Good day, and welcome to the Palo Alto Networks Fiscal First Quarter 2019 Earnings Conference Call. Today's conference is being recorded. At this time, I'd now like to turn the conference over to Amber Ossman, Director of Investor Relations. Please go ahead, ma'am.
Good afternoon, and thank you for joining us on today's conference call to discuss Palo Alto Networks' Fiscal First Quarter 2019 financial results. This call is being broadcast live over the web and can be accessed on the Investors section of the website at investors.paloaltonetworks.com. With me on today's call are Nikesh Arora, our Chairman and Chief Executive Officer, Kathy Bonanno, our Chief Financial Officer, Lee Klarich, our Chief Product Officer, and Dave Peranich, our Executive Vice President, Worldwide Sales. This afternoon, we issued a press release announcing our results for the fiscal first quarter ended October 31st, 2018. If you'd like a copy of the release, you can access it online on our website.
We'd like to remind you that during the course of this conference call, management will make forward-looking statements, including statements regarding our financial guidance and modeling points for the fiscal second quarter 2019, our competitive positions, and the demand and market opportunity for our products and subscriptions, benefits, continued execution focus, and timing of new products and subscription offerings. These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today, and you should not rely on them as representing our views in the future, and we undertake no obligation to update these statements after this call.
For a more detailed description of factors that could cause actual results to differ, please refer to our annual report on Form 10-K filed with the SEC on September 13th, 2018, and our earnings release posted a few moments ago on our website and filed with the SEC on Form 8-K. Also, please note that certain financial measures used on this call are expressed on a non-GAAP basis and have been adjusted to exclude certain charges. For historical periods, we've provided reconciliations of these non-GAAP financial measures to GAAP financial measures in the supplemental financial information that can be found in the Investors section of our website, located at investors.paloaltonetworks.com.
We'd also like to inform you that we'll be participating in the 2018 Wells Fargo Tech Summit in Park City, Utah, on Tuesday, December 4th, and the Barclays Global Technology, Media and Telecom Conference in San Francisco on Wednesday, December 5th. Lastly, once we have completed our formal remarks, we will be posting them to our investor relations website under Quarterly Results. With that, I'll now turn the call over to Nikesh.
Thank you, Amber. Hello, everyone, and thank you for joining us this afternoon for our fiscal first quarter 2019 results. As you know, it's been a busy few months for me at Palo Alto Networks, and I am delighted to report that we had another outstanding quarter, and once again, we have been able to grow our top line significantly faster than the market. I'm also happy to say that my cybersecurity education is progressing nicely as I continue to meet more customers, partners, and employees. During this quarter, we held our first-ever European Ignite, our user event in Amsterdam, and our second annual Federal Ignite event in Washington, D.C. At these events for our customers and partners, we consistently heard from multinationals to governments all the challenges that are associated with protecting data in a digital world.
Mobility, the movement of data to the cloud, data analytics, and machine learning are some of the trends that we believe are forcing companies to reevaluate their security posture in a more comprehensive manner, looking for high levels of integration and automation. In this way, we believe we are uniquely positioned to support our customers across all these three events. One, securing their enterprise. Two, enabling them on their journey to the cloud, and three, helping them with their desire to deploy advanced AI and ML across their enterprise. Let's discuss some current examples of how we're solving customer problems and what we have in store. Service provider is a segment where we have traditionally not done as well as we would like. We're about to change that.
We're excited to announce a new product for our service provider partners, an area we plan to focus on and invest in for future growth. Our service providers are facing a major mobile infrastructure transition from 4G to 5G. We want to be there with them to help them succeed. We're announcing a new super scale next-generation firewall, the K2-Series, that has been developed specifically for service providers for their high throughput needs, taking into account their price considerations, their upcoming 5G and IoT transition. We expect it'll be available shortly in early 2019. In a segment where we've done well, the federal space, WildFire, our cloud-delivered malware analysis service, achieved FedRAMP Ready status during fiscal Q1. This extends our ability to provide advanced threat prevention and analysis capabilities to U.S. federal agencies. For our largest customers, we introduced Panorama Interconnect.
The new Panorama plugin gives customers the ability to manage the configurations of over 30,000 next-generation firewalls from a single Panorama console, and they can push configuration changes to all managed devices from one single location. This continues our quest to simplify large-scale security management for our customers. Lastly, in cloud security, we closed our RedLock acquisition this quarter. RedLock adds to our already extensive set of cloud security offerings, which include Evident, Aperture, GlobalProtect cloud service, and VMC. By combining the Evident RedLock technologies, we will provide customers with cloud visibility and compliance, cloud security analytics, and advanced threat detection in a single offering to be released very early next year. Video offering will help security teams better understand their cloud deployments, detect and respond faster to the most critical threats, and achieve automated remediation.
I know there's a lot of discussion around our philosophy and my philosophy on M&A, I'd like to use the subject of RedLock to refine our point on the M&A philosophy. The technology required is best in class. We have a clear opportunity to be a leader in this space, and we believe that we can significantly enhance the value of the asset we acquire. We invest in a product-focused team and technology that we believe we can integrate quickly and effectively into our infrastructure. I want to reiterate that as a shareholder and as an investor, my interests are aligned with yours to create long-term shareholder value. To give you some guidance, any activities in the area of M&A are going to be disciplined.
