Good day, welcome to the Palo Alto Networks' fiscal fourth quarter earnings conference call. Today's conference is being recorded. At this time, I'd like to turn the conference over to Ms. Kelsey Turcotte, Vice President of Investor Relations. Please go ahead.
Great. Thank you very much. Good afternoon, thank you for joining us on today's conference call to discuss Palo Alto Networks' fiscal fourth quarter and full year 2017 financial results. This call is being broadcast live over the web and can be accessed on the investor section of our website at investors.paloaltonetworks.com. With me on today's call are Mark McLaughlin, our Chairman and Chief Executive Officer, Steffan Tomlinson, our Chief Financial Officer, and Mark Anderson, our President. This afternoon, we issued a press release announcing our results for the fiscal fourth quarter and full year ended July 31st, 2017. If you would like a copy of the release, you can access it online on our website.
We would like to remind you that during the course of this conference call, management will make forward-looking statements, including statements regarding our financial guidance and modeling points for the fiscal first quarter and full year fiscal 2018, our competitive position and the demand and market opportunity for our products and subscriptions, benefits and timing of new products and subscription offerings, organizational changes, our ability to drive outsized growth rates, and trends in certain financial results, operating metrics, mix shift, and seasonality. These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today, you should not rely on them as representing our views in the future, we undertake no obligation to update these statements after this call.
For a more detailed description of factors that could cause actual results to differ, please refer to our quarterly report on Form 10-Q filed with the SEC on June 1st, 2017, our earnings release posted a few minutes ago on our website and on the SEC's website. Also, please note that certain financial measures we use on this call are expressed on a non-GAAP basis and have been adjusted to exclude certain charges. For historical periods, we have provided reconciliations of these non-GAAP financial measures to GAAP financial measures in the supplemental financial information that can be found in the investors section of our website, located at investors.paloaltonetworks.com. We would also like to remind you that we will be hosting Investor Day 2017 with on-site registration starting at 8:00 A.M. Eastern Standard Time on Wednesday, September 27th, in New York City.
For more information or registration details, please visit our investor relations website or email Shane Xie at sxie@paloaltonetworks.com. Finally, once we have completed our formal remarks, we will be posting them to our investor relations website under quarterly results. With that, I'll turn the call over to Mark.
Thank you, Kelsey, and thank you everyone for joining us this afternoon for our fiscal fourth quarter and full year 2017 results. I'm pleased to report that we ended the year with a strong fourth quarter. On a year-over-year basis, Q4 revenue was $509 million, up 27%. Billings were $671 million, up 17%. Non-GAAP earnings per share was $0.92, up 39%, and free cash flow was $190 million. For the fiscal year 2017, revenue was $1.8 billion, up 28% year-over-year. Billings were $2.3 billion, up 20% year-over-year. Non-GAAP earnings per share was $2.71, up 43% year-over-year, and free cash flow was $705 million. I want to thank our customers, our team, and our global partners for these results, their hard work, and their ongoing support.
In the quarter, we saw a solid demand environment in all theaters and strong customer interest in all the capabilities of our next-generation security platform. We also saw continued solid gains from the go-to-market work we started in our fiscal third quarter. Customer acquisition in the fourth quarter was very strong with approximately 3,000 new customers added. We are now privileged to serve more than 42,500 customers worldwide. This was by far the strongest quarter for new customer adds in our history, including the addition of a record number of G2000 customers, which now total over 1,250. We also added approximately 2,000 new WildFire customers in the quarter, bringing our total number of WildFire customers to over 19,000, an increase of approximately 50% year-over-year. In addition to record new customer additions, we continue to rapidly increase our wallet share of existing customers.
In the quarter, all of our top 25 lifetime value customers again made purchases. To make this list, the customer had to have spent a minimum of $21.9 million in lifetime value, a 56% increase over the $14 million in Q4 of fiscal 2016. This represents a multiple of almost 100 times their initial purchase, which is up from approximately 50 times the initial purchase of our top 25 in the prior year period.
Specific examples of customer wins and competitive displacements in the quarter included an eight-figure Cisco replacement at one of the world's largest pharmaceutical companies that included both attached and non-attached subscriptions, a seven-figure Check Point replacement at one of Australia's largest banks to protect their remote offices, a McAfee replacement on 40,000 endpoints at one of the largest energy companies in the U.S., a seven-figure Cisco replacement and competitive win against Check Point at a large U.S. loan corporation for data center segmentation, and a competitive win at a very large global service provider in a cloud data center deal. Our ability to extend prevention capabilities consistently wherever data is deployed or computed is essential in an increasingly dynamic compute environment. As a result, our platform adoption is increasing across the board.
