Good day everyone, welcome to the Palo Alto Networks fiscal third quarter 2018 earnings conference call. Today's conference is being recorded. At this time, I'd like to turn the conference to Amber Ossman , Director of Investor Relations. Please go ahead, ma'am.
Good morning, thank you for joining us on today's conference call to discuss Palo Alto Networks' fiscal third quarter 2018 financial results. This call is being broadcast live over the web and can be accessed on the investor section of our website at investors.paloaltonetworks.com. With me on today's call are Mark McLaughlin, our Chairman and Chief Executive Officer, Kathy Bonanno, our Chief Financial Officer, Mark Anderson, our President, Nikesh Arora, Palo Alto Networks' newly appointed Chief Executive Officer. This morning, we issued a press release announcing our results for the fiscal third quarter ended April 30th, 2018. If you would like a copy of the release, you can access it online on our website.
We would like to remind you that during the course of this conference call, management will make forward-looking statements, including statements regarding our financial guidance and modeling points for the fiscal fourth quarter and full fiscal year 2018, our competitive position, the demand and market opportunity for our products and subscriptions, benefits and timing of new products and subscription offerings, trends in certain financial results, operating metrics, mix shift, and seasonality. These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today, you should not rely on them as representing our views in the future. We undertake no obligation to update these statements after this call.
For a more detailed description of factors that could cause actual results to differ, please refer to our quarterly report on Form 10-Q, filed with the SEC on February 27th, 2018, our earnings release posted a few minutes ago on our website and filed with the SEC on Form 8-K. Also, please note that certain financial measures we use on this call are expressed on a non-GAAP basis and have been adjusted to exclude certain charges. For historical periods, we've provided reconciliations of these non-GAAP financial measures to GAAP financial measures in the supplemental financial information that can be found in the investor section of our website, located at investors.paloaltonetworks.com.
We would also like to inform you that we will be participating in the Bank of America 2018 Global Technology Conference on Wednesday, June 6th in San Francisco, and the 2018 William Blair Growth Stock Conference on Wednesday, June 13th in Chicago. Finally, once we have completed our formal remarks, we will be posting them to our investor relations website under quarterly results. With that, I will turn the call over to Mark.
Thank you, Amber. Thank you everyone for joining us this morning for our fiscal third quarter 2018 results. Before getting to the results for the quarter, I'd like to start by welcoming Nikesh, who will succeed me as Chairman and CEO of the company this week. I've been working with the board of directors over the past several quarters on a succession plan after having had the incredible privilege of leading the team here for nearly seven years. I'm immensely proud of all the team has accomplished in that time, the company is on very strong footing and well-positioned for the future. In Nikesh, we found a leader who's ideally suited to take the company on the next leg of its journey of rapid market share gains with our security operating platform.
His experience at Google as the Chief Business Officer, as well as his experience as the President of SoftBank, brings demonstrated abilities to scale at rapid rates and run very large and fast-growing global organizations. I'll be working with Nikesh over the coming months to assist in the transition, I'll remain with the company as Vice Chairman of the Board of Directors, supporting Nikesh and the team with our mission of protecting our way of life in the digital age. Welcome to the team, Nikesh, congratulations.
Thanks, Mark. This is day minus two for me on the job, all I can talk about are my impressions. I've had the pleasure and privilege of getting to know the Palo Alto team, the board, the company over the last few months. The more time I spend, the more excited I get about the space, about the company, the people. It's clear to me that we're still in the very early stages of the cloud revolution for enterprises. I was fortunate enough to see it early at Google, participate in the growth and scaling there. I think we have a very similar opportunity here. I think cybersecurity is one of the most exciting spaces out there. For me, even more exciting is to be able to see firsthand what, Nir, you and the team here have built. This company, for me, is truly unique.
Your growth is testament to the quality of the offering, your customer centricity, as well as the execution capability that you have built over the last seven years. For me, great companies are built by collecting great people, motivating them towards a common mission with the right set of values. It's evident to me that the members of the Palo Alto Networks team are those people. I couldn't be more excited and honored to become part of the Palo Alto Networks team and work with the leadership to continue to build on the good work that you have done and cement the company's position as a leader in the security space.
Thanks a lot, Nikesh. Welcome again. With that, let's turn to the quarter. I'm very pleased with the strong results we delivered on our third quarter. On a year-over-year basis, Q3 revenue grew 31% to $567.1 million. Billings were up 33% to $721 million. non-GAAP operating margin was 20.3%, and we delivered non-GAAP earnings per share of $0.99. We are seeing strong global demand for our security operating platform due to the ever-accelerating and rapidly evolving threat landscape and the resulting significant consequences to businesses that lose the trust of their customers. As our results show, our competitive advantage is increasingly evident. The ecosystem leverage of our platform is growing rapidly, and we continue to capture market share at high rates and at very large scale. We had another strong quarter of new customer additions and are pleased to now serve approximately 51,000 customers around the world.
In addition to robust new customer acquisition, we also continue to rapidly increase our wallet share in existing customers. Our top 25 customers, all of which made a purchase this quarter, spent a minimum of $28.7 million in lifetime value in Q3, a 43% increase over the $20.1 million in Q3 of fiscal 2017. Some examples of customer wins and competitive displacements in the quarter include beating Cisco to become the security standard in both a global leader in the hospitality and entertainment industry, as well as a leading cloud-based provider of benefits and HR solutions, a Check Point replacement in the data center of one of EMEA's largest defense system manufacturers, and a competitive win against both Check Point and Cisco to become the public cloud security standard for one of the largest U.S. healthcare providers.
