Good day, welcome to the Palo Alto Networks fiscal first quarter 2018 earnings conference call. Today's conference is being recorded. At this time, I would like to turn the conference over to Ms. Kelsey Turcotte, Vice President of Investor Relations. Please go ahead, ma'am.
Thank you. Good afternoon, thank you for joining us on today's conference call to discuss Palo Alto Networks' fiscal first quarter 2018 financial results. This call is being broadcast live over the web and can be accessed on the investors section of our website at investors.paloaltonetworks.com. With me on today's call are Mark McLaughlin, our Chairman and Chief Executive Officer, Steffan Tomlinson, our Chief Financial Officer, Mark Anderson, our President, and Kathy Bonanno, our newly appointed CFO. This afternoon, we issued a press release announcing our results for the fiscal first quarter ended October 31st, 2017. If you would like a copy of the release, you can access it online on our website.
We would like to remind you that during the course of this conference call, management will make forward-looking statements, including statements regarding our financial guidance and modeling points for the fiscal second quarter and full fiscal year 2018, our competitive position, and the demand and market opportunity for our products and subscriptions, benefits and timing of new products and subscription offerings, our ability to drive outsized growth rates, and trends in certain financial results, operating metrics, mix shift and seasonality. These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today, and you should not rely on them as representing our views in the future, and we undertake no obligation to update these statements after this call.
For a more detailed description of factors that could cause actual results to differ, please refer to our annual report on Form 10-K filed with the SEC on September 7th, 2017, and our earnings release posted a few minutes ago on our website and filed with the SEC on Form 8-K. Also, please note that certain financial measures we use on this call are expressed on a non-GAAP basis and have been adjusted to exclude certain charges. For historical periods, we have provided reconciliations of these non-GAAP financial measures to GAAP financial measures in the supplemental financial information that can be found in the investors section of our website, located at investors.paloaltonetworks.com.
We'd also like to inform you that we will be participating in the Credit Suisse 21st Annual Technology, Media and Telecom Conference in Scottsdale, Arizona on November 30th, the Raymond James 2017 Technology Investors Conference in New York on December 4th, the 2017 Wells Fargo Tech Summit in Park City, Utah on December 6th, the Barclays Global Technology, Media and Telecom Conference in San Francisco on December 7th, and the Cowen Networking and Cybersecurity Summit in New York on December 13th. Finally, once we have completed our formal remarks, we will be posting them to our investor relations website under quarterly results. With that, I'll turn the call over to Mark.
Thank you, Kelsey, and thank you everyone for joining us this afternoon for our fiscal first quarter 2018 results. I'm pleased to report that we delivered a strong start to the fiscal year. On a year-over-year basis, Q1 revenue was $505 million, up 27%, billings were $596 million, up 15%, and non-GAAP earnings per share was $0.74, up 35%. In the quarter, we saw a healthy demand environment in all theaters, as well as strong customer interest in all the extended capabilities of our next-generation security platform from network to endpoint and cloud. The go-to-market changes we made in mid-year fiscal 2017, which were designed to drive growth and leverage at scale, are paying dividends for us and our channel as we start off our new fiscal year. In the quarter, we added over 2,500 new customers and are now privileged to serve over 45,000 customers globally.
In addition to strong new customer acquisition, we also continue to rapidly increase the wallet share of our existing customers. Our top 25 customers each spent a minimum of $23.2 million in lifetime value in Q1, which is a 53% increase over the $15.2 million in Q1 of fiscal 2017. The rapid growth and adoption of our platform results from our relentless focus on innovation and our customers.
Specific examples of customer wins and competitive displacements in the quarter included a seven-figure competitive win against Cisco in a virtualized data center deal with a U.S. military organization, a Cisco displacement as the standard security vendor at one of the world's busiest airports based in EMEA, a Check Point displacement at one of the world's largest technology companies to become its global security platform, a Check Point displacement in the data center of one of the world's leading payment processors based in the United States, and a Symantec displacement in an endpoint deal for 10,000 workstations at a U.S. federal agency that also included AutoFocus.
There are three hallmarks to our platform that are increasingly well understood by customers and prospects. The first is our ability to provide increased prevention through automation and orchestration. Second is our ability to deliver these security outcomes consistently across on-premise, endpoint, cloud, and hybrid environments.
Third is our demonstrated ability to continually push the boundaries to simplify consumption models at a time when organizations are struggling to balance security needs with limited operational manpower and budgets. To accomplish these objectives, we continue to drive disruptive evolutions in the market that are designed to meet today's most challenging security requirements and that build on each other over time to establish significant competitive differentiation. To that end, we introduced two new offerings in September. First, GlobalProtect cloud service, which delivers the Palo Alto Networks next-generation security infrastructure for remote offices and mobile users as a cloud-based service. This offering opens up new use cases for us, help widely distributed organizations improve their security and reduce complexity. In late September, we introduced the Palo Alto Networks Logging Service, our cloud-based offering that stores context-rich logs generated by our security platform.
Managed seamlessly with our existing Panorama management product, the Logging Service is the foundation of our Application Framework, which is the next major evolution in security. We expect our Application Framework to provide a new model for the delivery of security applications that it can apply advanced analytics to massive data sets and have automated workflow decisions enforced through already deployed capabilities in the network, on the endpoint, and in the cloud. We have received great feedback from the hundreds of customers briefed on the Application Framework, which we are on track to deliver in the first half of calendar 2018. Initial reception to GlobalProtect cloud service and the Logging Service has been strong, and we are very pleased to have closed several deals in the first quarter.