Along with market-leading growth for our hardware and SaaS security services, our non-attached subscriptions, including Traps, VM-Series, Aperture, and AutoFocus, all performed well in the fourth quarter. More than 3,400 customers are now using our VM-Series and cloud deployments, and we have sold millions of endpoints to over 1,400 Traps customers. At the beginning of August, Traps received a maximum performance score of 100% detection of real-world attacks on testing done by AV-TEST, a third-party organization with extensive experience testing endpoint security software. In addition, we were positioned in the leaders quadrant of the July 2017 Gartner Magic Quadrant for enterprise network firewalls for the sixth time in a row. We continue to take market share, see rapid adoption of the platform, and receive industry recognition because of our relentless focus on innovation and customers.
For over a decade, we have been driving major evolutions in security that deliver increasingly high rates of consistent prevention regardless of where data may be, marrying innovation with the consumption model that overcomes the legacy, siloed, expensive, and people-intensive models that have reached a breaking point. These evolutions build on each other. Fiscal 2017 was a very big year for the introduction of new products and capabilities that are driving increased disruption in the market. In the third quarter, we released our new hardware, high-performance virtualized firewalls, and feature-rich 8.0 operating system. Feedback on these releases has been very positive, which is evident in our Q4 results. These new products and capabilities were quickly followed in May with the release of Traps 4.0, which added several key security capabilities and extended operating system support to include macOS.
At our user conference in June, we announced two new services, the GlobalProtect cloud service and the Palo Alto Networks logging service. Our new GlobalProtect cloud service will deliver all the prevention capabilities of our platform, including application visibility and control, threat prevention, URL filtering, and WildFire to secure remote networks and mobile users. Our new logging service is a cloud-based offering that is the basis for better security analytics that provides scalable storage capacity and processing power to help organizations store, process, and analyze as much data as possible without needing to plan for local compute and storage. Both services will be generally available in September. In addition, given our critical mass and deployments of architectural enforcement points globally, we made the game-changing announcement at our user conference in June of the next evolution of the industry and our platform, the Palo Alto Networks application framework.
This open and flexible SaaS framework leverages the existing Palo Alto Networks security infrastructure already deployed across tens of thousands of global customers, which is growing by thousands each quarter. The data from these deployments, our extensive threat intelligence, and new data from the logging service allow customers to address the myriad of security needs by being able to rapidly consume and deploy innovative security applications built by Palo Alto Networks, third-party developers, MSSPs, and their own teams. This brings customers and security innovators a new level of agility and speed by reducing the complexity of creating, deploying, and integrating security innovations by leveraging already deployed infrastructure. More than 30 security industry vendors have already engaged with Palo Alto Networks to develop applications for the new application framework, which we are planning to have generally available in early calendar 2018.
There's been a lot of excitement and positive feedback around our fiscal 2017 announcements, which we had the privilege of sharing live with customers in June at Ignite, and then again just last week at our sales kickoff, where we trained almost 3,500 team members and partners on the skills they need to sell the platform. The energy level is very high as we come off a strong finish to the year. As we look forward to fiscal 2018, I'm excited about driving further disruption in the market and our opportunity to continue to quickly acquire market share. I'll turn the call over to Steffan to review the financials and provide guidance in a minute. Before doing so, we'll bring you up to speed on a few organizational announcements we made this afternoon.
First, I'd like to congratulate Lee Klarich on his promotion to Chief Product Officer, expanding his responsibility to now include engineering as well as product management. Lee, who has been with Palo Alto Networks since 2006, has been a longtime member of our senior executive team and has played a key role in leading the team that has delivered our market-leading security platform. I'd also like to welcome Sridhar Ramaswamy to our Board of Directors. Sridhar, who is currently Senior Vice President, Ads and Commerce at Google, brings deep technical engineering experience and extensive cloud, analytics, and infrastructure expertise to the board, and we're very happy to have him. Finally, Steffan has informed me and the board that he intends to retire from his role as CFO. The company is initiating a search for his replacement, and Steffan will remain as CFO until the search is completed.