Competitive wins against Symantec to become the endpoint security vendor on tens of thousands of workstations to secure a U.S. statewide education system, as well as Zscaler with their new GlobalProtect cloud service to secure more than 1,500 stores of a large U.S.-based retailer. Customer and prospect interest and engagement in our security operating platform is very high. We were pleased to host a record crowd of over 4,000 customers and partners recently at our annual Ignite user conference in Anaheim. At Ignite, we showcased the continued strong momentum around our platform capabilities, including the third evolution, which is the Application Framework . The Application Framework fundamentally changes the entire consumption model in security, and we were delighted to have over 30 companies such as Microsoft, ServiceNow, and Proofpoint, as well as leading, highly innovative startups like Phantom, which Splunk just acquired, preview their applications.
The Application Framework marries security innovation and ease of consumption, which is a compelling value proposition for our customer base and is helping to drive purchases of the foundational elements of our security operating platform in the network, on endpoints, and in the cloud. In the network, the introduction of PAN-OS 8.1, in addition to the new hardware delivered over the past 15 months, including the most recent PA-3200 series, the PA-5280, and the ruggedized PA-220, allows us to reach new customers while driving expansion sales and opening new use cases in existing customers. These appliances offer customers increased SSL decryption capabilities, higher performance and capacity, and superior price performance. They serve as critical sensors for log collection and enforcement points for the Application Framework .
On endpoints, we were pleased to announce the release of Traps version 5.0 in March, which brings a new level of functionality to our advanced endpoint protection offering. Customers can now utilize our cloud-delivered management service, which allows for easier deployment and day-to-day management. Also, with the addition of Linux support, Traps now plays a major role in securing cloud applications. We continue to see strong momentum with Traps and are receiving market validation as a leading endpoint security vendor. In April, NSS Labs' independent evaluation of advanced endpoint protection offerings, Traps garnered a recommended rating. The report evaluated 20 different vendors, looking specifically at protection against a variety of malware, exploits, blended threats, and evasions. Traps blocked 100% of evasions and exploits with zero false positives, and the report identified Traps as having the most favorable rating when weighing overall effectiveness and total cost of ownership.
We also announced the acquisition of Secdo in April. Secdo brings leading endpoint detection response capabilities to Traps. Secdo's unique thread-level approach to data collection and visualization goes beyond traditional EDR methods and will also feed into our logging service, giving applications running in the Application Framework greater precision to detect and stop cyber attacks across our entire platform. For cloud security, we have shown that you must protect all applications and all platforms through the combination of inline, host, and API-based security, which we do through our VM-Series, Traps, and Aperture offerings. We were excited in the quarter to acquire Evident.io, a leader in public cloud infrastructure security. With Evident, we now provide continuous monitoring of public cloud deployments, cloud storage protection, and compliance validation and reporting.
Customers can now better understand how applications are being deployed and used in their cloud environments, produce detailed compliance reporting, and achieve an overall superior security posture for cloud deployments. We will also be able to leverage the data collected from Evident's consistent monitoring to enhance the effectiveness of other applications in the Application Framework . We have seen very good traction already with Evident, both in terms of customer interest and pipeline. We're helping our customers solve their most pressing security needs and drive digital transformation through security transformation. As we head into the end of our fiscal 2018, we're excited about the significant and growing total addressable market for security, our leading position in the market, and the growing competitive advantages we are driving through our security operating platform.
I want to once again thank our team and partners for their ongoing hard work and dedication to our mission of protecting our way of life in the digital age and our customers who place their trust in us every day. With that, I'll turn the call over to Kathy. Kathy?
Thank you, Mark, and welcome, Nikesh. Before I start, I'd like to note that except for revenue and billing, all financial figures are non-GAAP, and growth rates are compared to the prior year periods unless stated otherwise. In the third quarter, we drove robust top-line growth with both new and existing customers adopting offerings across the full breadth of our security operating platform. We once again delivered market-leading revenue growth in combination with year-over-year operating margin expansion and earnings per share growth. I'm pleased with our results, and as we look to the remainder of fiscal 2018, we are well-positioned to deliver a strong finish to the year. In Q3 2018, total revenue grew 31% to $567.1 million. By geography, Q3 revenue grew 29% in the Americas, 35% in EMEA, and 37% in APAC. Q3 product revenue of $215.2 million grew 31% compared to the prior year.
Q3 SaaS-based subscription revenue of $192.5 million increased 38%. Support revenue of $159.4 million increased 25%. In total, subscription and support revenue of $351.9 million increased 32% year-over-year and accounted for a 62% share of total revenue. Turning to billings, Q3 total billings of $721 million increased 33%. The recently announced acquisitions were not material for revenue and billings in the quarter. Total deferred revenue at the end of Q3 was $2.2 billion, an increase of 34%. Gross margin was 76.2%, a decline of 20 basis points compared to last year. Q3 operating expenses were $316.6 million or 55.9% of revenue, which is a 210 basis point improvement year-over-year, driven primarily by ongoing increasing leverage in sales and marketing. Operating margin was 20.3%, an increase of 190 basis points year-over-year and includes approximately $3 million of operating expense related to M&A.