In addition to our new services, we further enhanced the capabilities of Traps, our advanced endpoint protection offering, with the introduction of version 4.1. Among the many new features, 4.1 added behavior-based ransomware protection, enhanced kernel exploit prevention, and local analysis for macOS. Just a few weeks ago, Traps scored a 100% protection rate and earned the Approved award in the Business Security Report published by AV-Comparatives, an independent organization that tests and assesses AV software. This is yet another third-party validation of our ability to replace traditional AV products. In October, we expanded the capabilities of Aperture, our cloud access security broker offering. As part of the migration to the cloud, many organizations are adopting a multi-cloud strategy that includes storing large amounts of data within cloud environments and which requires advanced protections that complement basic native cloud offerings to achieve comprehensive and consistent security.
Aperture now provides application protections for several AWS solutions, including Amazon EC2, AWS Identity and Access Management, and Amazon S3. We also enhanced our support for Office 365 and Google applications to include cloud-based email services and G Suite Marketplace applications. We continue to see very good traction with customers as they look to us to help them work through the requirements of security in a hybrid world. We were recently honored to be named to Fortune magazine's list of top 50 companies changing the world and to the Fortune Future 50 list. These acknowledgments further underscore our commitment to innovation and our dedication to improving security outcomes for our customers. I also want to welcome Kathy Bonanno as our next Chief Financial Officer. Kathy joined our team in 2014 and is currently senior vice president of finance, responsible for financial planning, treasury, enterprise risk management, and facilities.
With more than three years at Palo Alto Networks, a decade in cybersecurity, and 30 years business experience, she has an intimate knowledge of our company, the industry, and broad expertise across financial disciplines, as well as a proven track record of building world-class organizations. Congratulations, Kathy. I look forward to continue to work with you.
Thanks, Mark. I'm excited about this role and my work with the team. I believe we have a truly unique opportunity to continue to disrupt the security market, take share at scale, and increase operating leverage. I will be at several of the upcoming investor conferences and look forward to meeting those of you I don't already know.
Congratulations again, Kathy, look forward to taking the reins from Steffan this coming Wednesday. Before I conclude, I want to thank our customers and partners for their support and our team for their dedication to our mission, which is to protect our way of life in the digital age. With that, I'm going to turn the call over to Steffan.
Thanks, Mark. I'd like to add my congratulations to Kathy as well. I've really enjoyed working with you, and I know you'll be successful in your new role. Now let's turn to the numbers and guidance. I'd like to note that except for revenue and billings figures, all financial figures are non-GAAP, and growth rates are compared to the prior year periods, unless stated otherwise. In the first quarter, we delivered strong performance against our land and expand go-to-market model. In addition, the power of our hybrid SaaS model was evident in record deferred revenue that continues to be driven by our ongoing mix shift to subscription and support, year-over-year non-GAAP operating margin expansion, which drove 35% growth in non-GAAP EPS, and very healthy free cash flow generation.
As we look to the balance of the fiscal year, we are pleased with our improving execution and widening competitive positioning, which is further differentiated by our new offerings. In Q1, total revenue grew 27% to $505.5 million. Looking at the geographic growth of Q1 revenue, the Americas grew 25%, EMEA grew 35%, and APAC grew 25%. Q1 product revenue of $186.5 million grew 14% compared to the prior year. Sales of the new hardware, which we launched in fiscal Q3 2017, continued to perform well as we land new customers and upsell them into our existing customer base.
Q1 SaaS-based subscription revenue of $169.3 million increased 40%. Support revenue of $149.7 million increased 32%. In total, subscription and support revenue of $319 million increased 36% and accounted for a 63% share of total revenue, which was a 420 basis point increase compared to last year. Q1 total billings of $596.5 million increased 15%.
Total deferred revenue at the end of Q1 was $1.9 billion, an increase 37%. Q1 gross margin was 76.8%, a decrease of 260 basis points compared to last year and within our target range of 75%-78%. The decline was primarily attributable to the ongoing traction we are seeing with the new products introduced in the third quarter of last fiscal year. Q1 operating expenses were $292.4 million, or 57.8% of revenue, which is a 360 basis point improvement year-over-year, driven primarily by ongoing increasing leverage in sales and marketing. Operating margin was 19%, an increase of 100 basis points. We ended the first quarter with 4,707 employees. Net income for the first quarter grew 36% to $69.8 million, or $0.74 per diluted share. On a GAAP basis for the first quarter, net loss increased 12% to $64 million or $0.70 per basic and diluted share.
Turning to cash flows and balance sheet items, we finished October with cash equivalents, and investments of $2.3 billion. During the first quarter, we repurchased approximately 861,000 shares of common stock at an average price of approximately $145 per share, leaving a balance of approximately $455 million available for ongoing repurchases through December 2018. Turning to cash flow, Q1 cash flow from operations of $274.1 million increased 35% and included the receipt of a $38.2 million upfront cash reimbursement related to certain of the company's lease agreements. Capital expenditures in the quarter were $32.2 million, including $11.2 million of CapEx related to our new headquarters. Free cash flow was $241.9 million, up 32%, at a margin of 47.9%. On an adjusted basis, excluding the upfront cash reimbursement and investment in our new headquarters, free cash flow was $214.9 million, up 16% at a margin of 42.5%.