Steffan, you've been a great CFO and friend, as well as a great business leader. You've built a world-class team that has enabled our market-leading growth and positioned us well for the future. While you'll be with us until we find your replacement, I did want to take this opportunity to thank you for all that you've done for the team. We are all very deeply appreciative. With that, I'll turn the call over to you, Steffan.
Thanks, Mark, and thank you for the kind words. It's a privilege to work with you and the team here at Palo Alto Networks. I'm very proud of what we've been able to accomplish in leading the market in such a short period of time. Now let's turn to the numbers and guidance. I'd like to note that except for revenue and billings figures, all financial figures are non-GAAP, and growth rates are compared to prior year periods unless stated otherwise. In the fourth quarter, we continued to see positive indicators of the changes we started to make in Q3 2017 in the go-to-market portion of the business as sales productivity improved sequentially. It was by far the largest new customer acquisition quarter in the company's history, and we saw strong expansion sales in the existing customer base.
I'm pleased with the execution of our growth and profitability strategy as we continue to significantly outgrow the market, delivering record revenue, billings, and deferred revenue, while also generating record operating income, earnings per share, and free cash flow. In Q4, total revenue grew 27% to $509.1 million. For the fiscal year, we reported total revenue of $1.8 billion, a 28% increase year-over-year. Looking at the geographic growth of Q4 revenue, the Americas grew 27%, EMEA grew 28%, and APAC grew 27%. Q4 product revenue of $212.3 million grew 11% compared to the prior year and was greater than we expected. Sales of the new hardware, which we launched in fiscal Q3 2017, contributed to the strong results this quarter. Q4 SaaS-based subscription revenue of $155.7 million increased 46%. Support revenue of $141.1 million increased 37%.
Subscription and support revenue of $296.8 million increased 42%, accounted for a 58% share of total revenue. It is now approximately a $1.2 billion run rate business. Q4 billings of $670.8 million increased 17%. The dollar-weighted contract duration for new subscriptions and support billings in the quarter was just under three years, essentially flat compared to the end of the second quarter and up slightly year-over-year as customers commit to our platform as their long-term security architecture. For fiscal 2017, total billings were $2.3 billion, up 20% year-over-year. Product billings were $711.1 million, up 6%, and accounted for 31% of total billings. Support billings were $715.3 million, up 23%. Subscription billings were $867 million, up 32%. Support and subscription billings accounted for 69% of total billings in fiscal 2017, compared to 65% in fiscal 2016.
This mix shift towards subscription and support is a multi-year trend that we expect to continue given increasing customer adoption of our eight subscriptions, new subscription services to be introduced in FY 2018, and high renewal rates. Total deferred revenue at the end of Q4 was $1.8 billion and increased 43%. Q4 gross margin was 77.3%, a decrease of 210 basis points compared to last year and at the higher end of our target range of 75%-78%. The decline was primarily attributable to the new products introduced in our fiscal third quarter. Q4 discounting decreased sequentially and year-over-year. Q4 operating expenses were $273 million or 53.6% of revenue, while operating margin was 23.7%. For the full fiscal year 2017, operating margin was 20.1%, an increase of 280 basis points year-over-year compared to FY 2016 operating margin of 17.3% as reported.
Included in the 280 basis point increase is approximately 100 basis points of organic operating margin expansion. We ended the year with 4,562 employees, an increase of 767 year-over-year. Net income for the fourth quarter grew 42% year-over-year to $85.5 million or $0.92 per diluted share. For fiscal 2017, net income grew 47% year-over-year to $253.4 million or $2.71 per diluted share. On a GAAP basis for the fourth quarter, net loss increased 22% year-over-year to $38.2 million or $0.42 per basic and diluted share. For fiscal 2017, GAAP net loss increased 12% year-over-year to $216.6 million or $2.39 per basic and diluted share. Both Q4 and fiscal 2017 GAAP results include an impairment loss of $20.9 million on property and equipment related to the relocation of our corporate headquarters.
Additionally, we expect to recognize a loss of approximately $15.4 million in our Q1 fiscal 2018 GAAP results as we vacate our former headquarters facilities. Turning to cash flows and balance sheet items. We finished July with cash equivalents, and investments of $2.2 billion. During the fourth quarter, we repurchased approximately 900,000 shares of common stock at an average price of $134.60 per share, leaving a balance of approximately $580 million available for ongoing repurchases through December 2018. Q4 cash flow from operations of $239.5 million increased 28%. Capital expenditures in the quarter were $49.2 million, including $25.5 million of CapEx related to our new headquarters. Free cash flow was $190.3 million, up 11% at a margin of 37.4%. Excluding CapEx related to our new headquarters, free cash flow was $215.8 million, up 25.8% at a margin of 42.4%.