We ended the third quarter at 5,121 employees. Non-GAAP net income for the third quarter grew 67% to $95.1 million or $0.99 per diluted share. On a GAAP basis for the third quarter, net loss declined 23% to $46.7 million or $0.51 per basic and diluted share. This includes a loss of $23.8 million due to updated sublease estimates associated with the company's former headquarters and $13.3 million in acquisition-related expenses. Turning to cash flows and balance sheet items, we finished April with cash equivalents, and investments of $2.2 billion, which takes into account approximately $375 million of cash consideration for acquisitions during the quarter. Q3 cash flow from operations of $241.3 million increased 14%. Free cash flow was $212.5 million, up 31%, at a margin of 37.5%.
These numbers include approximately $10.6 million of operating cash outflow related to M&A for acquisition-related costs and ongoing operating expenses. Capital expenditures in the quarter were $28.8 million. DSO was 58 days, a decline of 20 days from the prior year period. Turning now to guidance and modeling points. Please remember this guidance includes the type of forward-looking information that Amber referred to earlier. For fiscal Q4 2018, we expect revenue to be in the range of $625 million-$635 million, an increase of 23%-25% year-over-year. Product revenue to be in the range of $246 million-$249 million, an increase of 16%-17% year-over-year. Billings to be in the range of $815 million-$830 million, an increase of 22%-24% year-over-year.
We plan to invest between $10 million-$12 million or $0.08-$0.10 per share related to our recent acquisitions. With this investment, we expect fourth quarter non-GAAP EPS to be in the range of $1.15-$1.17, using approximately 97 million-99 million shares. For the full year fiscal 2018, we expect revenue to be in the range of $2.240 billion-$2.250 billion, representing growth of 27%-28% year-over-year. Product revenue to be in the range of $850 million-$853 million, representing growth of approximately 20% year-over-year. Billings to be in the range of $2.807 billion-$2.822 billion, representing growth between 22% and 23% year-over-year. Non-GAAP EPS to be in the range of $3.86-$3.89, using 95 million-96 million shares. This includes our acquisition-related investments in the fourth quarter.
We continue to expect capital expenditures to be approximately $100 million. Before I conclude, I'd like to provide some additional modeling points. Our non-GAAP EPS guidance includes the impact of our recent acquisitions and assumes that we will be at the lower end of our gross margin range. Our Q4 non-GAAP effective tax rate will be 22%, and our full-year non-GAAP effective tax rate is expected to be approximately 24%.
We expect fiscal year free cash flow margin to be in the range of 39%-40%, which includes approximately $30 million of cash expenditures associated with acquisitions. Excluding the acquisitions, we expect full year fiscal 2018 free cash flow margin of between 40%-41%. With that, I'd like to open the call for questions. Operator, please call for questions.
Thank you. The question and answer session will be conducted electronically. To ask a question, please press star one on your phone at this time. If you're on a speakerphone, please depress your mute function to allow the signal to reach our equipment. In the interest of time, we ask that you limit yourself to one question and one follow-up question. Again, that's star one if you would like to enter the queue. We'll pause for just a moment. Our first question will come from Keith Weiss with Morgan Stanley.
Excellent. Thank you, guys. Very nice quarter. Mark, it's been a pleasure working with you. I'm sorry to see you go, but it does seem like you guys got a really solid replacement in Nikesh. Welcome on board. I guess a high-level question on the performance in the quarter. 31% product growth is something we haven't seen from Palo Alto Networks in a while, but even more so, it's something we're not really seeing across the board in terms of your peers, who seem to be struggling to sort of sustain any really type of growth in their core markets. Can you talk to us a little bit about sort of what's kind of creating that separation between you and your peers and how durable you think that is on a going forward basis?
To what degree the messaging around security operating platform is playing into that separation?
Sure. Thanks, Keith. Thanks for the kind words. I appreciate that. Well, as you can see, the product growth is very strong. Platform growth is very strong. I think it's really important for us to understand inside the company, outside the company as well, the whole concept of the security operating platform is resonating very well. As we've talked about before with the three evolutions, with the Application Framework being the third one right now, the customers we speak with, the prospects we speak with, almost unanimously across the board, really resonate with that. It's an answer to a significant problem about how do you get more automation and how do you get less complexity in their environments. They like it a lot.
They realize as well that in order to do that or achieve the most value from that, it'll become increasingly important that they, in essence, standardize on Palo Alto Networks and all the positions for data sensors and enforcement points, which is in the network, on the endpoint, and in the cloud. Of course, we need to, every single day of the week, be the very best at all those positions as well on a, and I call it on a standalone basis, which we're very confident in. You can see that from the release of the hardware, the operating system releases, the new version of Traps, the Evident acquisition things we're doing at every one of the positions to make sure we win head-to-head across.
I would say that it seems that to me, and I think the team here spends a lot of time with customers, the concept of the Application Framework , the third evolution in getting consistency across the entire platform is working very well in driving purchases of all the underlying aspects.
Got it. If I could sneak in one follow-up. Nikesh, although definitely has a great background as a leader, not a traditional security pick. Maybe Mark, as your new position as Vice Chairman of the board, you could give us some visibility into how the board got comfort in sort of having a non-traditional security leader be leading up what is still very much a security-focused company.
Sure. Security will continue to be our focus. Let me be clear about that, and thanks for the question. As I was talking with the board over the last several quarters about succession planning, it's been amazing to run the company for the past seven years or so. I said that we would want to make a change at the right time. There was no hurry for this. It was basically saying if we found the right person at the right time, we would do it. That had us thinking, of course, about what does the future look like. When we look at the company, we have 5,000-plus security professionals, companies are the best in the world, starting with Nir and Lee and other folks on the team.