DSO was 70 days at the low end of the target range of 70-80 days. Turning now to guidance and modeling points. This guidance takes into account the type of forward-looking information that Kelsey referred to earlier. For fiscal Q2 2018, we expect revenue to be in the range of $518 million-$528 million, an increase of 23%-25% year-over-year. Product revenue to be in the range of $185 million-$188 million, an increase of 10%-11% year-over-year. Billings to be in the range of $640 million-$655 million, an increase of 14%-17% year-over-year. Non-GAAP EPS to be in the range of $0.78-$0.80, using 94 million-96 million shares. We expect CapEx for Q2 fiscal 2018 to be approximately $30 million.
For the full fiscal year 2018, we're raising our guidance and now expect revenue to be in the range of $2.145 billion-$2.185 billion, an increase of 22%-24% year-over-year. Product revenue to be in the range of $755 million-$770 million, an increase of 6%-9% year-over-year. Billings to be in the range of $2.65 billion-$2.71 billion, an increase of 16%-18% year-over-year. Non-GAAP EPS to be in the range of $3.35-$3.41, using 96 million-98 million shares. We continue to expect CapEx to be approximately $100 million. Before I conclude, I'd like to provide some additional modeling points for the fiscal year. We continue to expect fiscal Q2 and fiscal Q4 to have the strongest sequential total revenue growth.
As reflected in consensus heading into this call, our non-GAAP EPS guide continues to include approximately 150 basis points of organic operating margin expansion, excluding first half fiscal year 2018 investments associated with the LightCyber acquisition. We continue to expect fiscal year free cash flow margin to be in the range of 37%-39% as the non-recurring cash reimbursement received in Q1 will be mostly offset by rent payments throughout the balance of this fiscal year. With that, I'll turn the call back over to Mark.
Thanks, Steffan. Before we head over to questions, I want to take the opportunity to thank you again for all your contributions to Palo Alto Networks. You've been an inspiring leader, you've built a great organization, and you've been a wonderful friend, and a real pleasure to work with you. Thank you very much for that.
Thanks, Mark. I appreciate your kind words.
With that, why don't we head to questions? Operator, would you please pull for questions.
Absolutely. If you'd like to ask a question, please signal by pressing *1 on your telephone keypad. If you are using a speakerphone, please make sure your mute function is turned off to allow your signal to reach our equipment. Please limit yourselves to one question and one follow-up. Again, that is *1 to ask a question. Our first question will come from Philip Winslow of Wells Fargo.
Hey, thanks guys, and congrats on a great quarter. Obviously, the product number was strong again this quarter and saw an acceleration from the other prior two quarters. I wonder if you can double-click on just the sales practices that you all discussed following Q2 and just sort of how you feel in terms of just the go-to-market right now with the changes that you made last year, and then just one quick follow-up to that.
Sure. Yeah, Phil, we saw a good strong environment every theater. We really like the health of the market out there and then with being able to go capitalize on that with some of the changes we made last year, which have really taken effect. I think we're seeing the dividends from that work we started then last year. We feel good about where we are with that process. We called it the base phase before, the relationship-building phase, which seems to be going very well, and we'd expect that to keep paying dividends for us as we play out the year.
Got it. I was hoping you all could comment on just the pricing environment as well, just any changes that you've seen there, as we exit this calendar year versus maybe earlier in the year or last year. Thanks, [Kelsey].
Good question. It seems the same. It's a very competitive market. We've seen the competition price aggressively for quite some time, what we've seen us be able to do is continue to sell to the value of the platform. I think customers get that more and more. Our team is trained to do that, we like the results of that. We've been able to continue to improve product discounting, continuously, sequentially, for example, we like to see that as well. It doesn't seem like we have to succumb to all the pricing machinations that are going on with the competition here as the customers really adopt the entire platform.
Our next question will come from Pierre Ferragu of Bernstein.
Hi, everybody. Thanks for taking my question. When I look at your guidance for next year, you have 6%-9% in product and 16%-18% in billing. If I make the difference, you're growing your subscription billing 20%-23% year-on-year, which is firstly impressive and also way above your product growth. My question would be, how does that split between attached and unattached products? How much of that is still driven by your expansion of your install base of firewall, and how much is really subscriptions that are not attached anymore?
My second question would be, if you keep growing like that, subscriptions much faster than products, next year you're going to have what, less than a third of your billings coming from products, and in two, three years out, it should be like an 80% subscription and only 20% product business. Am I right thinking it that way?
Yeah, Pierre. Obviously, we don't guide beyond the year, so I'm sorry that, but I think just as a general matter, we've seen our business continue to move into the services category over time, particularly in subscription services, for a few reasons. One is, the platform is very powerful, and the customers understand how the subscription services provide better security and reduce the complexity of their consumption models. Secondly, we continue to introduce new services. We just introduced two in September, the GlobalProtect cloud service and Logging Service, and we're happy with the performance already with those. As we continue to bring new services to market as well, we would see the business move in the subscription services direction as well. On top of that, the Application Framework, which will come into market next year as well, should also help move things in those directions.
That's what we would imagine would occur over a period of time, that we keep moving in that direction. For the year, we've guided about a 65% split. If you recall from Analyst Day, is on revenue as to what would come from the services side of the business.
Thank you.
Yep.
Next question, please. Our next question will come from Rob Owens, KeyBanc Capital Markets.
Great, and thanks for taking my question. Maybe give us a little more color on the success you're seeing on the product side of things, and what's coming from pre-existing customers that are within your renewal base versus maybe an increase in competitive wins.