They're going to be guided by an aspiration to, one, participate in a large market, two, become number one or number two in that market, and three, bring the vast execution capabilities of Palo Alto Networks to any acquisition so that we can instantly enhance value. Looking forward, we will continue to stay strong in network security, adding capabilities to solve our customer problems. Additionally, we will lean forward into the trends of cloud, machine learning, and AI in a big way. These important technologies, paired with our vision of simplifying security and providing a platform with consistent protection across an enterprise environment, is resonating with customers. The application framework and XDR are the next step in our evolution towards this goal. We're making good progress under the leadership of our Founder, Nir Zuk.
While we're still in the early days, during Q1, seven partners launched applications of the framework. The technologies these partners bring to the framework include analytics, MSSP, identity, threat intelligence, security for industrial control systems, IoT, and network access control. Before I move on, I'd like to add a little bit more color on my first 180 days. As we all know, execution has been a key variable in our success as a company, and will continue to be so in the future. During our last earnings call, I mentioned launching speed boats with focused leadership accountable for results in our more nascent market opportunities. While we have a great execution machine, we want to make sure our speed boats give us the flexibility to operate and execute effectively in some of the newer areas.
Our first speed boat in cloud security has been launched and is off to a good start. We have product and sales leaders jointly driving our cloud performance, and we expect this focus will allow us to execute as well in new areas as we have done historically. We'll likely launch additional speed boats in the future, and we'll keep you posted on our progress. We have an excellent go-to-market engine that is running well. With our new President, Amit Singh, we have a leader in place who brings extensive experience growing enterprise and cloud businesses and driving revenue scale. Amit joined us on November 1st and has been extremely busy in his first few weeks on the job.
He's finished over 50 account reviews, met as many customers already this quarter to both share our commitment to them and learn from our customers on how we can best partner with them. He's running hard, and I'm excited that we found such a capable leader to fill this important role. He joins a great team, and together they will remain focused on executing against our significant market opportunity and momentum across the platform. In our fiscal Q1, the team lived up to their reputation as we once again acquired new customers at a rapid rate and expanded our wallet share with existing customers. Our top 25 customers each spent a minimum of $33.6 million in lifetime value, which is a 45% increase over the $23.2 million they did in Q1 of fiscal 2018.
Examples of customer wins and competitive displacements in fiscal Q1 that demonstrate the progress we're making across the network, endpoint, and cloud are: we landed a top-tier airline in the U.S. to secure their data centers. We also replaced a competitor in the data center and sold all of our data subscriptions at a U.S.-based investment management company. Our cloud firewalls VM-Series was selected as a security standard for one of the world's largest networking telecom companies in the world. Our cloud monitoring and compliance offering, Evident, was selected to secure the public cloud infrastructure on one of the world's largest banks based in Europe. GlobalProtect cloud service was selected to secure the remote factories, offices, and stores of one of the world's leading manufacturers and marketers of quality skincare, makeup, fragrance, and haircare products. No points for guessing who that is.
Our advanced endpoint protection offering, Traps, was selected to protect 10,000 devices at a leading healthcare provider in Australia. To round out the news on the quarter, we were happy to be positioned as a leader for the seventh consecutive year in Gartner's 2018 Magic Quadrant for Enterprise Network Firewalls. This positioning reflects our commitment to staying ahead of the threat landscape and providing our customers the best protection against the ever-evolving threat of cyberattacks. I personally remain extremely excited about the opportunity ahead of us and plan to keep my head down and continue to execute with our leadership team. I'd like to thank our customers and our partners for their support, and of course, the team at Palo Alto Networks for their dedication to our mission. I've really enjoyed becoming more established at Palo Alto Networks and learning about cybersecurity and working with this great team.
I wake up every day excited to be part of this great company. With that, I'm going to turn the call over to Kathy.
Thank you, Nikesh. Before I start, I'd like to note that except for revenue and billing, all financial figures are non-GAAP, and growth rates are compared to the prior year period unless stated otherwise. All current and prior period financials discussed are reflected under ASC 606, as we adopted the new standard as of August 1st, 2018. As Nikesh indicated, we had a great start to our fiscal year. We continue to see healthy security spending and strong demand across our platform. In the first quarter, total revenue grew 31% to $656 million. By geography, Q1 revenue grew 29% in the Americas, 35% in EMEA, and 35% in APAC. Q1 product revenue of $240.5 million grew 30% compared to the prior year. Q1 SaaS-based subscription revenue of $231.3 million increased 37%. Support revenue of $184.2 million increased 24%.
In total, subscription and support revenue of $415.5 million increased 31% year-over-year and accounted for 63% of total revenue. Q1 total billing of $758.5 million increased 27% year-over-year. The dollar-weighted contract duration for new subscription and support billings in the quarter was approximately three years, consistent with what we have seen in prior periods. Total deferred revenue at the end of Q1 was $2.4 billion, an increase of 34%. Q1 growth margin was 76.7%, relatively flat to last year. Q1 operating expenses were $366.5 million, or 55.9% of revenue, which represents a 140 basis point improvement year-over-year. Q1 operating margin was 20.8%, an increase of 150 basis points year-over-year. We ended the first quarter with 5,645 employees. Non-GAAP net income for the first quarter grew 64% to $115.4 million, or $1.17 per diluted share.