We have some of the best operating executives in René Bonvanie and Mark Anderson and folks who are very committed to the company, which is fantastic. Security is something we know genetically and from a DNA perspective. We started to think about where the company's going to look like in five years from today. I would garner to say that it's more of the security operating platform I just laid out. It's going to have a lot to do with massive data sets, with analytics, with the infrastructure required to support those, the cloud, SaaS. It's very clear that security's headed in that direction, that we're forcing it in that direction as a company.
That really informed our pick for the succession planning, which would be a great accomplished business leader, somebody who's a culturally great fit, and then somebody also has experience ideally with large-scale platforms that have those kind of characteristics. There's not a lot of those platforms in the world, and there's not a lot of people who have that kind of experience. We're fortunate to find Nikesh and spend the last few months with him to make sure that we had alignment across all those variables I just laid out. That was really the thought process, Keith.
Our next question will come from Phil Winslow with Wells Fargo.
Hey, thanks. I take my question. Mark, my congrats again for your move up to Vice Chairman. Have known you since back at Verisign. You've not only been a super impressive executive, but a real gentleman. It's been fun, and congrats on your new role.
Thank you, Phil. I'll try to continue to be a gentleman.
At least you pulled it off well. All right. Just a question on the quarter. Obviously, you noted several competitive displacements and wins sort of across the portfolio. When you think about just the competitive environment out there, particularly from a pricing perspective, there's been a lot of conversation about that. Just sort of what have you seen out there? Any changes that you'd highlight sort of across the platform?
Yeah, sure. Let me take that first, and I think Mark probably has some good commentary as well. He spends a massive amount of time in the field with the customers. What we're seeing from a pricing perspective is no change in the sense of it's a very competitive market. The competition has always been competitive in pricing. I think they increasingly go to the price card out of desperation in a lot of cases. What we've seen in our business is being able to sell value first, the security operating platform as being very unique. Nobody can match that. The third in doing that, and perhaps interestingly, is we have done a very nice job discipline-wise by having discounting improve quarter-over-quarter. It improved again sequentially and year-over-year.
In the face of all that strong competitive pricing pressure, we continue to sell the value of the platform in the market.
Yeah. Hey, Phil, it's Mark Anderson here. With the last 18 months of product announcements, the hundreds of features that we've brought into the hardware platforms that we've replaced, I think price performance-wise, we've got very compelling offers there. I think most importantly, when customers get a sense for where we're taking security with the third evolution, the Application Framework, I think the kind of future-proof nature of us being able to help them distill security innovation into consumable form factors on the Palo Alto Networks kit, I think is a very compelling value proposition, and I think that's something that every customer I talk to takes into consideration when they're making a decision for paying 2x or 3x for Palo Alto Networks, what our desperate competitors are charging for their stuff.
Got it. Just actually a follow-up on the Application Framework for my next question here. Wondering if you could give us sort of a grade of sort of where you stand so far in the development, and what milestones should we, from the outside looking in, point toward for sort of success there?
Yeah, that's a great question, Phil. First, let me start with where it is. The Application Framework is very real today. We announced it about a year ago, and over the course of last year, have made a lot of progress on a number of things. One is making sure that from an Application Framework perspective, that third parties can write apps easily into the framework. The second thing was the development release, and so far, very successful launch of a logging service, which allows all the data to be collected there. We just had Ignite user conference last week, and we had over 4,000 folks there, and there were sort of 30 companies who are previewing their applications, which was fantastic right there on the demo floor. We really liked that.
The customers saw not only their applications, but also workflow between the applications as well. We highlighted a number of them on stage just to give a sense of that. We also announced that the Application Framework would be production-ready in August, very soon we'll be able to actually use that with customers. Lots of good traction. I would say, people have asked me this before, how do you think about it in the future? It's a definition of success in the Application Framework, which you're driving towards would be a lot of applications in that framework. I think somebody said one time that a real platform is successful when there's more value driven across the top of the platform than the platform itself.
We would expect that over time, customers will get a lot of value from the applications running on top of the framework.
We'll go next to Matthew Hedberg with RBC Capital Markets.
Hey, guys. Thanks for taking my questions. I'll offer my congrats to you, Mark, as well. It's certainly been great working with you over the years. Nikesh, congratulations on the role. Excited to see what you bring to the company. Maybe I'll start with Nikesh. Obviously, you mentioned it's day minus two, but your ability to scale businesses at Google was certainly impressive, and you mentioned there are some similarities. I'm curious, when you did your due diligence, what are some of those similarities you came away with? Any insights in how you think Palo Alto is well-positioned to thrive in a public cloud environment?
Thank you, Matt, for asking the question, and thank you for your congratulations. As I said, it's day minus two, so anything I say is subject to change. What I say, I think the early impressions are, I think there's no question in anybody's mind that we're still early in the cloud revolution, and in the next few decades, we will see almost every company out there having to make that transition. Palo Alto Networks' mission on sort of preserving our digital life and keeping it safe is kind of in line with that cloud transition. As we go to that transition, huge amounts of data sets are going to be created. People are going to have to keep track a lot about a lot of data. We'll have to apply a lot of AI machine learning.