Yeah, Rob. Well, we're doing well in both cases. You can see net new customer acquisitions continue to be very strong, and obviously we're selling product into a lot of those customers, the vast majority of those, as a matter of fact. We continue to bring in new customer wins, and also in the expansion business has been strong for us for a very long time, and is powering the majority of our business, just by math, the size of the customer base. Expansion business continues to do well. I feel like we're doing really great in white space opportunities and also convincing our customers to continue to grow their lifetime value with us.
I guess along those lines, with much of the upside in the quarter coming from product, the billings was at the high end, but you overachieved on product and overachieved on total revenue. If I look at billings relative to revenue yield, or I guess the inverse of product with the attached subscriptions, is that product mainly coming in from pre-existing customers who don't give as much of a subscription uplift, or do you have less attached or less duration to the attached? Maybe you could help provide some color there. Thanks.
Yes. Yeah, sure. Just a couple observations around that quarter. We're very happy with the product delivery, obviously, and total revenue delivery. Also on the billing side, in the quarter we saw a couple things going on in that ratio. One was, as we continue to improve the product discounting, then that would put more into the product revenue bucket, so the mix is a little bit higher than we thought we would see in the quarter. Also in some of our service provider businesses, purchases, some of those were a little more CapEx heavy than we forecasted as well. That would put some more into the product bucket as well. Just really the mix is a little different than we expected coming into the quarter.
Our next question will come from Ken Talanian of Evercore ISI.
Hi, guys. Thanks for taking the question. Another one on product. I was wondering if you could give us a sense for how much the VM-Series and Panorama contributed to the product revenue in the quarter and how we should think about that for the remainder of the fiscal year.
Yeah, Ken, it's Mark. Very, very little. VM-Series is primarily almost all of it is heading into the subscription services line. That's how we recognize that. It performed very well, by the way, but very little of that goes into product.
The same is true with Panorama?
Yep, same with Panorama.
Okay. I guess, you delivered double-digit year-over-year product revenue growth in the quarter, expecting the same next quarter. Is there anything that you see in the back half of the year that makes you a little bit cautious?
No. We like the way the quarter played out. We over-delivered on product, which is great. Our forecast looks good in the second quarter, and based on that, we've Yeah, we've increased the product revenue guide on a full-year basis, but it's early in the year, so we're going to see it play out a little bit more.
Our next question will come from Sterling Auty of JP Morgan.
Yeah, thanks. Hi, guys. First of all, Kathy, congratulations. Steffan, great job to finish off your tenure on such a strong note. Just wanted to take it to the high level. With the guide out of Check Point, out of Fortinet, there was all these concerns about what was happening in the firewall market. Obviously, you put up good results, Mark, in your comments, you specifically pointed out good demand in all theaters. That's what I want to point to. Can you give us additional color as to just the general spending environment for network security, and more specifically, firewalls? There's still this big question on everybody's minds, how much is the move to the cloud going to hamper, help, or be a non-event to the firewall vendors?
Yeah. Maybe I'll take that at two different levels, a high level, and I'll ask Mark to talk about the theaters for just a second, which are very strong. At the highest level, we've seen healthy demand in the market for security, period, right? I think what's happening is folks are definitely moving in the real platform direction, we feel like we have the best one of those, and it continues to get better and better over time. If you remember, Sterling, at Analyst Day, we talked about the three evolutions, all that build on each other and drive continued competitive advantage. That second one in there, which we defined as consistency of security outcomes across not only the network, but endpoints and also cloud environments, whether they're public or hybrid cloud environments, is very important. Customers, we think, agree with that.
We're seeing a good adoption in our cloud offerings, the VM-Series and Aperture as well. Lots of folks are operating in hybrid environments, and I expect them to continue to do that for some time. That drives strength in not only the cloud offerings, it drives strength in what's happening in data centers from a hardware perspective. We see lifts in all this. Maybe Mark, you can talk about the theater.
Yeah, you bet, Mark. Hey, Sterling. I think from a geographic color standpoint, really happy across the board. We saw 25% in the Americas, by far our biggest theater, and 25% in Asia Pac and Japan, and 35% in EMEA. Really good, strong execution across the board. I think in all theaters, we're getting tremendous at-bats because we've got great geographic coverage in all the sub-regions and really good partner traction as well. We're getting a lot more at-bats. We're winning the vast majority of those at-bats because we have a much better solution. I think with regards to cloud, as we said pretty clearly at Analyst Day, we really think that there's major tailwinds coming with cloud. We're hearing constantly from customers that as they move more and more off of-prem over the long term, they're going to want consistent delivery of security.
That's what we've been talking about for a long time, and we think we're pretty unique in that.
Our next question will come from Matthew Hedberg with RBC Capital Markets.
Hey, guys, thanks for taking my questions. Kathy, I'll offer you my congratulations as well. Mark, we continue to hear good things about GlobalProtect cloud service, and you highlighted in your prepared remarks. Could you talk a little bit more about the competitive landscape there? What are some of the opportunities? I have a quick follow-up.
I think the way to think about that, Matt, and the way we certainly think about it, is we want to make sure that for our customers, when they want to consume the platform, that those consumption models are as broad and as flexible as possible. For a long time, we've offered those capabilities from an on-prem perspective, that people want to manage themselves. We've had that with MSSP partners, where it can be managed by a third party. Now with GlobalProtect cloud service, we give them the option of having that totally the cloud experience as well. We continue to evolve all the offerings based on what the customer needs will be into the future.
If I step back from that a second and say, "Okay, what are we doing?" We're bringing the full-on enterprise security platform in that form factor to the market, which means we're going to be able to provide, and we are providing the security outcomes we've been driving for some time across all applications, consistently from endpoint to network and cloud as well, and in ways that are just not based on traffic that's leaving, but also coming into the network and being able to bridge the local user. A pretty distinct competitive advantage, I think, there, and also flexibility on a new model that customers' reaction so far has been very positive.
