Good day, welcome to the Palo Alto Networks fiscal second quarter 2019 earnings conference call. Today's conference is being recorded. At this time, I'd like to turn the conference over to Jeffrey True. Please go ahead, sir.
Good afternoon, thank you for joining us on today's conference call to discuss Palo Alto Networks' fiscal second quarter 2019 financial results. This call is being broadcast live over the web and can be accessed on the investors section of our website at investors.paloaltonetworks.com. With me on today's call are Nikesh Arora, our Chairman and Chief Executive Officer, Kathy Bonanno, our Chief Financial Officer, and Lee Klarich, our Chief Product Officer. This afternoon, we issued a press release announcing our results for the fiscal second quarter ending January 31st, 2019. If you would like a copy of the release, you can access it online on our website.
We would like to remind you that during the course of this conference call, management will make forward-looking statements, including statements regarding our financial guidance and modeling points for the fiscal third quarter and full fiscal year 2019, our competitive position, and the demand and market opportunity for our products and subscriptions, benefits and timing of new products and subscription offerings, our ability to drive outsized growth rates, and trends in certain financial results, operating metrics, mix shift, and seasonality. These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control and which could cause actual results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today. You should not rely on them as representing our views in the future, and we undertake no obligation to update these statements after this call.
For a more detailed description of factors that could cause actual results to differ, please refer to our quarterly report on Form 10-Q filed with the SEC on November 30th, 2018, and our earnings release posted a few minutes ago on our website and filed with the SEC on Form 8-K. Also, please note that certain financial measures we use on this call are expressed on a non-GAAP basis and have been adjusted to exclude certain charges. For historical periods, we have provided reconciliations of these non-GAAP financial measures to GAAP financial measures in the supplemental financial information that can be found in the investors section of our website located at investors.paloaltonetworks.com. We would also like to inform you that we will be presenting at the Morgan Stanley Technology, Media, and Telecom Conference in San Francisco on Wednesday, February 27th.
Once we have completed our formal remarks, we will be posting them to our investor relations website under quarterly results. With that, I will turn the call over to Nikesh.
Thank you, Jeff, thank you everyone for joining us this afternoon for our fiscal second quarter 2019 results. I'll go briefly through our financials, give you a progress update on our three focus areas of securing the enterprise, securing the cloud, and securing through our Application Framework. Finally, I'll provide a little more color on the Demisto acquisition. Starting with our financials, I'm pleased to report that the team has delivered another outstanding quarter. Fiscal Q2 revenues of $711 million represents year-over-year growth of 30%, non-GAAP earnings per share increased by 44% to $1.51, sorry, $1.51. We had a number of big wins this quarter, there are a few I'd like to highlight. We continue to see success around the world in our next-generation firewall business. People are getting more security conscious and want to deploy our firewall with the attached subscription.
To note, during the quarter, we did a large deal with a data center in Europe, one of the most prestigious car manufacturers, had a significant expansion of our hardware footprint in one of the largest online gaming companies in the world, as well as in one of the largest retailers in the world. We're beginning to see fruits of our Speedboat strategy. With our increased focus on GlobalProtect cloud service, we've had a few spectacular wins, one to secure 25,000 mobile users at a global financial services company and another to secure 8,000 mobile users for one of France's largest aid on public services.
We also won a very large VM-Series deal with several subsidiaries of one of the largest broadcasting companies in the U.S., we won a deal to secure 47,000 endpoints at one of the largest university healthcare systems in the U.S. as well. Expanding more on our three strategy focus areas, first, let me talk about securing the enterprise. Over the last 11-plus years, we transformed the network security market with our next-generation firewall. We use the firewall as a platform to deliver tightly integrated security services. We've had great success with our attached subscriptions, the most successful ones having attach rates of about 90%. Earlier this month, we announced the release of PAN-OS version 9.0, which added over 60 new features, including the Policy Optimizer, which helps teams replace legacy rules with intuitive policies that provide better security and are easier to manage.
I'm excited about our new DNS Security subscription. This is our first new attach subscription since 2011. The subscription utilizes machine learning and predictive analytics to proactively block malicious domains and stop attacks in progress. We only serve through this level of capability to be integrated with the firewall. This continues our practice of reducing the number of disparate point products and making security better, easier, and more effective. We're working hard on future subscriptions in our software releases, providing our customers more integration for their cybersecurity solutions in the enterprise. We believe next-generation firewall will continue to serve as a platform for security services in the enterprise. We also have expanded our hardware family.
Our new PA-7000 Series features throughput capabilities at two times the nearest competitor and will be especially useful to customers with large data centers and high volumes of encrypted traffic. Additionally, we announced availability of our K2-Series. As we discussed on last quarter's conference call, the service provider market has become a lot more interesting to us with the adoption of IoT and the advent of 5G, where security will be a primary concern. Our new K2-Series addresses this market, simplifying operations by offering unprecedented visibility, automation, and consistent protection. Finally, we continue our investments in advanced endpoint protection. With Traps 6.0, which we announced earlier today, endpoint security just got a lot better. The new behavior threat prevention engine allows Traps to prevent attacks based on their behavior.