DSO was 70 days at the low end of our target range of 70-80 days. Turning now to guidance and modeling points. This guidance takes into account the type of forward-looking information that Kelsey referred to earlier. For fiscal Q1 2018, we expect revenue to be in the range of $482 million-$492 million, an increase of 21%-24%. Product revenue to be in the range of $170 million-$173 million, an increase of 4%-6%. Billings to be in the range of $580 million-$600 million, an increase of 12%-16%. We expect non-GAAP EPS to be in the range of $0.67-$0.69, using 93.5 million-95.5 million shares. We expect CapEx for Q1 fiscal 2018 to be approximately $30 million, including approximately $10 million final expenditure related to our new headquarters.
For the full fiscal year 2018, we expect revenue to be in the range of $2.125 billion-$2.165 billion, an increase of 21%-23%. Product revenue to be in the range of $735 million-$750 million, an increase of 4%-6%. Billings to be in the range of $2.64 billion-$2.7 billion, an increase of 15%-18%. We expect non-GAAP EPS to be in the range of $3.24-$3.34, using 96 million-98 million shares. Before I conclude, I'd like to provide some additional modeling points. For the full year, we expect seasonality for revenue to be in line with historical trends as reflected in FY 2018 consensus heading into this afternoon's call. Year-over-year billings growth for the first half of fiscal 2018 to be approximately 15%. Subscription and support revenue to make up approximately 65% of total revenue.
Our non-GAAP EPS guide to include approximately 150 basis points of organic operating margin expansion, excluding continued investments in LightCyber in the first half of fiscal 2018. CapEx to be approximately $100 million. Finally, free cash flow margin to be in the range of 37%-39%. With that, I'll turn the call back over to the operator for questions.
Thank you. If you'd like to ask a question, please signal by pressing star one on your telephone keypad. If you are using a speakerphone, please make sure your mute function is turned off to allow your signal to reach our equipment. Again, please press star one to ask a question. We'll go first to Ken Talanian from Evercore ISI.
Hi. Thanks for taking the question. First off, I was wondering, where are you in refreshing the group of customers who are likely to come up to renew hardware within the next year or so with the new hardware? What assumptions are you factoring into your fiscal 2018 guidance around that?
Yeah. Hey, Ken. Mark. Happy to take that question. From a refresh perspective, as you know, the cohorts for our customers continue to decrease each year, so that gets better and better for us as the years go on. We've been doing well on the refresh so far. We're doing a lot of work to make sure that we capture refresh opportunity and into the future. In our fiscal 2018 numbers, we have a number of drivers associated with product growth. Refresh is one of them. It's not the primary driver for growth, but it's one of them in there.
Okay. Then along those lines, are you seeing any changes to the level of attach for your attached subscriptions or acceleration in the unattached?
Yeah. The last time we had talked about attach, which was a metric that we're not going to provide any longer because we were more focused on the penetration rates. The last time we talked about it a couple of quarters ago, we said it was 2.6, and since that time, it's been rising continuously for us.
Thank you. We'll go next to Michael Turits from Raymond James.
Hey, guys. First, congrats on the quarters. Steffan, thanks for all your hard work over the years, and best of luck in all things. Glad you're sticking with it through the transition. 2 questions. First of all, the guidance is all very strong. One, billings growth is still lagging by about 5 points. Any thoughts on what's happening there in terms of duration or why we're still seeing that lag? Then I have a product question.
On the billing side, Michael, as you know, as we came off of the first half of fiscal 2017, we were working through some issues. Those are improving for us. We saw productivity increasing through the second half. Naturally, we were lower on the billings growth than we originally planned in fiscal 2017. It created a lag to revenue. As you see from the guidance, we would expect that lag to continue, but it is compressing through the back half of fiscal 2018 as we benefit from the ongoing work there. We are not seeing any change in duration for FY 2018.
I wonder if you could talk a little bit more about GlobalProtect Cloud Service, initial reaction on that. We have been very positively impressed by it in terms of its importance to the market. I am wondering what else you can tell us there.
