain, and you can give you a way. We'll give you more and more capability from the firewall you do deploy it.
And that's kind of, I mean, very exciting. So that's a point of integration and a a mile marker, like you called it, for integration for us. On the enterprise side. On the cloud side, we're slowly and certainly working towards better integration. We're excited about our RedLock progress.
We're excited about our GPU progress that I as I highlighted that these are big wins for us. And the team is getting more and more excited. We're deploying more people across the the certain regions to make sure we have the capability and the ability to go, compete with the people out there offering new solutions. You can expect us to provide more proof points in our integration in further quarters. We don't have anything else on the cloud side yet.
I think, you know, We just announced Cortex this morning. I think the marketing team has done a phenomenal job, the product team has done a phenomenal job, and deploying application framework 2.0 as of last quarter, what would be the proof point of us being able to show true integration across multiple data points, and Cortex XDR is that it is the only service in industry, which will plan endpoint, cloud, and network data as a point of integration. So we believe We are making tremendous progress towards our aspirations to provide more integrated services, and you can expect us to do more and more of that.
That's super helpful. And Kathy, maybe a question for you on the gross margin, certainly a little bit better than we were looking for. Just wanted to understand how you've been navigating over the supply chain constraints, as a consequence of the tariff. And, how much longer should we expect that headwind to persist And at the same time, as, the cloud solutions build out and you cry at greater scale, how should we think about impacting how should we think about those investments impacting gross margins as well? And that's it for me.
Thank you.
Yes, sure. So in terms of our gross margin improvement during the quarter, yeah, we've, you know, we've said that with the new products that we introduced, now almost 2 years ago, we've made a concerted effort to ensure that we're able to improve the margins on those products over time. And we've definitely been able to do that. And so we've seen some improvement in that product gross margins over time. We also have seen, you know, some improvement in terms of just memory pricing, which we talked about.
Memory pricing seems to be stabilizing now. We do still have some issues in terms of more commoditized parts being, more more expensive than they have been in the past, but overall, we've indicated an impact of $0.01 to $0.02 in this quarter due to the tariff. So it's kind of a mixed bag. We're some improvements. And we're also we also have some negative influences.
Overall, we did see an increase of about 30 basis points year over year, which Obviously, we're very pleased about given the current environment. In terms of cloud investments and where we see that going, obviously, that you've also seen some declines in our services margins as we have been investing in those businesses. We think that there's a lot of potential for us to build really big, nicely sized, businesses in the cloud. And there's a great for us. So we're definitely investing in those areas in order to ensure that we can capture the market opportunity.
Very clear. Thank you so much.
The next question comes from John DiFucci, Jefferies.
Thank you. My first question is actually for Lee. So Lee, I think you mentioned her might have been Nikesh in the last last call that the the new, telco class, appliance you're coming out with. I I assume that's the PA 7000 just, I I guess, if you could just, let us know that that's that's right, or is that replacing other products? And and And I guess if it is, the new one is, should we expect further launches to address this market, a market you really haven't been in very much in the past?
Yeah. Good question. So let me let me just start by by clarifying the DSN thousand series and specifically the new modules that were introduced and lost as part of the 9.0 release earlier this month. That is that is the basis for the KQ Series, but the KQ Series is a optimized hardware platform targeted for service providers and specifically the mobile networks as we see those transitioning from 4G to 5G. And then with 5G, the advent of much broader IoT and in particular, high value and sensitive IoT devices coming on to those that that need security.
So so they are related, but they are they are different offerings. Relative to service provider overall, we we have been in this space in this market, selling to service providers. We had seen success, across different parts of the portfolio, the K2 series, that was the first time we've designed and built the product specifically for that market to really go capture the specialized opportunities that exist there.
And and we're still waiting on the K2 series. Is that correct?
No. The Kitchen series is is now available, as of earlier this month.
Okay. Okay. Perfect. Thank you.