That's great. Maybe just a quick one. Could you comment on the relative rate of sales capacity adds in Q1 relative to your 15% billings growth? Was it less, more, about the same?
Nothing out of the norm historically. Very consistent with what we've been doing for many years.
Our next question will come from Saket Kalia of Barclays.
Hey, guys. Thanks for taking my questions here, and congrats, Kathy, on the promotion as well.
Thank you.
Hey, Mark, maybe just to start with you, just higher level, understanding it's still early days on Application Framework. I'm just curious how Application Framework is maybe changing customer conversations, if at all, at this juncture.
It's been really dramatic, Saket, in a positive way that when we're talking with customers and we start off always with the very high level to say Palo Alto, for the last decade, has been fundamentally bringing higher and higher rates of prevention through automation and orchestration. In addition to doing that, we've also been massively simplifying the consumption model along the way so that customers can have better security with a much simpler consumption model that drives better ROI, less manpower, all the things that we've believed important for a long time, the world completely agrees with that now with the models the way they are. They're really broken. They have to be fundamentally different.
To show them the way for the third evolution with the Application Framework to say, imagine a world that looks like this, where you don't have to give up getting lots of innovation from the security market because security has to be highly innovative, but no one company can do that. Here's a way to get even more automation, more orchestration, better prevention rates, and do it with a vastly simplified consumption model as well. They really like that. I think what that's doing for us right now is very much showing what the future's going to look like as the thought leader. We have lots of demonstrated capabilities in making those real. We have people writing applications to the Application Framework today. We always got to keep in mind that after that conversation, they're going to buy something this afternoon, right?
It might be a firewall, it might be an endpoint solution, it might be a virtual machine in the cloud or something along those lines for a project. What I think we're hearing them say is, we've given us a very significant reason why we want to choose Palo Alto Networks as our operating platform, for lack of a better term, in all places in our architecture for our security capabilities.
Our next question will come from Gabriela Borges of Goldman Sachs.
Great. Good afternoon. Thanks for taking my question. Maybe a follow-up on the demand picture, but instead of geographically, by vertical. Maybe if you could comment a little bit on federal carrier mid-market. I think there was a comment earlier on some of the mix being better towards product because of CapEx from service providers. If you could just talk a little bit more about the demand profile and the mix you're seeing across vertical, that'd be really helpful.
Sure thing. Yeah. First let me start off with we're very well diversified across our verticals, which is great. We like to see that. Mostly it demonstrates that we're truly a platform because you see that horizontally played out across all verticals. From a Federal perspective, it's a Federal year-end. We saw some good wins there, and continuing to see increasing signs of spending getting back to normal, which would be fantastic. There's been a lot of ups and downs and anxiety in the Federal market due to lack of leadership positions being filled. We're in a continuing resolution right now, so any return to normalcy is a good thing there. Also, the Federal space fits very well within our mission for what we do, which is to protect our way of life in the digital age and what the federal government's trying to do.
They find that to be very in line with their mission, so they like that a lot, which is great. On the service provider side, that's a good market for us. It continues to grow nicely. We continue to put more investment in there from a technology perspective of adding features and functionality to that. My comment earlier on the prepared remarks on service provider was that the product mix of the deal sets in the service providers was a bit heavier than we thought in the quarter, so that contributed some to the product mix in the quarter, which of course we like to see.
We'll hear next from Michael Turits of Raymond James.
Hey, guys. Two questions. First one, I think this is a continuation of Rob Owens' question asking about new versus existing. Can you give us some sense of where you are in that refresh cycle coming off of your big build, where growth was really strong back in the 2012, 2013 era, and where you might be in, if that's on track? I have a follow-up question about billings.
Yeah, sure. From a refresh perspective, the refresh opportunity, as we've said before, is large and continues to grow. We add this many customers, and the cohorts grow over time. That's been going well for us. We had a good refresh in the quarter. We expect to continue that through the rest of the year. We also mentioned, Michael, as you may remember at Analyst Day that while that's the case, we wouldn't expect that to be the major driver of product growth in the year. We expect that to be really the platform itself, our new product introductions, and increasing productivity from the sales team with reorg. The refresh is definitely a positive for us, and we're doing very well in that.
Our next question will come from Patrick Colville of ARETE Research.
Thanks. Here's my question. Is there any way you could tell us the, or give us an indication of the product revenue blend from the new hardware launched in February 2017?
The product revenue blend. I'm sorry, Patrick, I'm not exactly sure I understand the question.
Of the product revenue you sold in the quarter, what kind of portion roughly was from the kind of new hardware you launched early this year?
The new products that we launched had a very healthy contributing factor to the mix of products. We don't give out specific percentages, but the traction has been very strong. It's opened up new opportunities to sell to new customers as well as selling into our install base from an expansion standpoint. It was a very strong contributor. We just don't give out the specific percentages.
Our next question will come from Andrew Nowinski of Piper Jaffray.
Great. Thanks. Congratulations, Kathy. Just maybe a clarification here. I guess your product gross margin was a little bit lower than it has been historically, which I think you said was due to the new products, the new hardware. When do you expect to start to see the cost efficiencies from the new products, where they're no longer a headwind to your gross margin?