On a GAAP basis for the first quarter, net loss declined 39% to $38.3 million or $0.41 per basic and diluted share. Turning to cash flow and balance sheet items. We finished October with cash equivalents, and investments of $3.8 billion. Q1 cash flow from operations of $252.3 million declined by 8%. Free cash flow for the quarter was $218 million. During the quarter, we redeemed $327 million of the $575 million 2019 convert. For accounting, $52.3 million of the amount redeemed is categorized as cash flow from operations. Adjusting for this and other cash charges, free cash flow in the quarter was $275.4 million, up 27%, at a margin of 42%. Capital expenditures during the quarter were $34.3 million. DSO was 58 days, a decline of 12 days from the prior year period. Turning now to guidance and modeling points.
For fiscal Q2 2019, we expect revenue to be in the range of $675 million-$685 million on an ASC 606 basis, an increase of 24%-26% year-over-year. We expect second quarter non-GAAP EPS to be in the range of $1.20-$1.22, also under ASC 606, using approximately 99 million-101 million shares. Before I conclude, I'd like to provide some additional modeling points. Our non-GAAP EPS guidance includes expense of $10 million-$15 million associated with our recent acquisitions. Also included is our expectation of a $0.01-$0.02 impact associated with U.S. tariffs on Chinese origin goods. As we continue to retire the 2019 convertible debt through maturity in July, we expect approximately $45 million of the remaining $248 million balance to be accounted for as cash flow from operations. We expect our non-GAAP effective tax rate to remain at 22%.
CapEx in Q2 2019 will be approximately $25 million-$30 million. With that, I'd like to open the call for questions. Operator, please poll for questions.
Thank you. At this time, we'd like to open the floor for questions. If you would like to ask a question, please press the star key followed by the one key on your touch-tone phone now. Questions will be taken in which the order they are received. If at any time you'd like to remove yourself from the questioning queue, please press star two, and please limit yourself to one question and one follow-up question. Again, that is star one to ask an audio question. It looks like our first question will come from Ken Talanian with Evercore ISI.
Hi. Thanks for taking the question. First off, could you give us a sense for what, if any, changes you have made to your go-to-market efforts on the firewall side? I'm thinking of that inclusive of the channel.
Thanks, Ken. Thanks for your question. We haven't made any particularly major changes to our go-to-market on the firewall side that I can think of or including the channel. I think the efforts continue to be the same. Dave, can I have you?
Yeah, Ken, it's really been business as normal on that front. The sales team is enthused and highly engaged. We've got the industry-leading product. We've got great traction and great markets in front of us to grab. We feel great about that business.
Okay. As a second question, could you give us an update on your traction with GlobalProtect Cloud and how you would characterize your win rates there?
Thinking on the GlobalProtect Cloud front, we think we have a unique opportunity as we see people trying to go ahead and automate and put security and come up with a new architecture for their remote branches and for their remote offices. We think GPCS is a unique product, which does really well. We've had some good success with some very large players. We'll share more about the success in our next quarterly call. For now, again, it's an interesting product. It's unique in the way it allows our existing customers of Palo Alto Networks to be able to extend their network security, which they already have in the data centers, off to the remote branches without having to change the management control system, et cetera. Really exciting. We're seeing a lot of traction, hopefully we'll tell you more about it next quarter.
Great. Thanks very much.
Thank you. Our next question will be from Matt Hedberg with RBC Capital Markets.
Hey, guys. Congrats on the quarter. Nikesh, in your prepared remarks, you talked about an increased focus on the service provider segment, which is great to hear. It sounds like there's a new product coming early next year. There's obviously a lot of drivers here. You mentioned a couple of them, including 5G. I guess I'm wondering, can you give us a little bit more detail on how this new product portfolio might accelerate the momentum there? Is there anything else from a go-to-market perspective that needs to be also augmented?
Matt, thanks for your question. Look, let me give you a very high-level point of view, then I'll have Lee jump in and give you some more insight into why we believe this product meets the needs for the future for our service provider customers. It's a segment when I came here, where I realized we haven't done as well as we'd like to. There's structural reasons for it. There's reasons on the service provider side for it, but that's not enough of an answer. We sat down and looked at what we should be doing, what we can do, and the product team really rallied hard the last six months to be able to put this together. We believe we already have the industry-leading firewall from a security and networking perspective.
We just needed to make sure we were emphasizing some of the features that the service providers need in the future. From that perspective, I think the team has done a phenomenal job in getting us ready. Remember, the sales cycles with service provider are long. You're not going to be hearing us blow the top off from a sales perspective in three months. This is a prerequisite for us to be strong in that sector. We have a very dedicated go-to-market team in the SP space as one of our few spaces where we have a dedicated team around the world, and they're very excited about this new product. Let Lee jump in and talk about why this product is relevant for a 5G IoT and a next-generation perspective for the service providers.