Traps 6.0 also introduces container security protections and rich data collection for XDR, which I will talk more about later. We're proud to serve close to 4,000 Traps customers, almost half of whom manage Traps from the cloud. Turning to our second focus area, the cloud. We continue to be laser-focused on delivering technology that enables our customers in their cloud journey by delivering the broadest set of security capabilities across all clouds and cloud configurations. As of the second quarter, approximately 8,000 customers are using our cloud offering. The speed boat we created around cloud and the acquisition of RedLock last quarter is already showing positive results. We have exceeded the original forecast for our RedLock business by more than 50%. This is a great example of the power of combining a best-in-class product with Palo Alto Networks' execution and distribution.
Additionally, our inline cloud security VM-Series was recently expanded to include support for the Oracle Cloud and initial trials with the Alibaba Cloud. We improved performance of the product by up to 2.5 times and added many new and enhanced capabilities for operating in both public and private cloud environments. We're very pleased with our continued progress with VM-Series and success we're seeing with customers. The third focus area of our strategy is harnessing the power of advanced AI and machine learning. We started this strategy with the announcement of Application Framework 18 months ago and are proud to announce Application Framework 2.0, which is now called Cortex. We believe this is how security will be managed in the future. Cortex is a significant evolution of the Application Framework. It is the industry's only open and integrated AI-based continuous security platform.
Cortex has been deployed in the public cloud, allowing us to leverage its features and scale and rapidly deploy AI. We're also announcing the first application available for Cortex called Cortex XDR. Built to empower SOC analysts, Cortex XDR enables teams to stop sophisticated attacks and adapt their defenses to prevent future threats. Cortex XDR goes far beyond traditional EDR that only works on endpoint data. It breaks down the silos created by legacy technologies to offer the first-ever detection, investigation, and response product that natively integrates network, endpoint, and cloud data. It reduces the signal-to-noise ratio that has been plaguing security analysts. It accurately uncovers threats using machine learning, simplifies investigations with automation, and stops attacks before damage is done through tight integration with existing enforcement points. Cortex XDR is being launched in conjunction with Traps 6.0, our new endpoint product that I mentioned before.
Now, Traps is enhanced for even better endpoint protection. Using its behavioral threat protection engine, it stops advanced threats in real time by stitching together a chain of events to spot malicious activity. When combined with Cortex XDR, customers can use Traps to extend their prevention capabilities to include detection and response across their entire digital infrastructure from a single agent. The more powerful Traps product acts as the ultimate data collection sensor for Cortex as well, collecting the most comprehensive data in the industry. We're confident in the uniqueness of our approach, so to make sure our customers can take full advantage of Cortex XDR, we have decided today to include endpoint protection free of charge when they purchase Cortex XDR. Yes, we're declaring our newly developed advanced Traps 6.0 product as free if purchased with Cortex XDR.
We believe that for true comprehensive investigation of advanced attacks, the data is critical. Customers can now deploy one single endpoint agent that prevents, detects, and responds to attacks across their entire digital infrastructure. To help us roll out Cortex XDR, we're also announcing partnerships with five managed security service providers partners. Partners who will deliver 24/7 threat monitoring, detection, and response services to our customers. We are excited about these partnerships with Pricewaterhouse, Critical Start, ON2IT, BDO, and Trustwave. They will provide important service to our customers and demonstrate industry confidence in our Cortex platform. These are all exciting changes, and I cannot thank our product team enough for stepping up to the challenge of integration and speed in solving our customers' problems. Lastly, I would like to provide more color on Demisto. Last week, we announced the proposed acquisition of Demisto.
Demisto is a leader in the evolving space called SOAR. We believe that Demisto's multi-vendor orchestration capabilities and unique analytics and playbooks will help our customers further automate significant parts of their security operations and allow them to turn their attention to solving unique and complex threats. Demisto, already a partner of Cortex, now will integrate even more tightly into our plans for AI and ML on Cortex. Demisto has an ambitious plan for 2019, with billing projections of approximately $50 million-$55 million. To facilitate and support achievement of this plan, we will have Demisto operate as a separate speed boat under the leadership of Slavik Markovich, their CEO, leveraging the broader Palo Alto Networks' distribution engine. At the same time, Slavik will work closely with Lee Klarich and me to accelerate the next step for customer solutions.
As I mentioned on the call we had last week, with the addition of Demisto, we now have made a couple of acquisitions over the last six months. While we continue to evaluate companies, my primary focus is on making sure these acquisitions are successful, and we are delighted with both customer reaction and our initial results. In closing, as we approach RSA next week, we know there will be a robust debate about whether the endpoint or the firewall is the center of security. In our mind, this debate is looking at security through too narrow a lens. We believe the future of security is about data. It's about data, it's about machine learning from that data, and orchestrating and automating responses.