Yeah, sure. Very happy to talk about that. The GlobalProtect Cloud Service, as I mentioned in the prepared remarks, is a new service that we will be launching in September, very shortly. This is a way for our customers in remote locations or branch offices to use all of our capabilities with a cloud offering if they choose to do so. Some customers like to, in those kind of locations, use small hardware and in essence run it themselves. Obviously, we have been doing that for quite some time for them. Others like to have third parties manage that. We have been doing that for quite some time with our MSSP partners. Now we will give them an additional way to do that as well through a complete cloud-based solution.
The interest on this is great from when we rolled it out at Ignite and talked with our customers about it.
Thank you. We'll go next to Walter Pritchard from Citi.
Hi, Steffan. Same, been great working with you. Just wanted to ask you about the free cash flow margin, sort of the high end of the range you've talked about. I think you talked about 30%-40%, and you're at 37%-38%. Your revenue guidance at the low end of the range, you've talked about corresponding to that cash flow range. Any help you can give us understanding what's enabling you to drive that better cash flow on revenue that's at the lower end of that range?
Well, there are a couple of moving parts that go into free cash flow, but we are starting to see slight increases in productivity. Billings growth will help with free cash flow. There's also just the overall improving operating margin that we're trying to drive as well. We've signaled that we're looking at increasing operating margin by 150 basis points of organic operating margin expansion. That should be helpful as well. Those are two dynamics. We're solidly within our growth and profitability framework. The last thing is, our taxes continue to be very de minimis. Cash taxes for FY 2017 were roughly $9 million, and we don't see a very big uptake in FY 2018 as well. Those are the moving parts.
Great. Thank you.
Yep.
Thank you. We'll go next to Philip Winslow from Wells Fargo.
Hey, thanks for taking my question. In your comments you highlighted, obviously strong expansion, and then in the Q&A, you commented on your refresh as well. I really wanted to touch on the new customer acquisition because, if I look at what you did in the second half versus the first half, you clearly saw an improvement there. Just to the team here, I just wondered if you could just drill down on that. Have we started to see the positive impact of the changes that you made mid-fiscal year in terms of new customer acquisition? When you look at new customer acquisition, maybe you could comment too, not just on count, but deal size and any sort of color you'd give. Thanks.
Yeah, sure, Phil. Customer acquisition, as you saw, very, very strong in the fourth quarter. Happy to see that. I think there's a number of drivers inside of there. The first and most important is I just think that the customer base continues to really gravitate towards Palo Alto Networks and the platform and what we can do with that, with things that we're talking about doing in the future as well, are really resonating with customers who really can't handle all the complexity and cost in the old way of doing things. There's clearly a move towards platforms, and we consider ourselves the leader there.
The second thing is more tactical in nature or operational, Phil, which you touched on, is the work that we've been doing in the go-to-market organization has paid off dividends early in the second half and through the fourth quarter, and we would expect that to continue to pay dividends into next year as well. I think some of that's showing itself through in customer acquisition rates as well. As far as the customers themselves, we're a very enterprise-focused company. The ASPs for our customers continues to be in the mid-five digits for us. That goes up and down through various quarters. We certainly pay attention to that, but we pay more attention to the lifetime value and wallet expansion. As you heard us talk about, lifetime value continues to grow very nicely across the customer base, including wallet expansion as well.
That's all going well. Then probably, one more thing that's worth noting in the fourth quarter itself is we've seen the team doing a continued great job internationally as well. Our brand presence and recognition in international markets continues to grow over time and quickly, and we saw solid performance in every theater in the world, and that also contributed to strong customer adoption.
Great. Thanks, guys, and congrats again. Also, Steffan, just wanted to pass along my congratulations to you as well. It's been a great run.
Thank you. I totally appreciate it.
Thank you. We'll go next to Pierre Ferragu from Bernstein.
Hi. Thank you for taking my question. Steffan, I hope it's not too difficult a question, but could you give us some perspective on what your thinking process has been and how you came to this decision to tell the board you would retire from the role? Then if I think about Palo Alto Networks going forward in the next few years, from where you stand today, what do you think is going to be the most important challenge the company is going to face? Thank you.
Pierre, appreciate the question. Over the past five and a half years, I've been fortunate to be part of the team that's helped grow and scale to be a market leader. The company's in really good shape. We have a lot of management bench strength. I'm focused on an orderly transition to whomever my successor is. When I think about just the overall opportunity for Palo Alto Networks, with leading technology, a great go-to-market organization, and the vision and leadership that the company has, I think the future's very bright. I'll turn that part over to Mark.