And Kathy, just a clarification, I mean, the results are strong across the board, all revenue categories, but especially in the product area. So I just want to make sure we understand correctly. I mean, is all of attached subscription something, I think both you, Nikesh, talked about in your prepared remarks, Is all of that in the subscription line, or is there any of that in the license line due to ASC 606 in the way on premise subscriptions treated under that standard?
Yeah. A portion of the VM series, which we talked about. And when we talked, at the beginning of Q1, regarding ASC 606, a portion of our VM series is recognized up front in that category.
Okay. And and so it's in that that line item in the on the income statement and the license line?
That's correct.
Yep. Was there any shift, like, is there is there a continuing shift to more subscription or more on what would be cons you know, that that kind of revenue on premise subscription? You'd have to have a license line?
No. I mean, in terms of what's driving the growth there, that's really not a driver of the growth not a significant driver of the growth in any respect. It's obviously we've, we've made the adjustment both in this year's recognition of VM Series and last year's recognition of VM Series. And, while we're seeing growth there, obviously, it's not a as big a portion of our business as the rest of our product revenues are. And so the real impact is what we're seeing in terms of the rest of the product category.
Perfect. Thank you very much. It's very clear.
Our next question comes from Drew Talpaz, Stifel.
Thanks for taking my question and congrats on the results. A few products extra questions here. 1, how
should we think about the efforts around XDR and core tech in conjunction with your vision for Demisto and the app framework? And ultimately speaking, how intertwined are these initiatives?
Let me let me give you an overview and then perhaps we can jump in with the real answers. Look, for us, Cortex is a big deal. We spend a lot of time in making sure we get the underlying platform right. I think by deploying it on the public cloud and using the features that you've come where you can handle massive amounts of data, and being able to leverage the needed AI tools, and that is very useful. I think XDR is very critical.
I think XDR is a service which there's a whole bunch of startup files that are trying to provide that kind of service.
I think it's different when
we deploy that service where you can leverage the data to collect a power of firewalls and from Traps and from our cloud security sensors. We actually, there are many customers who deploy all three from us we have the option to go in the select where we have them. Here's a real tool that can help you in your sock, see if it'll hold extra step that would not be that was not available in the past. I think, Demisto, was something that, I think you and I haven't talked about this and we haven't talked much about it because I wasn't gonna talk to you about it until we figure out what we wanted. But, when we went out to our customers, the customers, big challenges, I got so many cybersecurity solutions, I'm getting 3 to 10 times more alerts than I was getting 2 to 5 years ago, and I'm gonna have to hire more and more analysts to figure out how to solve an alert.
So you know, this cannot be punitive damage. The more secure I want to feel, the more products that we deploy, the more people I have to hire to solve the alerts that you guys send me. So we realize that there is a crescendo where people are saying I need more help solving this alert than going on generating them. I think Demisto fits squarely in that so spot in the industry, no pun intended. And
I think
one of one of the opportunity we have is to be able to take that and leverage that across the entire application framework, original leverage that across, data from not just Palo Alto Networks, but other vendors in the list of early early masters that are.
Yeah. Just to just to piggyback on top of it, Nikesh, that I think one of the ways to to think about this is we we do want to actually encourage customers to have more alerts. Like, more data is always a good thing, but it's only if, for the for majority of that, we can automatically deal with that. And that is where Gavista will fit in is that that automated, playbooks and analytics to to deal with, sort of the the the large volume of alerts coming in. And that XDR provides that ability to stitch together data from different sources, really understand it and proactively present it to the soft analyst for the more sophisticated attack where you actually need an analyst to to spend some time understanding it, investigating it, and initiating a response.
And so they they they do work very sort of hand in hand, in terms of how is how is how a soft analyst would would think
of the of the
capabilities. That's actually really helpful. And then Nikesh, you talked about a strong customer response for Demisto, but I want to know if you got can't talk with any integrated vendors yet. And if you've gotten any responses from those that have worked directly with Demisto in the past and how they sort of view the the integration and acquisition going forward.