For customers who are struggling to manage too many disconnected security point products, we believe that our platform approach to security with high levels of integration, analytics, and automation is the answer for the future of security. We believe Cortex is the future. With that, I'll turn the call over to Kathy.
Thank you, Nikesh. Before I start, I'd like to note that except for revenue and billing figures, all financial figures are non-GAAP, and growth rates are compared to the prior year periods unless stated otherwise. All current and prior period financials discussed are reflected under ASC 606, as we adopted the new standard as of August 1st, 2018. In the second quarter, we once again added new customers at a rapid pace while also driving robust expansion business. Our top 25 customers, all of which made a purchase in Q2, spent a minimum of $35.6 million in lifetime value, a 39% increase compared to the same period last year. In the second quarter, total revenue grew 30% to $711.2 million. By geography, Q2 revenue grew 27% in the Americas, 38% in EMEA, 35% in APAC. Q2 product revenue of $271.6 million grew 33% compared to the prior year.
Q2 SaaS-based subscription revenue of $249.7 million increased 36%. Support revenue of $189.9 million increased 21%. In total, subscription and support revenue of $439.6 million increased 29% and accounted for 62% of total revenue. Our non-attached offerings continue to show strong momentum, and we exited the second quarter with run rate billings of approximately $383 million, growing approximately 60% year-over-year. Q2 total billings of $852.5 million increased 27% year-over-year. The dollar-weighted contract duration for new subscription and support billings in the quarter was approximately three years. For the first half of fiscal 2019, billings of $1.6 billion increased 27% year-over-year. Product billings were $514.9 million, up 33%, and accounted for 32% of total billings. Subscription billings were $646.7 million, up 30%. Support billings were $449.4 million, up 17%. Total deferred revenue at the end of Q2 was $2.5 billion, an increase of 32%.
Q2 gross margin was 76.3%, an increase of 30 basis points compared to last year. Q2 operating expenses were $367.5 million or 51.7% of revenue, which represents a 220 basis point improvement year-over-year. Operating margin was 24.6%, an increase of 250 basis points. We ended the second quarter with 5,856 employees. Non-GAAP net income for the second quarter grew 49% to $147 million, or $1.51 per diluted share. Our non-GAAP effective tax rate for Q2 was 22%. On a GAAP basis for the second quarter, net loss declined by 90% to $2.6 million, or $0.03 per basic and diluted share. Turning to cash flows and balance sheet items. We finished January with cash equivalents, and investments of $3.6 billion. During the quarter, we completed our $1 billion share repurchase program, which was effective through December 31st, 2018.
We repurchased approximately 1.9 million shares of common stock at an average price of approximately $178 per share. On February 22nd, our board of directors approved a new $1 billion share repurchase program. The new repurchase authorization will expire on December 31st, 2020. Turning to cash flow, Q2 cash flow from operations of $275.4 million increased 13%. Free cash flow for the quarter was $251.9 million. This figure was impacted by approximately $15 million of imputed interest expense associated with redemption of the 2019 convertible debt. Adjusting for this and other cash charges, free cash flow in the quarter was $271.4 million, up 21%, at a margin of 38.2%. Capital expenditures during the quarter were $23.5 million. DSO was 50 days, a decline of nine days from the prior year period. Turning now to guidance and modeling points.
For fiscal Q3 2019, we expect revenue to be in the range of $697 million-$707 million, an increase of 23%-25% year-over-year. We expect non-GAAP EPS to be in the range of $1.23-$1.25, which includes expenses related to the proposed Demisto acquisition, using approximately 99 million-101 million shares. Before I conclude, I'd like to provide some additional modeling points. Our Q3 non-GAAP EPS guidance includes a net increase in M&A expense of approximately $5 million or $0.04 per share, attributable to the proposed Demisto acquisition. In the first 12 months following the acquisition, we expect Demisto billings of approximately $50 million-$55 million. Our EPS guidance also includes an expected $0.01 impact due to U.S. tariffs on Chinese origin goods. We expect our non-GAAP effective tax rate to remain at 22%. CapEx will be approximately $20 million-$25 million.
To help you model billings for the remainder of the year, we are comfortable with current consensus for the second half of the year. For fiscal 2019, including acquisition-related operating expenses, we expect an adjusted free cash flow margin of approximately 36%. This fiscal 2019 number is adjusted for one-time items consisting of the previously communicated $97 million related to the settlement of 2019 convertible debt and between $35 million-$40 million of cash flow associated with our new headquarters in Santa Clara. With that, I'd like to open the call for questions. Operator, please poll for questions.
Yes, ma'am. If you would like to ask a question, please signal by pressing star one on your telephone keypad. If you are using a speakerphone, please make sure your mute function is turned off to allow your signal to reach our equipment. Again, press star one to ask a question. We'll pause just for a moment to allow everyone an opportunity to signal for questions. Okay, our first question comes from Walter Pritchard, Citi.