Yeah. Thanks, Pierre. On the second part of your question, I'd say the most important challenge for us in the future is one that's been with us for quite some time, which is to make sure that we can scale well. I think from an innovation technology perspective, the team's done a very nice job. We get very high marks from the industry, from the customers, from third-party recognition. We just launched a whole slew of new services. The application framework, which we just announced, we truly believe is very, very disruptive. It's going to change the entire industry as well, again. We're going to do it again, is our plan.
Through all that, where we're a large company growing very quickly, we have to execute well all the time. I believe that would be the single biggest challenge for us is just to make sure we get it right again and again and again. We've been more right than wrong, we've had our missteps there.
Thank you.
Thank you. We'll go next to Rob Owens from KeyBanc.
Great. Thank you for taking my question. You mentioned in your prepared remarks, less discounting in the period, and I was just curious if this is a function of the environment or a function of the new solutions that you have. If you could elaborate, that'd be great. Thanks.
Well, I think it's a mix of both things, Rob. What I mean by that is that Palo Alto has been very well known for bringing the highest levels of security into the enterprise space for a long time, and as a result of that, I think we're the premium provider in terms of innovation and we're not the cheap providers in the market from a price perspective. Our customers pay for value, and we believe we're delivering very high value, and as we keep delivering more and more capabilities and value to that, they're continuing to pay at the prices we're looking for and they're getting a lot for that.
In addition to that, from the price performance throughput on things in the hardware category, those change over time as customers need better and better performance with better and better price per performance to do things like SSL decrypt and use cases that are growing in nature. We've been able to continue to deliver on that for customers as well, so that they can have all the performance they need at an acceptable price. I think it's a mix of a combination of things there.
Great. On the DSO front, a massive improvement on a year-over-year basis, I guess it's one of your best results this year. Was this a more linear quarter than you have seen that really speaks to you guys getting back to a normal cadence of sales? Thanks.
Yeah, that's a great question, Rob. We've been operating in a range of 70 to 80 days. We were at the lower end of the range this quarter. There are a number of puts it takes DSO. We have seen improved linearity. That's one in particular. We've also seen just good business traction as well and good collection cycles. A number of things that go into it, being at the low end of the range is a good thing, we have a range for a reason because we do see some ebbs and flows to DSO.
Great. Thank you very much.
Thank you.
Thank you. We'll go next to Jonathan Ho from William Blair.
Hi, good afternoon, and wanted to echo my congratulations as well. Can you, maybe starting off, give us a little bit of an update in terms of what inning you're in terms of the sales reorganization and maybe what steps you're going to roll out more about that?
Yeah, sure. Jonathan, it's Mark, and just so you know, we're barely able to hear you, but I think I got the question. From using the baseball analogy from the go-to-market work we've been doing, it's called the bottom of the fifth. As we mentioned before, we took a four-phased approach to this. We were going to design what we were going to do, we're going to communicate it to folks, we were going to implement it, and then we have to put it in runtime. We finished the first three phases. We're in the runtime phase. We have the folks in the chairs for the most part that we need and established the relationships appropriately with the customers, and this is the human element portion of it now, where we have to have those relationships bake over time.
We're exactly where we expected to be at this time, so I'm very happy with the progress, and we think we're seeing the fruits of that, as you can see from the Q4 results.
Got it. Then just in terms of the application framework, can you give us a little bit more detail in terms of how you think that can maybe further differentiate Palo Alto and what that could maybe mean for win rates going forward?
Sure. Well, let me start off on this one. In the hundreds of customers that I've spoken to about this over the course of this past six months at Ignite, CBCs, the reaction to this has been very positive, and the reason for that is that it's pretty obvious that the consumption model in security is fundamentally broken. What I mean by that is most customers will complain, and rightfully so, that they have way too many vendors. How do you add the next one with less people to do it, less money to do it, and the complexity to do that?
What we're doing with the application framework is to continue to change not only what the definition of security is, which is very high rates of prevention, in this case, using increasingly better and better analytics on massive sets of data, but also to be able to consume innovation in a different model. As no single security company can innovate everything that's going to be needed, customers know it, we know it.
The application framework is leveraging all of the infrastructure that we've already deployed, and we're increasing that by thousands every quarter from a customer perspective into a big data lake, which is already running at petabytes and petabytes of data for a long time, applying analytics on top of that, which we've been doing for a long time with WildFire and MineMeld and LightCyber now, then opening that up through an open API at the top so that not only the Palo Alto Networks services and capabilities can be consumed off of things you've already deployed, but third parties as well. As I mentioned on the prepared remarks, over 30 security vendors are currently writing applications into the framework. We expect it to be a lot more over time.