We have had an opportunity. I think it's fair to understand that, you know, the biggest role in this process belongs to the customer. Because Demisto is deployed in a customer's infrastructure with their explicit permission to be able to access the data from the customer and remediate that into their infrastructure. And they've built the product on the back of open connectors that are available from every vendor out there. So there's no proprietary connectivity that Demisto leverages that is going to change by the acquisition if that's where your question is headed.
In addition, Demisto will also have access to a lot of Palo Alto data. Which is just impossible for us to deploy anywhere else but in Cortex.
That's that's helpful. Thank you.
The next question comes from Gabriela Borges, Goldman Sachs.
Good afternoon. Thank you. Nikesh, I was hoping you could expand a little bit on the monetization opportunities around XDR. We've talked about monetization with the application frame up more broadly. Maybe just specifically on XDR and the decision to include traps within the broader bundle, the puts and takes and how you thought about that.
Thank you.
Sure. Thank you. Look, again, I'm gonna give you a little overview and we will, bump in hopefully. From an HDR perspective, I think you know, our thesis going into it was the pieces of integration. And this is something the company had already been working on for a while.
With the acquisitions of sector like Sabahat. We can figure out how to take all this data and provide it consistently in one way as opposed to deploying more and more tools against the infrastructure. So XCR for us is very, very important because it is actually the first critical application from our end, which integrates data from all the three sensors that I mentioned. So it's very important as we get into the soft business. And also, you know, part of it, part of the observation we've had is that as more and more sophisticated tools get developed, it becomes impossible for customers to train their SOC analysts across multiple tools.
So if you notice, you know, I mentioned this, but I want to highlight that We've actually partnered with 5 partners who are gonna help us manage this as it gets deployed in the software because we believe the true leverage is from being able to fully utilize the product across all the data that we've collected or we will be collecting for XDR. In terms of the Traps decision, I think If you look at the endpoint industry and I stared at it hard over the last 8 months, there's a lot of vendors. And there's a lot of vendors who used to do a certain set of features that new lenders do turns out of new features. And we've talked and thought about how we could make sure that Traps over time becomes the ubiquitous endpoint agent in the market. And we realized that, you know, endpoint production in its most advanced form should become table stakes.
Every customer should have it, but the endpoint agent has in my mind, at least 22 major features. 1 is to provide protection at the endpoint, but more as importantly is to provide data to be able to go back into a cloud sort of database, if you will, which allows them both to leverage it across other security solutions, but also be able to send behavioral intent data back to the endpoint. So We thought bundling Traps and XDR would be the right outcome. And because we want ubiquity on Traps, we wanna make sure that's available free to our customers so they can deploy it. And as you probably know, customers have multiple endpoint agents running in their infrastructure.
They're not required to replace anything. This is just a free product that they can deploy, which leverages, which allows us to leverage XDR more effectively for that customer. He thinks I, I've I've he's coached me well, and he's giving me a thumbs up between, you know?
The the far off is fully. I think he might know the with us. When you look at your customer base on NextGen firewall, do you have a sense for to what extent your customers have standardized on Palo Alto Deployments for the firewall. This is maybe a dual source thing. I have multiple firewall vendors and some of the new policy rules and the features that you have and might not help with that sanitization asset?
Yes, great question. The high level answer is obviously going to be it depends. It depends on a number of things such as how large the customer is when they initially became a customer of Palo Alto Networks and where they are in that journey. We see Certainly, a lot of our customers, they often will initially purchase for a particular project deploy gain success success out of that and then use that success to leverage across other parts of their infrastructure over time. Obviously, we try to accelerate that in in capabilities like the policy optimizer actually allow us to help accelerate that by moving them more quickly into the kind of security policies we think and and they think are, are better both from security perspective as well as a, ease of operation perspective.
The second aspect of that is the more they are able to see the value and consume the value of additional subscription service on top of that, whether that's the preferential subscription, wildfire, hand to be Eurofiltering GlobalProtect, or or now was 9.0 to DNS security service, the more value they see out of, using us as their primary firewall and infrastructure, which also then often drives broader consumption and usage. And, so, it is a journey. But the but what we see both in terms of utilization as well as footprint does continue to expand.