Yeah, thanks, Nikesh. When we look at what's happening in the transition from 4G to 5G, there's some really significant changes that are taking place. The first is just the advent of IoT becoming really high scale on mobile networks with the capabilities that 5G offers. Second is a lot of that is going to be high-value IoT. It's going to be medical device use cases. It's going to be connected cars. It's going to be things that are really important. The third is more and more applications are moving into these mobile environments. When we think about that, you can just imagine the need for the best security all of a sudden becomes a critical driver for this change from 4G to 5G.
Our timing of bringing out the new K2-Series is aligned with this big shift in the SP space for this move to 5G.
That's great. Maybe one other for Lee on the product side. Obviously, RedLock seems like a great acquisition, really complementary to everything you've done. I think specifically what I can tell from Evident.io. Maybe a bit more color there. I guess it's an API framework, so it looks like it's going to be a nice integration. Maybe just a little bit more detail on how that sort of supplements what you guys have done there, including continuing to build out that side of the business.
I think, Matt, that's a great question. I think as I walked around and talked to a lot of customers, it was evident that, no pun intended, that every one of our customers was undergoing some sort of journey towards the cloud. Different shapes and forms. Some people have a public cloud instance, some people are analyzing it, some people are trying to decide. Many of them talk of a hybrid environment or a multi-cloud environment because none of them is quite yet sure where they want to land in the long term. As we went around and understood that journey, we understood that they need a multi-cloud security platform that allows them to carry their security posture from their existing data centers and their existing infrastructure into the cloud.
As we looked to that, we thought we had a product in the space called Evident, which was leading in its own way, in its own category. We looked to the market and said RedLock also was nipping at our heels and was also sort of doing really well in adjacent parts of the same market. A good offering would be the integration of the two. To the credit of our Evident RedLock team, they will integrate in the next month and be able to have an integrated product in the market by the first week of January, which I think is phenomenal given the pace of that market and given the opportunity in that market. We believe that this is the only product of its kind in the space. Lee, I'll let you talk more about it.
Yeah, absolutely. One of the things we've seen when we talk to our customers in their journey to the cloud is, one, they're all going through this journey. Two, they almost 100% don't fully understand everything that they have in the cloud already. The combination of Evident and RedLock really gives us a great window into, and our customers, a window into everything they have. So visibility, asset inventory. Based on that, it then gives them the next step, which is how to provide security analytics for that, ultimately detect threats and respond to those threats. Evident brought a certain aspect of that, RedLock brought another component, and as Nikesh said, we'll be integrating those two quite shortly into a single integrated offering.
Super helpful. Thanks, guys.
Thank you. Our next question will be from Andrew Nowinski with Piper Jaffray.
Great. Thank you, congrats on a nice quarter. You announced a new service provider product today, that's definitely a market that you should be in.
Thank you.
You've also refreshed your low-end and mid-range firewalls. I'm wondering, when can we expect a refresh of the large enterprise of the PA-7000 Series?
I'm going to let Dave answer that question. We don't talk about product futures on these calls and don't make public announcements. The PA-7000 Series is extremely competitive in the marketplace right now. It's doing great with our customers, and we're very happy with the performance on that box.
Okay. Fair enough. A question for Kathy. From talking to your sales team and your channel partners, do you feel like the enterprise buying cycle is perhaps more back-end loaded this year than it was last year as it relates to the calendar year-end enterprise budget flush?
Well, our linearity has actually been pretty good the last couple of quarters, and so I wouldn't say that we're really seeing more back-end loaded nature of the business necessarily.
Normal seasonality you're expecting this quarter?
In Q2, we've guided to what, 24%-26% year-over-year revenue growth. Seasonality there looks pretty in line with what we've seen historically.
Okay. Very good. Thank you.
Thank you.
Thank you. Our next question will be from Keith Weiss with Morgan Stanley.
Hi. This is [Toni Sacconaghi] in for Keith Weiss. Thank you for taking my question. I wanted to just dig into the security demand environment more broadly heading into 2019. It seems like we've had pretty strong refresh activity in each recent quarter. Where do you think we are in terms of this opportunity? Are we early innings still or middle innings? Just wanted to get your thoughts on that.
Yeah. In terms of refresh opportunity, we've talked about the fact that it's an important variable for us. As our cohort size increases every year over our history, it becomes a bigger and bigger opportunity for us as time goes on. While it's an important variable, it's not the most important driver of our growth. As you see, we continue to add customers at a very high clip every quarter, and our expansion opportunity within our existing customer base is quite significant. Relative to the numbers in our customer cohort of five or six years ago, just the opportunity within our existing install base and the new customers that we're adding are really the primary driver of our growth.
Got it. Just a follow-up question on that. It seems like the RedLock acquisition was a pretty good one for you. It's gotten some good feedback from the partner channel that we've talked to on that product. What other functionality gaps do you see from a cloud security standpoint that you still have to fill in? Do you think these could be addressed organically, or are you looking at all options?
Yeah. Look, public cloud security is obviously very important, and we're putting a lot of our weight behind that with VM-Series, which continues to do very well for inline security, with Evident RedLock combination, which we believe is the leading solution for API-based security and public cloud. With some of the enhancements in Traps over the last many months to include support for Linux, which is obviously the predominant operating system behind applications that run in the public cloud. That combination of inline security, API-based security, and host security, we believe is the right approach, and we feel very good about being in a position where we have leading solutions in all three of those.
Thank you.
Thank you. Our next question will be from Michael Turits with Raymond James.