It's a route to market for other vendors, including ourselves, where the customer gets to use that capability simply by turning it on without having to deploy something additional into their network, or their endpoint, or the cloud, which is the very traditional model. That's why we think it's very compelling, and customers seem to agree with that.
Thank you. We'll go next to John DiFucci from Jefferies.
Thank you. Mark, you said that ASPs for new deals were in the mid five digits, but it sort of bounces around a little bit. By my math, and I try to figure it out, it was lower than it used to be, let's say, a year ago. I know we're getting over the last year where there was a lot of things happening. Does it have anything to do with a greater ratable portion of revenue from new deals, more ratable subscription and maintenance than product, or is there something else going on there?
John, it's a good question. I think that when we are adding as many customers as we add every quarter, you see a whole slew of use cases for why people are coming to Palo Alto Networks. As a general matter, we kind of average it all out by the definition of what ASP is. As a general matter, if you average that all out, we are displacing our competitors at very high rates. Lots of times the way that that happens is they want to use us for something, then they go from there and they expand. Usually when we're going to get to come into an engagement somewhere, one of the first things they would do is put us in a lab environment or a DevOps environment or some environment to get started and tested.
That, of course, goes into the ASP for what they're doing. What happens almost all the time is they buy a lot more from us and spread out very rapidly, which is why we tend to pay a lot more attention to the lifetime value expansion and the wallet expansion of the customers as well. It's not really about ratable subscription services. It's really about how do you start off with Palo Alto Networks and then what happens after the initial purchase.
Got it. Okay, thanks. If I could, on the refresh, and maybe this one may be for Mark Anderson. Since your new products that just came out last quarter imply improvements, are you seeing what sometimes is called a sort of a trade-down, which we've seen with other companies in history when they come out with new products and when customers start to refresh, they may actually buy a lower-level product because they don't need to spend as much as they did previously. Are you seeing any of that at this point?
Any time we bring out a new product family that offers dramatic price performance, we see really three things. We see customers continuing to need more bandwidth because they're moving a lot more applications around, maybe back and forth to public cloud, then they'll trade up. We'll see some customers that will trade down because the price performance and the port density meets their needs on the trade down. I think more importantly, and this has really become a big factor already as quickly as Q4, is we're getting deals that we would not have otherwise won with the price performance of the in particular, the PA-850 and the PA-5200 family. It's just very disruptive relative to what's out there with the competition.
For customers that want real fast capabilities and our next-generation visibility to applications and user behavior, there's nothing like it out there, and that's been a big help.
Thank you. We'll go next to Sarah Hindlian from Macquarie.
Hi, Steffan. Thank you so much for taking my question, and congrats on the quarter. I wonder if you could talk about the overall threat environment a little bit more, where you're seeing dollars rotate within your product, and what sort of driving the better attach rates there on the subscription side would be of great interest to us as well. Thanks.
Sure. Hey, Sarah. Yeah, on the threat environment, I think the threat environment never stands still. Let's start with that, and you can see it all the time in newspapers and the various attacks. What we see from that from customers is the increasing recognition that the position you want to be in as a customer is the ability to get every possible shot you can to prevent an attack, and be able to do that very consistently everywhere possible. That would mean whether it's in your network or in the cloud or endpoints, and to be really interjected into the attack life cycle everywhere so you increase the probability analysis that you're going to prevent that attack successfully.
That is the definition of platforms and security, which is the ability to get high degrees of prevention in a highly automated way with less and less human involvement, with tons of leverage from other companies, all in the same kind of network effect, if you will, and to get it consistently wherever data resides. That's what we're delivering for folks. Earlier, somebody asked a separate question, which I said, the recognition of the need for platforms in this kind of environment where the adversary is increasingly automated, really is starting to underline the need for less and less complex and manually dependent systems that have been delivered through legacy platforms and point solutions. That's fundamentally what's happening with Palo Alto Networks and what's been driving our growth.
That's very helpful. Thank you. Sorry for the bad reception. On product attach, can you dive into that a little bit? Maybe a little bit more color, in particular around Traps .
Sorry, Saket, I missed half of that.
The second part of the question was about Traps. The first was attach, then it was Traps.