Hi. Could you give us an update on service providers? It sounds like you're still pretty excited about that opportunity. I don't know if you're willing to express it as a percentage of revenue or whatnot, but curious as an update on that and then how the product is ready to follow up.
Hi, Walter. Thanks for your question. Look, as I mentioned when we launched K2, we talked about it last quarter, we believe the 5G opportunity is a unique opportunity, the whole focus on IoT, we've been talking to a whole bunch of telcos and service providers out there's a twinkle in their eye when we start talking about the B2B use case for 5G, where they would not have cared as much as Well, I shouldn't say that for them, but they were not as focused on individual consumers and the ability to hack their phones or provide security.
As it comes to B2B use cases, providing bandwidth at the edge, they are very concerned with making sure that their B2B customers have a secure tunnel going all the way from their devices or their cars or whatever they choose to implement, or healthcare device to the rigs, back to their cloud. We believe our firewall is uniquely positioned to solve that problem for them in the K2 firewall space. We're very happy with a lot of conversations we're having. We're starting to see requests for integrating that in some sort of testing with them. All I can say is, early days, but we're happy with the direction the conversations are taking.
Maybe for Kathy, on the endpoint side, I guess that's been a market where you haven't really had a complete solution, arguably, until now. Should we think about seeing a pretty significant ramp in that net revenue here as we go into the second half of your fiscal year, giving you a complete product, you'd have some of those new relationships and so forth? Or is that maybe too ambitious, and we should think about that as more of a fiscal 2020 driver?
We're very excited about the new Traps 6.0 and of course, Cortex XDR, which will leverage Traps 6.0. We think that it's going to be a very compelling solution for our customers, and so we obviously have a lot of confidence in our ability to drive acceptance of that product in the marketplace. In terms of what's going to drive our overall revenue performance, I'm really not going to start to get into those kinds of details, but we're very excited about Traps 6.0 and think that it offers us great potential for the future.
Okay. Thank you.
If you find that your question has been answered, you may remove yourself from the queue by pressing star two. Our next question comes from Karl Keirstead, Deutsche Bank.
Thank you. Maybe one for Nikesh, one for Kathy. Nikesh, the product revenue growth acceleration to 33%, I think, was super impressive. I'm wondering if you could just comment on where you saw strength, either by appliance family or vertical, perhaps. Maybe just give a little color on if there was any particular driver of that. Kathy, the question for you is really on the margin outperformance, I don't think anybody was modeling a 250 basis point margin improvement. I'm assuming that something occurred on the sales and marketing line. Maybe you could offer some color as to whether any expenses were deferred out of 2Q into 3Q or if there's anything else unusual. Thank you.
Hey, Karl. Thanks for your question. I think I have to say that there's no specific driver but a general level of activity we're seeing out in the marketplace. As we've talked about this in the past, that every time something happens in the market where a customer gets breached or somebody gets breached, there's a heightened sense of awareness and security. All I can tell you is that the conversations are getting more and more up-leveled in terms of preparedness of organizations for security, and we are seeing more and more security consciousness. From a vertical perspective, we've always done better where people care more about security. Fed has been strong for us, the financial services have been strong for us, we're seeing that filter down into other verticals.
I'd just say that, generally, strength across the board, and that's probably what has driven the revenue on the product front this quarter.
I'll just address the margin comments by saying they're very related. The strong product mix that we saw in the quarter obviously drives higher revenue yield. That obviously is helping our margins. In addition, we have been driving leverage in the business, and in Q2, we saw operating expense as a percentage of revenue decline by 220 basis points, as I mentioned in my remarks. You're right that sales and marketing is driving that number and the leverage that we're seeing. We've seen that for the last several quarters, good leverage in terms of sales and marketing expense overall.
Got it. Okay. Thank you both.
Thank you.
Our next question comes from Fatima Boolani, UBS.
Good afternoon. Thank you for taking the questions. One for Nikesh and one for Kathy. Nikesh, one of the things that you've talked about and have been focusing on is packaging your cloud solutions in a better way and also taking steps to ensure the entire portfolio, which has expanded quite dramatically over the last couple of years, making sure the entire portfolio is better integrated. I wanted to understand the mile markers and progress you've made on that front and to what extent that has been influencing deal sizes, deal trends, and especially that customer lifetime value metric that continues to grow apace. A follow-up for Kathy, if I may.
Sure, Fatima, thanks for your question. Look, I think I'm very excited that in eight months, we've been able to create real focus around the three areas I highlighted. The enterprise side and expanding your question a little bit more. On the enterprise side, as I said in our prepared remarks, that I think this company had done a phenomenal job in building a firewall and putting subscriptions on top of firewalls. Basically, once you put a firewall at customer's infrastructure, which is a hard decision because you're introducing another piece in your infrastructure, which is now delivered to you by a cybersecurity vendor. It's incumbent upon us to provide more and more solutions to the customer, which can be triggered off the firewall.