Hi, guys. This is Eric Heath on for Michael. Nikesh, you indicated several times that Palo Alto will be focused on utilizing security data. Does this mean that you want to enter the SIEM market or, with the automation aspect, what we call now the SOAR market? How should we think about that?
Look, we have some very exciting products coming up early next year in XDR, which allows you to do some degree of investigation, some degree of remediation. Our application framework will allow for SIEMs and SOARs to run on top of it. We believe that we will be able to provide a comprehensive solution to our end customers as long as we can deploy our firewalls and our endpoint agents more ubiquitously across our entire base.
Got it. Just to kind of piggyback on that. Without a major investment, whether organically or inorganically, can you develop the intellectual capital and the culture around analytics and data science if you decide to go that way? You need it to kind of become a data-focused company or?
Look, we have a significant effort around analytics with our product Magnifier, which does a bunch of behavior analytics, which sits on top of the application framework. We have embedded ML people in almost every one of our product teams, albeit small. Our intention is to keep beefing that up because we believe machine learning is not just about taking a lot of data and trying to train it. Machine learning is about taking every product of yours, understanding the data that it gives you, understanding how you use that data to be able to create a better product to start with, and then leverage the ubiquity of that product to improve the outcome for every customer.
We're embedding ML people across the board, across the company. We also have analytics apps on our platform. As we see the deployment of the application framework, as we see the users' behaviors of customers, we'll decide which arrows we need to put more wood behind.
That's helpful. Thank you.
Thank you. Our next question will be from Sterling Auty with JP Morgan.
Yeah, thanks. Hi, guys. Kathy, you mentioned, I think, $0.01-$0.02 impact in terms of Chinese tariffs. Had some discussion with is some question as to if we see something go further in terms of the trade war, is there any concern about supply of products coming out of China? Do you have alternative sourcing if necessary?
Yeah. It's important for us to remind everyone that we do manufacture our products in the U.S. There are some components that we source that are only available in China. We are looking at a number of options in terms of being able to mitigate the impact of tariffs or ensure that we have dual source opportunities. Our supply chain management is always very aggressive in terms of ensuring that we have a number of options available to us, and we're doing the same in the current environment.
All right, great. Just one follow-up. Just strategically, how should we think about the product subscription growth from here for subscriptions that are not attached to a physical appliance? Whether that's a virtual firewall, et cetera, moving forward. How should we think of the growth dynamic there versus some of the physical product sales as you talked about service provider and other strategies?
Well, we've talked historically about the non-attached business being at a $274 million run rate as of Q4 of 2018, growing at 68% year-over-year. These are newer markets for us. We're seeing very nice growth in them, and Nikesh mentioned launching speed boats that we believe will help us to execute very well in these newer markets where we think we have great products, particularly in the cloud space. We've talked about the Evident and RedLock combination, we're very excited about the opportunity there. But obviously the business of the firewall growth and the product growth and our attached subscription growth is extremely important as well, and we continue to focus there. Those areas are also growing very nicely for us, which is why we continue to be able to grow at rates above the rate of the market.
Got it. Thank you.
Thank you. Our next question will be from Saket Kalia with Barclays.
Hi, guys. Thanks for taking my questions here. First, maybe for you, Nikesh. You talked about some of the early partners on the application framework. Can you zoom out a little bit, and can we talk about how customers are using logging service and maybe some of the next couple milestones that you look forward to that can help drive the app framework opportunity?
Look, I think part of the app framework pieces has always been of trying to collect the data once and use it many times across multiple applications. Because today, every cybersecurity solution that the customer sees requires some degree of intrusive probes into their infrastructure, whether it's the network or the endpoint or even their cloud security in some cases. The notion is, let's collect all the data once and then use it multiple times for multiple apps. Towards that end, for example, our Traps product is probably going to collect or collects close to 100 MB of data per user per month, which I think is probably 15 or 20 times higher than any other endpoint product in the market. That's what allows the customers to be able to collect that data once, and we can deploy multiple applications against it.
That's how we're going to be able to deploy XDR for them. There's no reason why these customers need to have that data collection happen multiple times. There are some customers who are running six to eight endpoints at the same time because each endpoint is taking a sliver of data, but the deployment life cycle of that endpoint is anywhere from three months to 12 months, depending on the complexity of the customer and the locations of their employee base. In that context, we're seeing good progress when we deploy a logging service with Traps or people use Traps management service in the cloud to be able to manage their endpoints around their enterprise. We're probably going to be able to leverage the same thing without any incremental sort of endpoint deployment for the same customer with XDR.
We can just offer that as a service atop the logging service. Similarly to products like Magnifier, which use similar data to be able to deploy the application atop of data collected from firewalls and the featured endpoint. We're seeing the evolution of the application framework as an integration point across multiple solutions. We're starting with our own first. We want to make sure that our stuff works, so there is proof in the pudding. For me, the key milestones are, can we get multiple firewall and network apps to be useful without deploying multiple sensors into the customer's infrastructure and be able to turn them on extremely rapidly? Because the speed of deployment is a key component in the future for cybersecurity. As long as we believe we're headed down that track, I'm excited.