Yeah. Well, we said earlier, when we have new product launches that we would have some headwinds on product gross margins as we got to economies of scale and also that our providers, people who supply us with components, can also take those components into a broad base into the market. When we look at the size of the product launch we just did back in February, it's the biggest one we've done by a long shot. We don't have actually a perfect analogy to that, but probably the closest one is the PA-5000 Series we did a number of years ago. That took about a year or so before we were able to get those economies of scale. We expect that to be the case here.
Just a follow-on point. With that being the dynamic, we're still operating within our framework of 75%-78% total gross margin, and we've incorporated that dynamic into that guidance range. We feel good about that structure.
Our next question will come from Gur Talpaz of Stifel.
Great. Thanks for taking my question. A quick question on endpoint. Do you think we're at the point now where large enterprises are more willing to buy endpoint prevention and networking security from the same vendor? Are you seeing more in the way of standardization projects? Thank you, and congrats on the quarter.
Gur, it's Mark. I think that's the case, and we believe just as a big-picture matter, that that's definitely going to be the case in the future. We lean very heavily into the endpoint market, as you know. We think it's by matter of necessity that if you think about that second evolution, the way we define it, of consistency from network to endpoints to cloud, that's going to be very important. Some capabilities from a security perspective are better done on the network, some are better done on endpoints. Increasingly, with data in the cloud, some will be in the cloud. We have to get all of those right, very importantly, they all have to work together. We're seeing that customers want that consistency. I think they also want fewer vendors as a big-picture matter as well.
Being able to have a platform that has that consistency, that allows them to reduce the number of vendors and sprawl in the organization, that might be devices in a network, it might be agents on an endpoint, is a net positive for them.
Gregg Moskowitz of Cowen and Company has our next question.
Okay, thank you. Congrats on a good quarter. Congrats, Kathy. Best of luck, Steffan. I'd like to go back to new customer acquisition because this was an impressive quarter on that basis, and especially so for a Q1. Would you attribute this to the product refresh earlier in the year, or would you also say there's a more concerted go-to-market focus around reaching new accounts? Thanks.
I think we had a number of things there going on, Gregg. We had solid performance from all the theaters that you heard a little while ago across all the customer profiles. We've got our continued productivity improvements as well from the work we started last year. The new products for sure are getting a positive reception in the market. Then also with increasingly growing the set of offerings with our new services, we have the ability to talk to customers about new opportunities and land new customers with non-attached services as well. We have a whole bunch of stuff going on as far as ability to touch customers. New products definitely are contributing nicely inside of that.
Okay, thanks.
Thanks, Gregg.
Our next question will come from John DiFucci of Jefferies.
Thank you. I have a follow-up question for Gur's question. It has to do with Traps because it looks like you're seeing some good traction. By the way, this question, I think it's more for Mark Anderson. That Symantec displacement is really interesting. I assume when your conversations with customers, they're first buying your firewall and everything that comes along with that, then they consider Traps. I guess, is that accurate? I've seen when they look at Traps, are they comparing Traps on its own merits against Symantec? Mark McLaughlin just talked about having both, it has some advantages. Do they also consider it on its own merits against the competing product? Has it ever been, or do you think it will ever be, the land product? Like, "Hey, I want to buy Traps, and then maybe I'll consider the firewall.
Yeah, John.
Sorry.
Thanks for the question. No, I think just first of all, about a third of our customers for Traps, their first purchase is Traps, not traditional network security. We think on the merits of the solution with the focus that we have in the field, that we're winning because we're delivering better outcomes. We're going after traditional antivirus budget because customers have associated very little value with the money that they're spending on traditional antivirus. I think down the road, it's really strategic space for us, as Mark mentioned earlier, we're going to continue to see success here.
I think one of the things, John, as well is, this is important for our teams as they're out there making these sales, is the ability to be able to tell a customer to say, this second evolution, the way we defined it earlier, is really important to have consistency of the security outcomes regardless of where the data is, and sometimes it'll be on an endpoint, right? We definitely want that consistency and also be able to say on a head-to-head basis, we're the best there, right? You should choose us on a competitive bake-off, which we know you're going to do, and we feel very good about that.
As you think about that bake-off, in addition to winning head-to-head, you also get the consistency aspect that allows you to grow into the future into even more interesting things like the Application Framework over time. More reasons why you want to deploy Palo Alto Networks everywhere that's important as a data collection point and enforcement point in your architecture, sometimes network, sometimes endpoint, sometimes in the cloud.
Yeah, it's really the trust and faith that we've earned from customers over the last decade, where they know that we're going to provide a high-quality product, then we're going to support it in a way, in a more focused way, than anybody out there can from a product support standpoint.
Great. Thank you, guys.
Sure.
Thanks.
Our next question will come from Fatima Boolani of UBS.
Thank you for taking my question. Mark, a question for you around your dedicated efforts around building a public cloud practice and bringing your partners in there. Just at a high level, I'd love to hear what sort of conversations you are having with the customers around their public cloud challenges and how you are positioned to sort of help them cross the chasm. A quick follow-up for Steffan, if I may.
You bet, Fatima. I think we've got a really broad spectrum of customers. Some are leaning pretty aggressively into public cloud. They're putting pre-production DevOps, new applications into the cloud. Some are dipping their toes in. I think what we represent for them is an opportunity to provide a real consistent look and feel for the security that we can impose there. This is going to take place over the next 5 to 10 years, where you're going to continue to see more and more migration as people become more and more comfortable for that. I think that comfort is going to come from the kind of security that we can help deliver to them. I think we're in a very good space there.