I think the product team really rallied in the last eight months, and we built our first attached subscription after 2011 in our DNS Security service. The team is really charged about building more capability to our firewalls. We have 60,000 customers for firewalls. The ability to take that to our customers and say, "Look, you don't need another appliance in your infrastructure. You don't need another solution. It all works off a firewall that Networks pane, Management pane, and we give you more and more capability from the firewall you deploy." That's, to me, very exciting. That's a point of integration and a mile marker, like you called it, for integration for us on the enterprise side. On the cloud side, we're slowly and steadily working towards better integration. We're excited about our RedLock progress.
We're excited about our GPCS progress that I highlighted. These are big wins for us. The team is getting more and more excited. We're deploying more people across the regions to make sure we have the capability and the ability to go compete with the people out there offering these solutions. You can expect us to provide more proof points around integration in further quarters. We don't have anything to announce on the cloud side yet. I think, we just announced Cortex this morning. I think the marketing team has done a phenomenal job. The product team has done a phenomenal job in deploying Application Framework 2.0. I was asked last quarter what will be the proof point of us being able to show true integration across multiple data points, and Cortex XDR is that.
It is the only service in the industry which will blend endpoint, cloud, and network data as a point of integration. We believe we are making tremendous progress towards our aspiration to provide more integrated services. You can expect us to do more and more of that.
That's super helpful. Kathy, maybe a question for you on the gross margin. Certainly a little bit better than we were looking for. Just wanted to understand how you've been navigating some of the supply chain constraints as a consequence of the tariff, and how much longer should we expect that headwind to persist. At the same time, as the cloud solutions build out and you acquire greater scale, how should we think about those investments impacting gross margins as well? That's it for me. Thank you.
Yep, sure. In terms of our gross margin improvement during the quarter, we've said that with the new products that we introduced now almost two years ago, we made a concerted effort to ensure that we're able to improve the margins on those products over time, and we've definitely been able to do that. We've seen some improvement in the product growth margins over time. We also have seen some improvement in terms of just memory pricing, which we talked about. Memory pricing seems to be stabilizing now. We do still have some issues in terms of more commoditized parts being more expensive than they have been in the past. Overall, we've indicated an impact of $0.01-$0.02 in this quarter due to the tariff. It's kind of a mixed bag. We're seeing some improvements and we also have some negative influences.
Overall, we did see an increase of about 30 basis points year-over-year, which obviously we're very pleased about given the current environment. In terms of cloud investments and where we see that going, obviously, you've also seen some declines in our services margins as we have been investing in those businesses. We think that there's a lot of potential for us to build really big, nicely sized businesses in the cloud, and there's a great opportunity for us. We're definitely investing in those areas in order to ensure that we can capture the market opportunity.
Very clear. Thank you so much.
The next question comes from John DiFucci, Jefferies.
Thank you. My first question is actually for Lee. Lee, I think you mentioned, or it might have been Nikesh on the last call, that the new telco class appliance you're coming out with, and I assume that's the PA-7000. Just, I guess, if you could just let us know that's right, or does that replace another product? I guess if it is that new one, should we expect further launches to address this market, a market you really haven't been in very much in the past?
Yeah, good question. Let me just start by clarifying. The PA-7000 series, and specifically the new modules that were introduced and launched as part of the 9.0 release earlier this month, that is the basis for the K2-Series. The K2-Series is an optimized hardware platform targeted for service providers, and specifically the mobile networks as we see those transitioning from 4G to 5G. With 5G, the advent of much broader IoT, in particular high-value and sensitive IoT devices coming onto those that need security. They're related, but they are different offerings. Relative to service provider overall, we have been in this space, in this market, selling to service providers. We have seen success across different parts of the portfolio.
The K2-Series, though, is the first time we've designed and built a product specifically for that market to really go capture the specialized opportunity that exists there.
We're still waiting on the K2-Series, is that correct?
No, the K2-Series is now available as of earlier this month.
Okay. Okay, perfect. Thank you. Kathy, just a clarification. I mean, the results are strong across the board, all revenue categories, but especially in the product area. So I just want to make sure we understand it correctly. I mean, is all of attached subscription something I think both you and Nikesh talked about in your prepared remarks, is all of that in the subscription line, or is there any of that in the license line due to ASC 606 and the way on-premise subscription is treated under that standard?
Yeah. A portion of the VM-Series, which we talked about when we talked at the beginning of Q1 regarding ASC 606, a portion of our VM-Series is recognized upfront in that category.
Okay. It's in that line item on the income statement in the license line?
That's correct.
Okay.
Yep.
Was there any shift, is there a continuing shift to more subscription or more on what would be that kind of revenue, on-premise subscription where you'd have?
No
On the license line?