Just this notion that Mark talked about of sort of migrating or transitioning to an Application Framework where we can bring a best of breed and allow people to sort of participate with Palo Alto Networks being sort of the one who brings this solution to the end customer is extremely empowering and extremely powerful. I think that's sort of my early impression, that being able to take the company along that path with the team that is working on those products over here is going to be fundamentally exciting.
That's great. Then maybe as a follow-up, we continue to hear good things about GlobalProtect, and Mark, you called out in your prepared remarks a nice win there. Could you talk a little bit more about the competitive landscape there? Are there some legacy competitors that you're seeing there? And I guess, just a better sense on pricing for GlobalProtect would be helpful. Thank you.
Yeah, sure. Matt, as you know, we have GlobalProtect and we have GlobalProtect cloud service as well, and that's all part of the platform, of course. Over time, what you've seen us do is ensure that customers can use our security operating platform with the appropriate form factor for the appropriate use case, right? We have hardware in some cases, big hardware or small hardware. We have agents on the endpoint. We have virtual machines in the cloud, API hooks for SaaS applications, and with GlobalProtect cloud service, you have the ability for what we would traditionally call network security to just point it at the cloud and have the full-on next-gen firewall capabilities as well. That's important for branch offices, mobile users in places where you want to reduce your MPLS costs, and customers reacting very well to that.
From a pricing perspective, we're competitive price-wise as we are with everything in our platform. We can be, because we think it's best on a head-to-head basis, and also the value of it being consistent across the platform helps as well, and we've seen really good early success with the GlobalProtect cloud service.
Our next question will come from Andrew Nowinski with Piper Jaffray.
All right, thanks. Congratulations, Nikesh, on your appointment, and Mark, it's been a real pleasure working with you over the years.
Thanks, Andrew.
Just a question on maybe on virtual firewalls. There's always been a view in the market that the move to the cloud is somehow bad for security. Can you just give us any color on the demand trends you're seeing on the virtual firewall side and how they may be driving some larger deals?
Yeah, sure. It's a really good question. As Nikesh mentioned a little earlier, the move to the cloud is inevitable. When you look at the amount of IT spend and how much of it's in the cloud today, it's actually pretty small. We think we're in the early innings of this. We've seen in our business, again, back to the right form factor for the right use case, that the VM-Series is selling very well. That's the inline portion for protection and protecting offerings in the cloud, and that's growing very well. That's been, we think, additive to the business so far.
We'd expect that to be the case into the future because we see existing customers not only buying VM-Series, but most everything else in the platform along the way, which is fantastic. We would expect that part of our business is going to continue to grow as people continue to hop to cloud.
Okay, got it. I know it's the platform and automation, as you said, were driving a lot of the product revenue growth this quarter, but could you maybe give us just an update on where you think we're at with regard to a refresh cycle, given the new 3200 series out in February and you had the 5200 last year, a lot of new appliances in the market, just wondering how much that's contributing, just specifically from the refresh cycle. Thanks.
Yeah. Great question. As you can see from the about 51,000 customers we're serving today, the size of the customer base continues to grow very nicely over time, quarter-over-quarter. The cohorts keep growing over time. As we said in the past, as those cohorts get bigger and as they get into the latter years, the refresh cycle becomes an increasingly large contributor to the business. We'd expect that would continue into the future. By giving customers new capability sets, not only in the hardware but also the operating system and reasons to refresh if they're already a customer or come to us if they're not, are very important. The drivers in the hardware side of our business, I think really fall into three categories.
The first, and I think the most prevalent today, is the expansion opportunity with so many customers who you can see the lifetime value creation goes up very significantly. We think that's the biggest driver. We also have a net new customer acquisition that's very high. As you can see again from the quarter, that certainly helps. The third is refresh, which is performing very well for us. We think that's going to continue to be the case and will continue to grow as a contributor over time.
That's great. Thanks, Mark.
Thanks, Andrew.
We'll go next to Jonathan Ho with William Blair.
Let me echo my congratulations as well. I just wanted to start out with the Application Framework and maybe some of the commonalities that you're seeing with some of the new customers that have signed up and maybe how you think about that from a revenue opportunity as well.
Yeah, Jonathan, great question. I've described this since we started with the Application Framework as what we inevitably would see as a push-pull model. The push aspect of it is going to be over time, how much value these applications deliver over top of the Application Framework, and perhaps someday we would monetize those. We don't have a plan to do that right now. We think our main focus there should be just growing a very healthy ecosystem of developers, and we'll see how that transpires over time. The flip of it with a pull, I think, is very evident already for us, which is customers really resonate with the ability to reduce the complexity of their footprint in all of their network, including cloud, and also the simplicity of working with less vendors through a platform.
That is driving purchases of all the foundational aspects, which we view as not only fantastic security capabilities themselves, but also as data collectors and enforcement positions. That's in the network, that's on the cloud, that's on the endpoint, and all of those are growing very nicely for us.
Got it. Relative to Traps 5.0 and the Secdo acquisition, can you talk a little bit about what new capabilities you're adding here and maybe what challenges you're addressing with that acquisition?
Sure. Yeah, I think there's two ways to think about that, Jonathan. The first and the most probably evident one is that Secdo brings EDR capabilities to Traps. That's an important capability that customers definitely want. Our ability to have that is important. We believe that the way that Secdo does EDR is very unique, with some very unique thread-level capabilities and visualizations. You'll see that come back into Traps early in calendar 2019. That's what we're going to do with that capability. In addition to that, I don't know if you were at Ignite or had somebody there, we also talked about taking the Secdo EDR capability and applying it across the entire platform.