That's helpful. Steffan, if I look back to your billings performance a couple of years ago, where you maybe signed some longer-term contracts, as those come up for renewal in 2018, and even 2019, what sort of trends are you seeing in the earlier crops of these longer-term deals? Are they renewing at the same duration? That would be really helpful. Thank you.
Well, if you look back over the last several years, we've seen a modest gradual increase in duration, and it seems to have leveled out at approximately three years. For the companies who did a three-year deal three years ago, there's really a mix of renewals business right now. We're seeing some re-up for a multi-year term. We're seeing others renew annually. There's really a mix there. What we said at our Analyst Day and what we still believe to be true is that for the rest of the fiscal year, we don't really see any changes in overall duration, and that it should be roughly about three years.
Our next question will come from Walter Pritchard of Citi.
Thank you. I'm wondering just as I look at revenue per customer, you highlighted your large, I think it's $23 million to be a top 25 customer. Can you talk about what's happening at the other end of your business? With some of the lower-end products that you released in the last six months, are you dipping down into smaller customers at all? What is your strategy around, I know you're not a small office best-in-breed player, but curious when you look to potentially turn into that segment of the market, which is probably some revenue opportunity for you.
Hey, Walter. It's Mark. Our focus has been, and continues to be, as you know, is this enterprise security market. Mostly because we find focus matters in delivering the best solutions and being able to support them in a high-quality manner. That hasn't changed for us. We look at the customer acquisition and to the mix of customers of who are they, very consistent with what it has been for some time. We haven't seen a change there either. Though I think what we are seeing from some use cases and some of the larger customers is the ability to address interesting and new use cases around, like in retail environments. Plus some of the insurance that just wants to be able to do some more campus work, mobile user work, things along those lines. We'd expect that to continue this year.
A question for Mark Anderson, just around the European theater. That looked especially strong. Was there anything specific? Sometimes good execution is the answer, but I'm curious if there's anything specific you're seeing, certain countries or certain vertical markets that might explain the strong performance in Europe.
Yeah, no. It was really good performance across the board in every sub-region within EMEA, Walter. I think just what we're seeing across the board in Europe is they're typically one to two years behind the Americas in terms of their IT culture, if you will. We're seeing just general awareness of the need for a migration away from legacy disconnected products to more of an architecture approach. I think it's coming at a time when bad things are happening around the world. It's focused on legislation with the GDPR and frankly, the coverage that we have now in every major country in Europe, that's getting us in front of customers and showing them how we can be a much better provider for them.
Great. Thank you.
Sure.
Our next question will come from Keith Weiss of Morgan Stanley.
Hey, guys. Thanks for fitting me in, a very nice quarter. I was wondering just on sort of go-to-market strategy. It seems like the differentiation in kind of the sales, sort of what the base of kind of selling to the customer base is changing in a big way. This isn't an appliance sell anymore. It's not a box sell anymore. You guys are selling a platform. Does this change sort of the partner strategy at all, or change sort of the kinds of partners you're going to market with, in terms of who could actually get across that value proposition?
That's a good question, Keith. Certainly, we're always on the lookout for, surgically, frankly, for new partners. Not looking to cast a wide blanket, but really looking to improve the coverage that we have around the world. It just naturally, as we've grown, the kind of partners that we couldn't address, the large global ones, the large systems integrators seven or eight years ago, now we're at the scale where it's hard for them to avoid us, frankly. We've actually worked really hard on that over the last five years, and as I think we've discussed in each of the Analyst Days, we're getting more and more attention there. I'd say nothing really dramatically different than the last Analyst Day other than just very much a focus on looking for large global distribution partners, large global systems integrators, service provider partners, and national brands.
What we do want is we want a message that's consistent with what our field team is talking to customers about. That's this platform or architecture delivery versus just disconnected point products.
Got it. Just one follow-up on the federal vertical in particular. Any color you could give us on sort of strength of federal in Q1 and given sort of current machinations and with budgeting and whatnot, expectations for potential to continue that strength further into the fiscal year?
Yeah, Keith. Mark here. In the Fed space, like I said, we saw some good wins here in the quarter. I would say big picture on Fed, it's been a mixed bag for a number of quarters as there's been some consternation, I think, in the federal space on some senior leadership positions that still go unfilled. Also just the budget. They're still working under a continuing resolution right now that don't think it's fixed until December timeframe. The progression of seeing more normal spending and people understanding what their budgets will look like for the following year is very important. Hopefully getting through the continuing resolution would be a positive marker on the table and get people back to more normal spending patterns there.
Yeah. Just I would add, it's a really important space for us to be in. We've invested in the team over the last three years, and we've got great coverage across the intel, civilian, and DOD segments, and I think we feel really good about the team.
Excellent. Thank you very much, guys.
Sure. Thanks, Keith.
Our next question will come from Karl Keirstead of Deutsche Bank.
Thanks. For either Mark, I wouldn't mind going back to the relative performance. It feels like in this quarter and the one you're guiding to, the gap between yourselves and Check Point and Fortinet seems to be widening. I just want to ask if you can help us understand exactly where that wedge seems to be opening up. Is it as simple as you've got a product cycle benefit that perhaps they don't now? Maybe you could help us there. Then maybe as a follow-up to Steffan. Steffan, to build on a prior question, you raised the revenue guidance, but the billings guidance is, at least at the high end, essentially the same. Is that simply because most of the DR comes from maintenance and subscription, and those line items were a little bit more in line versus the outperformance on product? Thank you.