As long as we can see other partners coming out and saying, "Oh, this is interesting. We like the fact that we have all this data. We don't have to go deploy multiple sensors across-
Our customer base or your customer base, we can just sit on top of this data, as long as there's an economic model which allows them to utilize that data and there's customer consent, we're fine letting them use it.
That makes a ton of sense. Thanks for that. For my follow-up for you, Kathy, just a quick housekeeping question. Was there anything to note on the other income line, I guess, this quarter and last? Feels just a little bit higher than what we've seen historically. Just wondering if you could talk about some drivers there.
Well, there are probably a couple of drivers. Number one, interest rates have been increasing. Number two, we have a higher cash balance given the convert that we recently did.
Okay, got it. No other sort of one-time investment gains or anything like that.
No, nothing like that. Yep.
Got it. Thank you.
You're welcome.
Thank you. Our next question will be from Gregg Moskowitz with Cowen and Company.
Okay, thank you very much. First question is for Nikesh or Lee. How did Traps do this quarter, and can you perhaps provide an update on the integration of Secdo as part of your XDR approach?
Yep. Traps continues to do well. We added a lot. We added a lot of new customers, of course. As Nikesh mentioned, the new Traps management service, which is a cloud-based service, the majority of these new customers are deploying using that service, which is great because that ties into logging service and the application framework and sets us up for some of the futures around things like XDR. On that topic, we continue to make good progress on the integration of Secdo. As we told you before, we believe that EDR is not sufficient, so the idea of doing detection response based off a single data source is not enough. We think that the endpoint data needs to be combined with network and cloud data as well. We are actively working on that. We have some of the endpoint data. We're getting more.
We have network data. We have cloud data. In parallel to that, we're making good progress on the XDR application, run on top of that, and use that data. We're on track for early calendar 2019 to have that available.
Okay, that's very helpful. Thanks, Lee. Just for Kathy, as you noted, your operating margins were up about 150 basis points year-over-year, it seems that you're absorbing the incremental cost from Evident.io and Secdo quite well. I know, of course, that you're not providing fiscal 2019 guidance. I'm just wondering, though, if there are any unusually high investments that you're targeting at this time over the balance of the year, whether it be the K2 launch or anything else.
Yeah. We're providing guidance, obviously, one quarter at a time, as you mentioned. We did reference a $10 million-$15 million investment in M&A in Q2 in our modeling point. Aside from that, there's really nothing significant for us to report at this time.
Okay. Thank you very much.
Thank you. Our next question will be from Jonathan Ho with William Blair.
Hi, can you hear me?
Yeah.
Fantastic. Just wanted to start out with the reference that you made to the speedboats. Can you maybe give us a sense of what this entails and maybe contrast that with your traditional approach?
Yeah, look, what happens when you have very successful large teams filling a large amount of revenue and you start a new product initiative, typically, some of those efforts get buried across a very large sort of team of functional organizations. What we've done is we've taken all the people who are focused on some of our new product areas, put them in the same floor. We had taken them across functions and effectively created two leaders, one on the product side, one on go-to-market side, and they have carte blanche to be able to move as fast as they'd like to move within certain guardrails. This has really increased our agility and our speed, both in terms of deployment of product, but also decisions that they need to make on a customer-by-customer basis and from a go-to-market perspective. The early results are promising.
On our cloud security space, it's really helped us. For example, the cloud security team is run by Varun Badhwar, who we brought on board as part of the RedLock acquisition. He's a CEO there. He's very excited. He's very motivated to keep driving the product strategy. Dean Darwin, who's a longstanding member of the Palo Alto Networks go-to-market and business team, they're both partnering really well. Dean brings the capability to be able to deploy that product across our very large sales force, which is globally distributed. Varun doesn't have to worry about that. Varun has to worry about continuing to build a market-leading product and going in partnership with Dean and making sure that some of our best customers sign up for the product. That's kind of like the model behind it. It's working really well so far for one of the product areas.
We're working on carving out the next set of product areas. We are almost on to our second. We'll be able to carve out a team which is going to focus on GPC as an Aperture as our second speedboat, and really excited about being able to do that, which will be driven by Adam on the product side and Rene, our CMO. Just trying to create speed and agility on the speedboat front.
Got it. That's helpful. Just wanted to also follow up on some of the newer developments with AWS and maybe your early thoughts in terms of what Outposts and some of the newer impacts could have on the business.
Look, the good thing is that what AWS, not just AWS, GCP, VMware, another RAM, or Azure, all of them are trying to encourage customers to think hard about the cloud and get out of this model of let me control my destiny by having my own data center. They're trying to convince people that we all need to go to the cloud. As people are going to the cloud, they're realizing that, yes, the cloud is.
The cloud is a fantastic platform. It gives you low latency, allows you availability, allows you to scale globally very rapidly. It's very hard to think about cybersecurity in that context. There's a whole set of conversations that come up about my data integrity, how do I move my security posture from my existing platforms to the future. That's where we think none of these cloud transitions are going to happen in a meaningful way, unless customers are able to think about a secure transition. Our job is to make sure that we partner with our current enterprise customers today and help them with the journey as they make this cloud journey and transition. There's a debate whether people are going to use AWS native security or GCP native security, or is there room for somebody like us?