Not just endpoints, also network and cloud as well, this concept we call XDR, meaning across the entire platform, so that you can get the best EDR capabilities everywhere from a security perspective, not just on endpoints. We think that's going to be an unmatched capability simply because of the size of the deployments we have in all the data locations.
Thank you.
Thanks, Jonathan.
Gabriela Borges with Goldman Sachs has our next question.
Good morning. Thanks for taking the question and congratulations to the team. Maybe for Mark Anderson and maybe Kathy as well. The last time we saw 30%+ type product growth, we were back in 2016, and that was subsequently followed by a little bit of a slowdown. The question is, how are you thinking about managing through tougher comps at a high level going into next year? A follow-up for Kathy, just on the incremental investments that you discussed in the prepared remarks in the acquisitions, a little more on what you're investing in. Thank you.
Hi. Thanks for the question. Yeah, we're very excited about our product growth this quarter. Obviously a very strong number. The platform, as Mark mentioned, is resonating with customers, and the security operating platform is experiencing a lot of interest from customers, both a push and a pull side, as Mark mentioned. We're really happy with the performance of product. We think that we still have a lot of market share opportunity, and we've been growing into that share year after year after year. We think there's still a lot of opportunity for us to grow and that growth can be sustainable for years to come. In terms of incremental investments that we're making, we're obviously integrating the newly acquired technology, in the case of Secdo, into our platform, that's coming off of the market and we're working on that integration now.
For Evident and Secdo alike, we are working on operationalizing, making sure that we have a great go-to-market plan for both of those product offerings, and just overall making sure that we have the right marketing messages, integration, and operational plan for those services.
Yeah. Hey, Gabriela. It's Mark A here. I think a couple of things. Our field sales team is really quite disciplined in going after business, both with expansion opportunities with existing customers as well as propositions for new customers, especially ones that are embarking on their own digital transformation journey. I think we provide a consultative type of approach that it's really a subject matter expert with regards to security in that journey. It gives us the opportunity to show them how important being able to future-proof their investments with, again, access to the Application Framework like I mentioned earlier.
I think also just hardware cycles come and go, but I think by and large, customers are telling us that our approach to security, to provide consistent security everywhere at the endpoint, in the cloud and on-prem, in customers' perimeters, is really differentiated from what our competitors are doing, either by providing an architecture that is just unrivaled out there.
That's helpful color . Thank you.
Yep.
We'll go next to Saket Kalia with Barclays Capital.
Hey, thanks for taking my questions and congrats to both of you on your new opportunities. Maybe for you, Mark, I believe several other parts of the Application Framework are going to be generally available here starting in August. Maybe related to Jonathan's questions, can you give us any broad brushes on how the pricing here might work and what you're seeing initially from customers on accepting that different consumption model?
Hey, Saket. It's a very good question. Yeah, probably the best thing to do is clarify when we say the Application Framework is production ready to come April, what that means is that third-party applications will be available through the framework. From a pricing perspective, today, the relationship for that is between the application provider. I'm sorry. I said April, I meant August. I have 10 people giving me notes to correct that in August, so sorry. The relationship from a pricing perspective will be through the customer with the application provider themselves. That's what it'll look like in the beginning. Meaning, we don't have intent right now to try to monetize that from our perspective. Perhaps over time, like I said, when we're driving a lot of value, we'll be in a position to do that.
What we're definitely seeing right now in the business, though, is the pull aspect, which is because of the compelling nature of the idea of being able to actually have a lot of innovation in the market, but not have to deploy form factor after form factor to collect data to get one more feature. The customers like that a lot. I think they will standardize on Palo Alto Networks. I think they are standardizing on Palo Alto Networks in a network increasingly than endpoints in a cloud as well. That's a driver of our business. I think that's been a driver for the last year. There's lots of other drivers as well. I think that's a driver that's happening. I think we're going to see that continue into the future.
That's helpful. Maybe for my follow-up for you, Kathy. You were nice enough to give us the impact that Evident.io and Secdo are having here from the EPS perspective in the fourth quarter. Can you give us any broad brushes on any billings or revenue impact it might have either in the quarter or maybe on an annual basis?
Yeah. In the quarter, the billings and revenue impact was immaterial. Going forward, obviously, we're working on our plans and our go-to-market plans, and we're certainly hoping that we have good revenue and billings performance from both of them. We see a lot of opportunity with both of those products, given the demand for cloud security, and as well, the EDR capabilities are going to be a great addition to our endpoint service offering.
Very helpful. Thank you.
Thanks, Saket.
Our next question comes from Ken Talanian with Evercore ISI.
Hi. Thanks for taking the question. Nikesh, I realize it's early, but could you provide some of your initial thoughts on M&A and general thoughts for the potential for consolidation within the security sector?
Thank you very much for the question. I think it would be inappropriate for me to have thoughts on M&A until I fully understand the entire product offering of Palo Alto Networks, which I do to some extent, but I'm going to spend a lot of time in the early part understanding the company, our priorities, and make sure that we continue to execute on the rhythm and pace that Mark has set and what you guys have gotten used to. That's kind of like the stake on the table that I need to make sure I maintain. We'll, hopefully, over future quarters, have more substantive conversations with all of you about where we see the opportunity and if we need to do anything or not.