Thank you.
Our next question comes from Sterling Auty, JPMorgan.
Hi, I'm curious how you guys think about the need for product growth moving forward within the overall growth of total revenue. You started as a razor and razor blade model. Now you have a substantial amount of non attached subscription. So how fast does product have to grow moving forward for you to deliver on your growth goals?
That's a good question. I think we'd like more and more customers to deploy the firewalls. Yeah. So in that perspective, yes, we'd like to see product growth. But we wanna see both depth and breadth And that's why we're embarked on a rejuvenation of our subscription services because we believe that the firewall can offer multiple subscriptions to our customers.
And Now we found good success and uptake every time we deploy these subscription, and we just want to increase the intensity of those subscriptions because today there are still many point products that are being deployed. In the infrastructure. So we see the firewall, not just as, as I said, like, as a as an in line firewall that protects you but we also see that as a platform to be able to deploy more and more services while the customer is doing these in global things. So, for our growth plan, it's important for us to get both Zep and Brett on the product side.
Makes sense. And one follow-up
on Demisto. You gave us a sense of, you know, the aspirations on the billings front. But how does the contract structure look and how does how do we think about the billings flowing into revenue?
K. Did you want to not answer that?
Well, the the the Demisto operates with a ratable model. For the most part. So we would expect a ratable revenue model with with the Demisto acquisition. Is that does that answer your question, Sterling?
Well, sorry to go. So in
other words, we should we should expect the revenue contribution initially to be small, but for it to layer in. So, you know, in that 4 quarter look, the second half should be substantially bigger than the first half, or is that the wrong way to look at it?
Well, I I think you're on the right track that revenue does lag in terms of, revenue does lag bookings in a ratable revenue model. So you you've got that correct.
Okay. Thank you.
Our next question comes from Keith Watts, Morgan Stanley.
Hi. This is Hamza Fodderwala in for Keith White. Just a couple of quick questions on my end. Looking at the fiscal q 3 guidance, and it implies a slight sequential down tick. In revenue versus Q2, which is, unlike what we've seen in the past.
So to what extent is that, caution related to the macro environment, whether it be tariffs or spillover effects from the federal government shutdown. Or just typical conservatism in your forward guidance?
Yeah. Look, I wouldn't read any sort of macro comments into our guidance. We're guiding a very respectable 23 to 25 percent year over year revenue growth range, on a pretty tough compare last year. So we feel very comfortable with where we are in terms of our guidance.
Got it.
And just a follow-up question on the free cash flow margin. You mentioned a 36% free cash flow margin roughly for the full year. Does that include the the the one time payments, or is that does that exclude that?
So the the 36 percent full year free cash flow margin that we guided to includes the adjustments. That's an adjusted free cash margin.
Yeah. Okay. Okay. Alright. Thank you.
Yep.
And next question comes from Shaul Eyal, Oppenheimer and Company.
Thank you. Good afternoon, guys. Congrats on the strong results and outlook. Nikesh or Kathy, I think this quarter has shown the strongest level of growth in EMEA, I think, at around 38% year over year. What's driving this ongoing improvement?
Is that the work you've been doing with the biggest distributors? Is it demand trends? Help us understand. Thank you.
Well, I think we're generally speaking that as follows networks of the company has grown and we've expanded globally, We spend a lot more time making sure we have robust teams in the country in Europe. We have very strong leadership there. I think it's just, in my mind, it's really getting out the ton of customers and presenting our solutions and penetrating the market. So it's just good execution on the part of our media team. And you know, all I can say is from from prior experience, you know, a U.
S.-based company has very focused the U. S. Routed trucks over time and started expanding globally. And we have a lot more room, we think, in our international markets, and we're going to be continuing to focus on execution, not just in Europe, but in EMEA, as we've shown and various position specific network.