Our answer is, yes, there is because there's very few. No, it's never a good ask answer, there's very few dedicated single cloud-only customers out there. Most customers are either hybrid customers, most customers are multi-cloud customers, in which case you need an independent cloud security partner who can help you across this myriad of platforms. It's very hard for one native cloud provider to produce a multi-cloud, hybrid, and public cloud environment, security environment. We believe that this is a huge space. We believe it behooves both us and AWS and GCP and Azure to partner in this journey because it's beneficial for them and beneficial for us. Honestly, like security is a 2% or 2.5% spend, across a cloud transition, maybe 3%. They're not going to go try and compete with us in that 3%-4% spend.
I know I went from two and a half to four, it depends on the customer. I like it to be more, it depends on the customer. We think there's enough room for a partnership in this space.
Fantastic. Thank you.
Thank you. Our next question will be from Patrick Colville with Arete.
Thanks for taking the question. Can I ask about core next-generation firewall? What continues to differentiate you guys? You guys are crushing it and doing a great job. Just from your perspective, what continues to differentiate Palo Alto versus the competition, to produce these results?
Look, in my six months that I've spent talking to customers and traveling around the world trying to understand both why are customers buying us and what's differentiating our product, I have to say, at least the feedback I get from our customers is that there is a very clear differentiation around security. Palo Alto Networks firewalls were built with security first in mind, and that's why you heard us launch the K2-Series just now because they balance both the throughput need to service providers as well as the high security requirements for 5G and IoT. We are a security first sort of firewall, and that resonates with all of our customers, and it's kind of the right time in the journey because early cloud migrations, early data center migrations, were a lot about moving your data there.
Now it's a lot about opening up to the Internet. The moment people start opening up ingress and egress into the Internet in a large scale basis, you open the door for cybersecurity attacks or cyber attacks across your infrastructure. At that point in time, every CIO, every CISO, is concerned about making sure that their environment is protected. Security is becoming a more and more relevant topic on the agenda of CISOs, CEOs, CIOs. They turn around and say, "Do we have good security or not?" That's not a price-sensitive conversation. It's a security-sensitive conversation. From that perspective, I think, and I can't take credit for this, is the team here and the prior management did a phenomenal job in making sure we have people around the world, we have customers, we have gone ahead and worked with these customers over the years.
Some of the deals coming to fruition now are deals teams have been working on for 12 months, 18 months, 24 months. This is a journey that we started a while ago. It is a security-focused journey, and it is a product that is clearly differentiated in the marketplace. We hope, given the more sensitivity around security, we will continue to take market share.
Got it. Can I ask in my follow-up, another high-level question like that. There's some investors that are skeptical that an appliance company can transition to be more of a software company over time because history in technology over the last 30 years shows us that that can be quite difficult. Clearly, the numbers you guys are putting out in on-app subscriptions are very healthy with growth and momentum being very strong. The indicators for now are that this transition is happening very effectively. What gives you confidence that that can continue and that you guys can continue pivoting away from product and more towards subs?
Look, I think once we look at it from an industry transition perspective, because some of us analyze the industry and look at it from afar, if you ask the customer, for them, it is a continuous spectrum. They see it as a continuous journey, they want to be able to take their existing partner with them through the journey, because security is kind of a thing where your customers have to believe and trust in you that you are going to protect them. We have many instances happen on a daily basis where the customers, we understand breaches. They call us, we work with them, we show them how to protect themselves, we show them how to improve their security posture. We build trust and reliability with over 50,000 customers around the world.
I think as we come out with new products, would a customer rather buy the next generation product from a small startup of 40 people? Would they rather have the capability of a team that's been working with them for three to five years helping the security posture? We believe the latter. Look, I'm sitting in the pit working with the team for the last six months, 12-hour days, working hard on every product, every part of the transition. I'm convinced we can make the transition. As far as the skeptical investors, it's for us to know and for them to find out. By the time they find out, it'll be too late.
Good stuff. Well, yeah. Good job. Keep it up. Thanks so much.
Thanks.
Thank you. Our next question will be from Gabriela Borges with Goldman Sachs.
Good afternoon. Thanks for taking my question. I was hoping you could characterize for us the level of sophistication education that you're seeing around cloud security awareness from your customers. At this stage, how much of it is a push from Palo Alto where you really need to educate around virtual firewall and GlobalProtect and Aperture and some of the cloud products that you have, versus customers maybe reaching a consensus and realizing that in order to be secure in the cloud they need more Palo Alto products? Thanks.
Thanks, Gabriela. That's a brilliant question because when we did the acquisition of RedLock and when I looked at what we have at Evident, I realized we have an awareness problem. Many of the existing customers, whether AWS, GCP, or Azure, don't know what they need. Part of the effort in the last even few weeks and going forward has been to get in front of our customers, demonstrate the product to them, and it's about them saying, "Oh my God, yes, I do need this." You're right. There's not a flash realization across the space that we need this security because some of these things are moving from a DevOps team upwards into the enterprise. There's a lot of awareness and education that is required, and hence we are stepping up our efforts to do that education, to do the partnerships, to create the awareness.
We also believe, like I said earlier, we are the only players right now with a product of this sophistication, and we intend not to lose the sophistication and leadership of this product.