Great. I guess as a follow-up, just to circle back around GlobalProtect Cloud. Is the primary use case there branch office applications, or are you seeing broader interest in using the solution instead of hardware?
Yeah, we're seeing a few use cases primarily, again, early on. One is branch office, the second is mobile users as well. I think both of those are drivers. We expect those to continue to be drivers into the future.
Great. Thanks very much.
Thanks, Ken.
We'll go next to Walter Pritchard with Citi.
Hi, thanks. Mark, as well, congrats on finding a successor here that looks to fill your shoes, at least mostly. Two questions for Kathy. One, just on, as we think about going into Q1, I know you're not providing guidance for next year, but seasonality has been a bit moving around as the business has evolved, and I'm wondering what you could tell us about how you think about the shape of the year and into next year with Q1, and then just had one follow-up question on the subscription side.
Sure. Thanks, Walter. Yeah, we have definitely seen seasonality become a bigger factor in our business, and we are seeing pretty normal seasonality patterns with our strongest quarters sequentially in terms of sequential growth being Q2s and Q4s. That continues to be the case, and I would expect that to continue into Q1.
Great. On the subscription side, I'm wondering, you have two pieces there. One I think is pretty easy just for us to model with the attaching to appliances. You are seeing a continuation, it looks like, in three-year attach there. On the unattached side, you just have a number of new products, some acquired, some products you've had for some time. Can you help us understand how the subscription side is splitting out, and maybe relative growth rates between the attached and unattached?
Sure. The non-attached business we mentioned at Analyst Day was on a $240 million run rate, growing very fast, growing at about 85% year-over-year. While it remains about getting close to about 10% of our overall business, still a relatively small portion of our business, but growing much faster than the rest of the business because it's newer and obviously a smaller portion of our business. Just in terms of law of large numbers, growing much faster. We're obviously adding more and more subscription offerings that are non-attached, and you'll see that in the Application Framework as well. We do expect that the non-attached business will continue to become a bigger part of our business and will continue to grow very fast. The rest of the business is also growing very well.
As you saw, our services billings growth rate was over 30% this quarter. The rest of the business continues to grow very fast. The non-attached business, because it's a relatively small portion, doesn't influence the overall growth rate to a significant degree at this point.
If I could just make one other point. Kathy said, at the end of Q2, we'd given out the billings contribution run rate. It's about $240 million, growing very quickly. You can see, that continues to go up over time. I think probably the interesting thing about that is with that approaching 10% of the billings run rate, which is good, it's against a very large base as well. That base is continuing to grow very well. If you think about the network security business and particularly the SaaS security services associated with it, that's a large business growing very well itself, right? The level of contribution takes time for the non-attached to grow simply because it's being matched against a large, very fast-growing business as well.
Great. Thank you.
Thanks, Walter.
Our next question comes from Shaul Eyal with Oppenheimer.
Thank you. Good morning, guys. Congrats on a strong quarter and outlook. Nikesh, welcome on board. Mark, we still have you on board literally, so not saying goodbye here. One for Mark, one for Nikesh. Mark, on Europe, another strong quarter, up 35% year-over-year. Talk to us a little bit about the different dynamics you're seeing in Europe than those in the U.S. Maybe how does GDPR in that context play into the equation?
Yeah, sure. I'll take the beginning. I'll hand it to Mark. He just came back from over there a little while ago. GDPR, just as a big picture, is driving a lot of interest in how do you use what would be termed state-of-the-art capabilities. Basically, GDPR has a requirement for avoiding liability that folks are using state-of-the-art capabilities for cybersecurity. Of course, there's no definition to that, which is probably the right thing to do for regulators, but it raises a lot of questions for customers, which are positive to us, which is, how would you do that, have state-of-the-art capabilities? We think everything that we provide plus the platform fits very uniquely in there. Mark, any additional comments?
Yeah, I think you nailed it, Mark. I think for us
Legislation like GDPR just heightens awareness of customers to do something different than what they've been doing for the last two decades. I think I would highlight that and also highlight the fact that government over there, the EU, as well as each of the individual countries in the EU, have never been more open to working with thought leaders like Palo Alto Networks to do things like share threat intelligence, have bilateral threat sharing agreements. I think our relevance in Europe, because it's maybe a little more of a conservative group of countries, has really ramped in the last four or five quarters, and you can see that in the performance. We get invited to the dance a lot more. True.
Nikesh, you're coming from SoftBank, invested heavily in security in recent years. I think you wrote a big $100 million check for Cybereason, just about, I think less than 18 months ago. Google appears to be eyeing security from afar. Who knows what they might be doing down the road. It seems that security software requires a bit of a different DNA. I think Mark also phrased that coin. Second, before you plunge into the security software arena, if you can share with us your thoughts as to how security is being observed by the big tech companies, the Googles, the Amazon, the Microsoft. They haven't done a lot so much, so it could be a great opportunity on your end. Maybe just a second, world is becoming crazy for you with Palo Alto. Just share with us maybe how the big tech behemoths are viewing security.
Look, I think it's fair to say, I had the privilege of working with the Google Enterprise team, which was part of our event when I was at Google. For the first time, as you see in the history of innovation, cloud came to the consumer first in a big way and is now slowly making its way back into the enterprise. Google's realized that, Microsoft's realized that, Amazon realized that. They're all charging ahead with trying to address the cloud opportunity vis-à-vis enterprises. I think that's great.