That's fair enough. And as a follow-up, if I may, linearity trend, if I'm looking the past few quarters, seem to be slightly improving. Auto stacking loaded, as as prior ones, Just looking for some color if it's possible on that specific point. Thank you for that.
Yeah. Our our linearity is in terms of when our bookings come in as remains fairly consistent over time. We do see we do see you know, depending on the quarter, for example, in the quarter just ended December, obviously, is month, year end months. And so we see different linearity in that quarter than we do in other quarters, but that's been very consistent over time.
Got it. Thank you.
I would, yeah, I wouldn't really call out anything particularly new or different there.
Okay. Thank you for that.
Yep.
Our next question comes from Philip Winslow, Wells Fargo.
Hey, thanks guys for taking my question. On the site with the launch this morning, you said you had 60,000 enterprise customers. If I just look at that versus the end of the year, it's up about 6000, which is actually ahead you were through the first half of fiscal twenty eighteen. So obviously you can continue to add net new customers a very healthy pace. When you start to thinking about sort of forward guidance like even just medium term planning, how are you thinking about sort of prioritization of go to market between upsell, obviously, a growing product portfolio in an existing installed base versus, continuing to add new customers?
Well, I think part of the challenge we've given to this sales team is we've got to be able to walk into kind of the same time. So we'll have to get at both. I think to be able to sustain the growth aspirations we have, we have to go out and expand in our existing days. We also have to be able to land new customers because We have a lot of new products that we're trying to deploy, which will be deployed both in our existing customers and your customers who may be more, receptive to our new products which we are deploying in the cloud space and the porting space. So we really are trying to focus on both ends, the opportunity to go to existing customers and sell them existing product, these products, of course, is great because they already have experienced our products, have deployed them.
And have the training and the the experience on the products, but, we're challenging our teams to try and do a bit of both.
Got it. And then just to follow-up on that in terms of obviously the healthy net your customer adds, any changes that you're seeing in those deals in of just win rates versus the competition, your pricing in those fields, etcetera? Just any sort of color on that would be great.
Our wind rates haven't changed substantially over the last 12 months or last 8 months have been here. I think it's been pretty good across the board. We are seeing better traction, obviously, in some of our newer products, which we haven't seen in the past, hence the suppose rate sustaining over 60% as Kathy mentioned. So we are seeing traction there. We are seeing our teams beginning to form around it.
So We had high expectations from the team in that area, but generally costs from a landscape perspective, one of you highlighted the success we're seeing more in EMEA. So clearly, as well as a penetration strategy. So I think it's just just steady, execution across all fronts and where we feel that we need to go step in and create more effort we do, by constantly inspecting ourselves.
All right. Thanks guys.
Thank you.
Okay. Our last question comes from Ken Talanian, Evercore.
Guys, thanks for taking the question. Are you seeing most customers make enterprise wide purchases, GlobalProtect Cloud, or most of the deals thus far more representative of the land spend opportunity?
Look, there are there are customers who already have calls and network firewall employed and they're used to our Panorama management team so they understand how to set up policies and how to make it work. And then GlobalProtect Cloud becomes an extension of their of their security posture. But we've also seen, as I highlighted, the two wins we've had, we've also seen situations where we walked in a customer has deployed over pre cloud service because they believe it's a more secure product than the other product, which is competitive, which I cannot name. I forget. Awesome.
Okay. And last question, have you made or do you plan to make any changes this year to sales compensation or the compensation terms?
We're constantly, adapting our sales forces compensation to make sure that we see objectives reset for ourselves. Therefore, we also take feedback based on where our expectations were different from what has transpired in the market, but there's nothing substantive that we have changed or we plan to change during the course of our year because so far it seems to be working.
That'd be great. Thank you.
Right. Well, if there are no more questions, I just wanna thank all of you for attending our call. I also wanna shout out, you know, big shout out to the team at the company. They've done a phenomenal job. So you very much, and I look forward to meeting with many of you in the upcoming weeks and some of you at the morning time of conference.
Thank you.
Thank you, ladies and gentlemen. This concludes today's teleconference. You may now disconnect.