No. I mean, in terms of what's driving the growth there, that's really not a driver of the growth, not a significant driver of the growth in any respect. It's obviously, we've made the adjustment both in this year's recognition of VM-Series and last year's recognition of VM-Series. While we're seeing growth there, obviously it's not as big a portion of our business as the rest of our product revenues are. So the real impact is what we're seeing in terms of the rest of the product category.
Perfect. Thank you very much. It's very clear.
Yep.
Just a reminder, if you would like to ask a question, please press star 1. Our next question comes from Gur Talpaz, Stifel.
Thanks for taking my question and congrats on the results. A few product-centric questions here. One, how should we think about the efforts around XDR and Cortex in conjunction with your vision for Demisto and the App Framework? Ultimately speaking, how intertwined are these initiatives?
Then perhaps Lee can jump in with the real answers. Look, for us, Cortex is a big deal. We've spent a lot of time in making sure we get the underlying platform right. I think by deploying it on the public cloud and using the features that have come where you can handle massive amounts of data and being able to leverage the native AI tools, that is very useful. I think XDR is very critical. I think XDR is a service, which there's a whole bunch of startups out there trying to provide that kind of service. I think it's different when we deploy that service where you can leverage the data you collect from Palo Alto firewalls and from Traps and from our cloud security sensors. We actually, there are many customers who deployed all three from us.
We have the opportunity to go to them and say, "Look, you already have them. Here's a real tool that can help you in your SOC." See with all that stuff that was available in the past. I think Demisto was something that, I think you and I haven't talked about this. We wouldn't talk much about it because I wasn't going to talk to you about it until we figured out we want it. I think when we went out to our customers, the customer's big challenge is I got so many cybersecurity solutions. I'm getting 3 to 10 times more alerts than I was getting 2 to 5 years ago. I'm going to have to hire more and more analysts to figure out how to solve the alerts. This cannot be a punitive damage.
The more secure I want to feel, the more products I need to deploy, the more people I have to hire to solve the alerts that you guys send me. We realized that there is a crescendo where people are saying, "I need more help solving these alerts than going out and generating them." I think Demisto fits squarely in that sore spot in the industry, no pun intended. I think part of the opportunity we have is to be able to take that and leverage that across the entire Application Framework. We can leverage that across data from not just Palo Alto Networks, but other vendors and Demisto's already mastered that art.
Yeah, just to piggyback on top of what Nikesh said, I think, one of the ways to think about this is we do want to actually encourage customers to have more alerts. More data is always a good thing. Only if, for the majority of that, we can automatically deal with that. That is where Demisto will fit in, is that automated playbooks and analytics to deal with the large volume of alerts coming in. Then XDR provides that ability to stitch together data from different sources, really understand it, and proactively present it to the SOC analyst for the more sophisticated attacks, where you actually need an analyst to spend some time understanding it, investigating it, and initiating a response. They do work very hand in hand, in terms of how a SOC analyst would think of the capabilities.
Yeah, that's actually really helpful. Nikesh, you talked about a strong customer response for Demisto, I want to know if you've had a chance to talk with any integrated vendors yet, if you've gotten any responses from those that have worked directly with Demisto in the past and how they view the integration and acquisition going forward.
We have had an opportunity. I think it's fair to understand that the biggest role in this process belongs to the customer. Demisto is deployed in a customer's infrastructure with their explicit permission to be able to access the data from the customer and remediate back into their infrastructure. They built the product on the back of open connectors that are available from every vendor out there. There's no proprietary connectivity that Demisto leverages that is going to change by the acquisition, if that's where your question is headed. In addition, Demisto will also have access to a lot of Palo Alto data, which is just impossible for us to deploy anywhere else but in Cortex.
That's helpful. Thank you.
Our next question comes from Gabriela Borges, Goldman Sachs.
Good afternoon. Thank you. Nikesh, I was hoping you could expand a little bit on the monetization opportunities around XDR. We've talked about monetization with the Application Framework more broadly, maybe just specifically on XDR and the decision to include Traps within the broader bundle. Just the puts and takes on how you thought about that. Thank you.
Sure. Thank you. Look, again, I'm going to give you a little overview, and Lee will jump in, hopefully. From an XDR perspective, I think our thesis going into it was the thesis of integration. This is something the company had already been working on for a while, with the acquisitions of Secdo and LightCyber, that we could figure out how to take all this data and provide it consistently in one way, as opposed to deploying more and more tools against the infrastructure. XDR for us is very important because it is actually the first critical application from our end, which integrates data from all the three sensors that I mentioned. It's very important as we get into the SOC business.
Also, part of the observation we've had is that as more and more sophisticated tools get developed, it becomes impossible for customers to train their SOC analysts across multiple tools. If you noticed, I mentioned this, but I think I want to highlight it, that we've actually partnered with five partners who are going to help us manage this as it gets deployed in the SOC. Because we believe the true leverage is from being able to fully utilize the product across all the data that we've collected or we will be collecting for XDR. In terms of the Traps decision, I think if you look at the endpoint industry, and I've stared at it hard over the last eight months, there's a lot of vendors. There's a lot of vendors who used to do a certain set of features.