Yep. I'll take the first part. What I think we're seeing in the market and have been for a while is the importance of the platform, which I mentioned before, where things work together in a highly automated, orchestrated fashion, and there's really positive benefits in prevention outcomes plus the simplicity of the consumption models that result. Now, I think that's really continued to distinguish itself in the market because anybody can make those statements, but at the end of the day, what really matters is the architecture on how it's actually built. I think that what we've proven over time is we get a lot of credibility there because we're a company that primarily is working on developing and building those things ourselves so we can make those statements at scale to customers and say, "No, we really think this actually works together," right?
We have lots of references you can talk to where other companies might be cobbling things together and trying to do things that really don't work out at the end of the day when you're trying to get to an automated platform. I think that's one level of it. The second thing on the architecture is the elegance of the architecture matters as well, where from a simplicity perspective, having it work in that automated, orchestrated way, and you're kind of mostly in charge of that platform, you've built a lot of it yourself, matters from a stability perspective, too. We see increasingly as other vendors add more like acquisitions into the mix, that stuff doesn't really work well together, and not only does it not drive the security outcomes, but it drives increasing instability in networks as well.
We hear a lot of folks come to Palo Alto Networks saying one of the primary reasons is not just technical, it's also stability. My current provider can't run at these big scales any longer. They just keep adding more stuff, and it's starting to break things as well. It'd be a whole bunch of stuff in the mix of that, but it all comes back to the architecture of the platform as the primary differentiator. As we drive these three evolutions and they build on each other, we think that increases the moat, and over time, we'll continue to allow us to distinguish ourselves.
Yeah. Karl, on the second part of your question, as you mentioned, we did raise billings for the full year by $10 million. The mechanics are such that when you look at our deferred revenue balance and what we're adding to it every quarter, very robust and healthy growth in both attached and non-attached subscriptions and also maintenance. They're coming in line as expected, and I think to the point that you raised, we are having more in-period revenue than we had originally planned for because product was so strong. We also raised product for the full year. The last point I'll leave you with is, if you think about current billings, current billings was strong, and that reflects product revenue in the period versus the change in short-term deferred.
Got it. Okay, thanks a lot.
Thanks, Karl.
Thank you.
Our next question will come from Shaul Eyal of Oppenheimer.
Thank you. Hi, good afternoon, guys. Congrats on a good quarter. Congrats, Kathy, on the recent promotion. Steffan, thank you for everything. Actually, Steffan, before we let you go, just a quick housekeeping. Number of customers relating to Traps and WildFire, I think historically we have been providing that. Any view, any update along these lines?
Yeah. On that front, we release those on a semi-annual basis. We saw very healthy growth in customer counts for both of those product lines.
Fair enough. Mark, you mentioned in your prepared remarks an expansion of your cloud product. I think you also mentioned including an updated email version targeting Office 365 landscape, among other things. Just want to make sure, does that product fall under your successful partnership with Proofpoint?
Yeah. What I mentioned, Shaul, is for our Aperture offering, which is our cloud access security broker offering-
Okay
we continue to expand the applications' APIs that it's worked with, and we've expanded it into cloud-based email offerings like Gmail, for example. That's what we've done. You can just think of them as we keep adding more application coverage to Aperture.
There is integration with Proofpoint that when we can make this discovery with Palo Alto Networks, the integration we do with Proofpoint can allow Proofpoint to actually do something about it. It really is an add for Proofpoint.
Got it. That is helpful. Thank you.
Our final question today will come from Jonathan Ho of William Blair.
Hi. Congratulations. Just to make it quick, I'll lead with one question. In your early data lake and Application Framework deals, can you maybe give us a little bit of color in terms of what those deals look like and the potential for upsell and expansion over time?
Yeah, sure. I'll take that. Mark was very involved with some of these, so he can give you some more color. Big picture on the third evolution, Jonathan, of bringing the Application Framework to market. Maybe somewhat an obvious statement, but we definitely are reinforcing it with customers, is that if you're going to have capability sets that are really based on analytics, and increasingly lots of interesting things in security will be driven on analytic capability, machine learning capability, the data set against which it runs is very important, not only in terms of its size, but also in the diversity of the kind of data in there. For example, you don't need machine learning to tell you information's bad if the only data set you put in there was bad stuff.
You want to have very big data sets, you want the diversity of the data set to have good, bad unknowns in there and grow a lot over time. The Logging Service is a capability set that we get to go to customers and say, for a very cost-effective point of view, you can log all the information coming off Palo Alto Networks' capabilities because you want those really large data sets for all the analytic capabilities like LightCyber, for example, and things we'll bring to the Application Framework to chew on those. The bigger they are, the better they are. It doesn't have to be cost prohibitive to log all that information. Mark was deeply involved in a couple of the sales this quarter, maybe you want to add a little color.
Yeah, I think you pretty much nailed it, Mark. I think to be able to leverage machine learning like our adversaries are leveraging against our customers every day in an increasing scale and velocity, you need to be able to log not just bad and suspected bad, but also good to really let the machines crunch, as Mark said. I think what makes us attractive beyond price is the fact that we're able to take the data from Logging Service and add that to the trillions of artifacts that we have in our threat intelligence data centers around the world to really drive the kind of automation that you need to be able to reduce the attack surface.
Great. I think that's the last question. Yep. Okay. Well, thanks. Before I close, I want to thank everybody again for joining us today, I wish you and your families a very safe and happy Thanksgiving. We look forward to seeing many of you in the coming [weeks at several] investor conferences. Really appreciate your time. See you next time.
Ladies and gentlemen, this does conclude today's conference. We thank you for your participation. You may now disconnect.