That's helpful. Thank you. The follow-up is not specifically on the PA-7000 Series refresh, but I do want to ask how you're thinking about the cadence of appliance introductions at a higher level. If I think back to 2017, there are a number of product introductions on the appliance side. Just maybe some high-level thoughts on how you think about those introductions going forward and how much more thought goes into that, if at all. Thanks.
I'm sorry, can you clarify your question? Appliance what?
How are you thinking about the cadence of new appliance introductions at a high level?
Yeah. Got it. Sorry. Thank you. Look, our desire as we build our hardware roadmaps and overall strategies, our large enterprise customers or service provider customers, in general, they do not want to see a hardware technology change too fast because that necessitates the need for them to then go through and do a whole bunch of work to swap out old hardware for new hardware and things like that. On the flip side, of course, we want to stay very up-to-date on the latest and greatest technology in order to be able to provide the best product. We're always balancing between those two aspects, and there's no single answer to it.
It's just always looking for where the big technology inflections are on the hardware side looking at how we can slot those into a development schedule that makes a lot of sense to both us and our customers. What you've seen us do over the last couple of years is obviously introduce a number of new hardware platforms that have been very well received. Then, where we need to, we'll continue that process of bringing to market new hardware technologies, where we get a lot of bang for the buck and really help our customers.
I appreciate the call.
Thank you. Our next question will be from Erik Suppiger with JMP Securities.
Yeah. Thanks for taking the question. Two questions. One, Nikesh, how do you feel your channel is currently prepared for moving into the cloud? What kind of evolution do you need to see from your channel partners? Secondly, on the service provider front, one of your competitors does a lot of development with the hardware, with ASICs. Is that something that you would consider in order to achieve the performance that you need to meet service provider requirements for 5G?
Thanks for the question. I think, look,
Can you mute?
Do you mind going on mute, Erik?
Okay.
Thank you. Sorry. We're getting a lot of feedback.
There we go.
There we are. Perfect. Thank you. Erik, from a channel perspective, look, the channel is not one entity. Channel is a very large set of partners where we have people who are very cloud-savvy and very cloud-ready, and we have people who are going through their own journey of transitioning to the cloud because they've been very hardware-centric. They come in different shapes and sizes. We're very excited about the partners who are stepping up and creating the cloud education focus within their own teams to be able to part the journey. There are some others who are called BIC, as one called born in the cloud. They're people who are focused exclusively in the SaaS space and working with us and other players in the SaaS space.
There is a transition going on in the channel as much as there is a transition going on in our customer base. The channel is getting ready to be able to provide these capabilities to our customers. We see a very, very sort of healthy partnership going forward with the channel, where they're going to end up providing a lot of services to our customers, creating a lot of education awareness. The question Gabriela Borges asked about how do we create the awareness across 50,000+ customers of the public cloud companies and get them to see our product. Can't do it alone with our smaller team on that scale. We're going to have to leverage a large distribution network which is in place, which is service provider network. I think that's kind of the answer for the first part of the question.
As it relates to the ASICs and the throughput part, look, we believe in the K2-Series product. We are going to match the price-performance of everybody else out there from a throughput perspective. We believe we're going to be industry-leading in security. In fact, the only ones in the industry who can deliver the security requirements for 5G and IoT. We feel very comfortable with the new K2-Series product.
As I said very early, the sales cycle and SP are long, as we've announced this today, we're going to be launching efforts throughout our teams and our go-to-market teams to start approaching some of the largest service providers around the world, working with them to make sure they understand the capabilities of the effectively the next generation firewalls now, and make sure that they keep us in consideration as they go towards their own journey of going to 5G and IoT.
Thank you. Our next question will be from Catharine Trebnick with Dougherty.
Oh, thanks for taking my question. Brilliant quarter. Did you provide the number of customers you added during the quarter? That's my first question.
Yeah, we didn't talk about it in the prepared remarks, but we added over 2,500 customers this quarter.
All right, thanks. Any particular service that stood out in driving your subscription services? Was there one that was stronger than the other during the quarter? Then any that underperformed? Thanks.
Yeah. No, we had nice performance across our subscription portfolio, and obviously, we're very happy with the growth we saw there.
None of them underperformed, like Aperture, AutoFocus? I'm just trying to quantify.
Yeah, no, we break out more details from time to time, but we haven't provided details by product of how each one grew.
All right, thanks. Keep up the good work.
Thank you very much.
Thank you. I'd now like to turn the call back over to Nikesh for closing remarks.
Yes. Well, thank you, operator. Look, in closing, I'd like to thank all of you for your interest in Palo Alto Networks. I also would like to thank, once again, our customers, our partners, and our employees for the tremendous amount of effort they put into making sure that we're able to deliver our results. I've been reading many of your notes, and I know that some of you are still anxious to understand me. Before I wish you a happy holiday, I wanted to send out this invite to all of you who would like to come meet me. We're going to try and schedule over the next three weeks for sell-side analysts to come visit. If you reach out to Amber in our investor relations team, she can schedule it.
That way, hopefully, next time around, when I read your notes, you won't be as anxious about me. I'm anxious enough about myself. I don't need you to be more anxious about me. With that, thank you again for your interest in Palo Alto Networks, and goodbye.
Thank you, ladies and gentlemen. This concludes today's teleconference. You may now disconnect.