There's new vendors who do certain set of new features. We've sat and thought about how we could make sure that Traps, over time, becomes the ubiquitous endpoint agent in the market. We realized that endpoint protection in its most advanced form should become table stakes. Every customer should have it. The endpoint agent has, in my mind, at least two major features. One is to provide protection at the endpoint, but as importantly, is to provide data to be able to go back into a cloud database, if you will, which allows them both to leverage it across other security solutions, but also be able to send behavioral threat data back to the endpoint. We thought bundling Traps and XDR would be the right outcome.
Because we want ubiquity on Traps, we want to make sure that's available free to our customers so they can deploy it. As you probably know, customers have multiple endpoint agents running in their infrastructure. They're not required to replace anything. This is just a free product that they can deploy, which allows us to leverage XDR more effectively for that customer. He's coached me well, and he's giving me a thumbs up, which means you got the answer.
The follow-up is for Lee. I think he might know the answer to this. When you look at your customer base on next-generation firewall, do you have a sense for to what extent your customers have standardized on Palo Alto deployments for the firewall versus maybe are still dual sourcing or have multiple firewall vendors, and can some of the new policy rules and the features that you have in 9.0 help with that standardization effort?
Great question. The high-level answer is obviously going to be, it depends. It depends on a number of things, such as how large the customer is, when they initially became a customer of Palo Alto Networks, and where they are on that journey. We see, certainly, a lot of our customers, they often will initially purchase for a particular project, deploy, gain success out of that, and then use that success to leverage across other parts of their infrastructure over time. Obviously, we try to accelerate that, and capabilities like the Policy Optimizer actually allow us to help accelerate that by moving them more quickly into the kind of security policies we think and they think are better, both from a security perspective as well as a ease of operation perspective.
The second aspect of that is the more they are able to see the value and consume the value of additional subscription services on top of that, whether that's the threat prevention subscription, WildFire, PAN-DB URL filtering, GlobalProtect, or now with 9.0, the DNS Security service, the more value they see out of using us as their primary firewall and infrastructure, which also then often drives broader consumption and usage. It is a journey. What we see both in terms of utilization as well as footprint does continue to expand.
Thank you.
Thank you.
Our next question comes from Sterling Auty, J.P. Morgan.
I'm curious how you guys think about the need for product growth moving forward within the overall growth of total revenue. You started as a razor and razor blade model. Now you have a substantial amount of non-attached subscription. How fast does product have to grow moving forward for you to deliver on your growth goals?
That's a good question. I think, look, we'd like more and more customers to deploy our firewalls. In that respect, yes, we'd like to see product growth, we want to see both depth and breadth, that's why we're embarked on a rejuvenation of our subscription services, because we believe that the firewall can offer multiple subscriptions to our customers. We found good success and uptake every time we deploy new subscription, we just want to increase the intensity of those subscriptions, because today there are still many point products that are being deployed in the infrastructure. We see the firewall not just as I said, as an inline firewall that protects you, but we also see it as a platform to be able to deploy more and more services while the customers don't need to deploy more things.
For our growth plan, it's important for us to get both depth and breadth on the product side.
Makes sense. One follow-up. On Demisto, you gave us a sense of the aspirations on the billings front, how does the contract structure look and how do we think about the billings flowing into revenue?
Kathy, did you want to not answer that?
Well, Demisto operates with a ratable model for the most part, we would expect a ratable revenue model with the Demisto acquisition. Does that answer your question, Sterling?
Well, sort of. In other words, we should expect the revenue contribution initially to be small, but for it to layer in. In that four-quarter look, the second half should be substantially bigger than the first half, or is that the wrong way to look at it?
Well, I think you're on the right track, that revenue does lag bookings in a ratable revenue model. You've got that correct.
Okay, thank you.
Our next question comes from Keith Weiss, Morgan Stanley.
Hi, this is Hamza Fodderwala in for Keith Weiss. Just a couple of quick questions on my end. Looking at the fiscal Q3 guidance, it implies a slight sequential downtick in revenue versus Q2, which is unlike what we've seen in the past. To what extent is that a caution related to the macro environment, whether it be tariffs or spillover effects from the Federal Government shutdown, or just typical conservatism in your forward guidance?
Look, I wouldn't read any sort of macro comment into our guidance. We're guiding a very respectable 23%-25% year-over-year revenue growth range on a pretty tough compare last year. We feel very comfortable with where we are in terms of our guidance.
Got it. Just a follow-up question on the free cash flow margin. You mentioned a 36% free cash flow margin roughly for the full year. Does that include the one-time payments or does that exclude that?
The 36% full-year free cash flow margin that we guided to includes the adjustments. That's an adjusted free cash flow margin. Yeah.
Okay. Thank you.
Yep.
Our next question comes from Shaul Eyal, Oppenheimer & Company.