Having said that, given that they're all, to some degree, offering proprietary solutions to people where you can have one or the other, there is an important need for an independent security team to look at it and see how we can take these massive amounts of data across multiple cloud offerings, provide a solution around it comprehensively to the end customer, and have somebody who they can trust to be the arbiter between all these different offerings that they have. I think that's a big opportunity out there, given that we're all going towards the cloud, given that these huge amounts of data sets are going to be created, we need to make sure we understand their aspirations and set our aspirations vis-à-vis them and provide the solution to the end customer. I think that's where the opportunity is.
Thanks.
Our next question will come from Michael Turits with Raymond James.
Hey, guys. Thank you very much. Mark, thanks for everything over many years. Nikesh, welcome. I'll come back to the M&A question, then I have a follow-up for Kathy on M&A. Let's just maybe say strategically product in general, Mark, there's still some very large areas of security that you're not in, the email, DLP, identity. How are you thinking about those given the fact that you have done so much in terms of expanding in the last quarter or so?
Yeah, great question, Michael. When we look at security, we think in terms of outcomes, meaning that if you're the CIO or the CISO for an enterprise, if you put technologies aside for a second, they have to solve for various outcomes. In those, there might be eight or 10 of those, depending on how broadly you define those, and they're not technical when you think about them. The outcome that we're solving for customers is to stop all known threats and ideally stop all unknown threats or at least detect them very quickly and limit the damage. That's a very large outcome statement and very important. That lives alongside other outcomes like making sure you can withstand a massive denial of service attack, for example.
We've been particularly focused over the years in ensuring that whatever outcomes we choose to solve for customers, that we bring something unique to the table in a highly competitive way. Those outcomes blend over time as well. That's why we've done a lot of very strong partnerships in the identity space, for example, something you just mentioned, in the messaging security space with Proofpoint, something you just mentioned as well, so that we can make sure that the customer using the best capabilities from the vendors who are solving these outcomes doesn't have to be the back-end systems integrators themselves for that, and they really appreciate that. Bringing that holistic picture to the table and solving those outcomes for customers is very important.
Great, thanks. Then for Kathy, thanks for detailing the impact on expenses and cash flow of the acquisitions in this quarter. This has been a particularly, again, period of strong investment. How do those acquisitions impact margin expansion next year? You've talked in the framework about 150-250 basis points. Are we on track to that even with these acquisitions?
Yeah, we have talked about organic operating margin expansion of 150 basis points to 250 basis points. The Q4 guidance that we've given is that we plan to invest between $10 million-$12 million, that equates to $0.08-$0.10 per share on our recent acquisitions outside of the organic operating margin expansion that we are working towards for the full fiscal year.
Okay. No early thoughts on next year, though?
It's pretty early.
We're still working on our planning, obviously.
Great. Okay. Thanks very much.
We have been, obviously, committed to that framework, and growth and profitability remain very important to the company.
Our final question will come from Rob Owens with KeyBanc Capital Markets.
Wow, under the wire. Thanks guys for taking my question. With regard to product revenue and the five quarters of acceleration that you've seen, juxtaposed, I guess, where your competitors are, and we've actually seen meaningful deceleration. Can you talk about your win rates and whether or not you think those are ticking up, or is your success more a function of ASPs at this point? Number two, Mark Anderson mentioned hardware cycles come and hardware cycles go, which begs the question, do we think one's coming or do we think we're going at this point? We're one to come, how could that possibly be reflected in customer acquisition and those numbers you're showing there? Thanks.
Maybe you can take them in reverse and I'll do.
Yeah, sure.
The second one.
Yeah. You go. Yeah.
Everybody thank Mark here. I think on the cycle one, Rob, over time, if you take a snapshot back of 10, 15 years, long periods of time, you see those cycles, in four, seven years, it's a little hard to nail that down, of buying patterns there. What Mark was saying is that regardless of what cycle they're in, Palo Alto Networks continues to outperform everybody in the market. You can see that all through the last 10 years, as a matter of fact, and including very recently in the last four quarters as well. Our job, we think, is to make sure that we have the most competitive offering in the market, and we'll always be taking market share, and we're very confident we'll be able to do that.
Yeah, just big picture, Rob. We've got low double-digit market share, or we prosecuted low double-digit market share in about a $20 billion total addressable market. I think both in terms of new customer opportunities, customers want to, if they're going to make a change for security, they're going to look to the thought leader. For existing customer expansion, we're just starting to hit the veins of significant customer sizes from the cohorts that we saw big customer growth the last five or six years. I think both give us tremendous opportunities to grow the business, and I think that's what gives us the confidence that's embedded into our guide.
Along competitive win rate lines?
Yeah, competitive win rates, I think I said it earlier, I feel bad sometimes for our competitors because they're trying to sell either stitched-together acquisitions that look like Frankenstein's monster, or they're trying to sell point products against an architecture. I think we've developed this platform over the last dozen years organically, primarily with some small technology tuck-ins that really drive the automation that's needed in the digital age.
We've seen win rates be very consistently high, Rob, against all comers.
Great. Thanks, guys, and cheers, Mark.
Thank you very much. Appreciate that. I think that was our last question. I'd like to close off. I want to thank everybody here, all the employees at Palo Alto Networks, our customers and our partners for the privilege of working with you. For me, it's been a really amazing experience. I want to thank everybody for their time this morning for the call. I look forward to seeing a lot of you in the upcoming future. Take care.
That does conclude today's conference. Thank you all for your participation. You may now disconnect.