Thank you. Good afternoon, guys. Congrats on the strong results and outlook. Nikesh or Kathy, I think this quarter has shown the strongest level of growth in EMEA, I think at around 38% year-over-year. What's driving this ongoing improvement? Is that the work you've been doing with the biggest distributors? Is it demand trends? Help us understand. Thank you.
Well, I think, generally speaking, that as Palo Alto Networks as a company has grown and we've expanded globally, we spend a lot more time making sure we have robust teams in every country in Europe. We have very strong leadership there. I think, in my mind, it's really getting out there in front of customers and presenting our solutions and penetrating the market. It's just good execution on the part of our EMEA team. All I can say is from prior experience, a U.S.-based company is very focused in the U.S. where it starts, over time it started expanding globally, and we have a lot more room, we think, in our international markets, and we're going to be continuing to focus on execution, not just in the U.S., but in EMEA, as we've shown, and various parts of Asia Pacific and LATAM.
That's fair enough. As a follow-up, if I may. Linearity trends, if I'm looking at the past few quarters, seem to be slightly improving, not as back-end-loaded as prior ones. Just looking for some color, if possible, on that specific point. Thank you for that.
Yeah. Our linearity in terms of when our bookings come in has remained fairly consistent over time. We do see, depending on the quarter, for example, in the quarter just ended, December obviously is a year-end month, so we see different linearity in that quarter than we do in other quarters, but that's been very consistent over time.
Got it. Thank you.
I wouldn't really call out anything particularly new or different there.
Okay. Thank you for that.
Yep.
Our next question comes from Philip Winslow, Wells Fargo.
Hey. Yeah, thanks for taking my question. On the site with the launch this morning, I take it you had 60,000 enterprise customers. I might just look at that versus the end of the year, it's up about 6,000, which is actually ahead of where you were through the first half of fiscal 2018. Obviously you continue to add net new customers at a very healthy pace. When you start to think about forward guidance, even just medium-term planning, how are you thinking about prioritization of go-to-market between upsell of obviously what is a growing product portfolio in the existing install base versus continuing to land new customers?
Well, I think part of the challenge we've given to the sales team is we've got to be able to walk and chew gum at the same time. We're going to have to do a bit of both. I think to be able to sustain the growth aspirations we have, we have to go out and expand in our existing base. We also have to be able to land new customers because we have a lot of new products that we're trying to deploy, which will be deployed both in our existing customers and new customers who may be more receptive to our new products, which we are deploying in the cloud space, in the Cortex space. We really are trying to focus on both ends.
The opportunity to go to existing customers and sell them existing product, new product of course, is great because they already have experienced our products, have deployed them, and have the training and the experience on the products. We're challenging our teams to try and do a bit of both.
Got it. Just to follow up on that in terms of, obviously, the healthy net new customer adds, any changes that you're seeing in those deals in terms of just win rates versus the competition, your pricing in those deals, et cetera? Just any sort of color on that would be great.
Our win rates haven't changed substantially over the last 12 months or last eight months, at least since I've been here. I think it's been pretty consistent across the board. We are seeing better traction, obviously, in some of our newer products, which we haven't seen in the past, hence the growth rates sustaining over 60%, as Kathy mentioned. We are seeing traction there. We are seeing our teams beginning to form around it. We have high expectations from the team in that area. Generally, from a landscape perspective, one of you highlighted the success we're seeing more in EMEA, so clearly that's more of a penetration strategy. I think it's just steady execution across all fronts, and wherever we feel that we need to go step in and create more effort, we do, by constantly inspecting our processes.
Cool. All right. Thanks, guys.
Thank you.
Okay, our last question comes from Ken Talanian, Evercore.
Guys, thanks for taking the question. Are you seeing most customers make enterprise-wide purchases of GlobalProtect Cloud, or most of the deals thus far are more representative of a land and expand opportunity?
Look, there are customers who already have Palo Alto Networks firewalls deployed, they're used to our Panorama management pane, they understand how to set up policies and how to make it work. GlobalProtect cloud service just becomes an extension of their security posture. we've also seen, as I highlighted the two wins we've had, we've also seen situations where we walked in and a customer has deployed GlobalProtect cloud service because they believe it's a more secure product than the other product, which is competitive, which I cannot name. I forget.
Okay. Last question. Have you made or do you plan to make any changes this year to Sales force compensation or the compensation terms?
Look, we're constantly adapting our sales force's compensation to make sure it meets the objectives we set for ourselves. Of course, we also take feedback based on where our expectations were different from what has transpired in the market. there's nothing substantive that we have changed or we plan to change during the course of our year because so far it seems to be working.
I would agree. Thank you.
Well, if there are no more questions, I just want to thank all of you for attending our call. I also want to give a big shout-out to the team at the company. They've done a phenomenal job. Thank you very much, and I look forward to meeting with many of you in the upcoming weeks and some of you at the Morgan Stanley conference. Thank you.
Thank you, ladies and gentlemen. This concludes today's teleconference. You may now disconnect.