Okay. Yeah, as I said earlier, on the attach side, a metric that we're not sure is all that helpful for what's happening from a license value and wallet expansion in the customers who are looking at penetration rates, which continue to go up over time. Attach rates have increased, as I said earlier on the call, and continue to increase. We expect that to continue as customers adopt all of our services. Then on Traps, very happy with how Traps is performing for us. It's getting to be a good-sized business for us. We have, as you heard, over 1,400 customers now and millions of endpoints, and that's growing really well.
Not only does our sales force agree with that, they're very excited about selling Traps and can see it working very well for customers, but so is the partner community as well, where an increasingly large number of partners are becoming Traps specialized partners, getting all the training that's needed in order to bring that to market.
That's fantastic. Thank you.
Thank you.
Thank you. We'll go next to Walter Pritchard from Citi.
Great. Thanks for taking my question, and Steffan, thank you for all the help over the years. I wanted to ask about interest level and uptake in your standalone subscriptions, namely the VM-Series, following the refresh earlier this year. Given the added capacity going all the way up to 16 Gbps with the 700 series, and as well as the new features you've added to PAN-OS 8, have you seen any change in the demand pattern for products like 300, 500, or 700 over the past few months?
No, Gur, what we've seen is really good demand in both cases. Customers have lots of use cases. We're trying to address all of their use cases. Obviously, some of them, a big growing part of that is cloud-based. Where they're using our VM-Series is in cloud environments, which is whether it's hybrid or private or public, we can service all of those with the VM-Series. With the increasing amount of bandwidth required through because of cloud and SaaS adoption, things along those lines, we have been and will continue to deliver faster and faster throughput in the VM-Series as well. At the same time, with the hardware that we have and we're going to continue to have, hardware is an important part of the business.
We are the biggest hardware security provider in the world today by a long shot, we think. Some customers are doing both, right? They have physical hardware, and they also have virtualized capabilities in the cloud. They need the consistent protection between both of those. Lots of customers are using our hardware and our VM-Series, and we would expect that to continue into the future.
Well, that's helpful. Maybe one more follow-up, if I might. On Traps, within endpoint, there's been a lot of talk about endpoint conversions, primarily through the incorporation of EDR. Do you feel like that's somewhere you need to go, or is that a feature you think that can be addressed through the application delivery framework and some of the third parties that are building on top of your framework? Thank you.
I think it will be both. If we went to the very basics of when we launched Traps in the first place, of some of the really simple way to think about things, about what do you need from a next-generation endpoint security solution, you would want the ability to do prevention if you could, detection if you can't. You would want EDR capabilities, and you'd want the ability to do some automated forensics as fast as possible, right? I'm oversimplifying things along those lines. What you've seen us do with our roadmap with Traps is continually march down that list of things and also partner in cases where we don't have those capabilities in the market. I think it'll be a mix of those.
On the application framework itself, the other endpoint vendors as well are writing applications into the framework, and I think other security vendors will do that, even perhaps hopefully some of our competition will at some point. Ultimately, what's best for the customer is the delivery of the best capabilities against the largest set of data, right? We think we have the largest set of data today, and we're going to continue to have that because of the very, very fast rate of deployment of Palo Alto Networks globally, as you can see from the customer additions and lifetime value expansion.
Thank you. We'll go next to Sterling Auty from J.P. Morgan.
Thanks. Hi, guys. Let me start, Steffan, congratulations on a wonderful career. I do know I'm going to get the question, so I'm going to ask it in this form. Are you retiring or just retiring from Palo Alto? Could we see you as a C-level executive in another company going forward?
I'm currently retiring from Palo Alto Networks as CFO. I'd like to take a little bit of time off to figure out what I'm going to do next. The most important thing for me right now is to ensure an orderly transition and be here until my successor is named.
Understood, again, congratulations. One follow-up. Really impressive results out of EMEA. We saw struggles out of Check Point and CyberArk in the quarter, there's been lots of questions about GDPR and other things. Mark or Mark, any commentary to what you saw in the quarter, perhaps the linearity or the discussions and demand specifically to the theater?
Sterling, it's Mark A here. We did have a very good quarter in EMEA. I think a big part of it is the continued elevation of our brand, the combination of the marketing and the sales coverage that we have has really helped drive awareness to how we're different, it gets us appointments. Especially with GDPR coming in May of next year, there's sort of a forced awareness that we're not running around chasing ambulances, we're certainly being asked questions as subject matter experts, we're showing ourselves to be much more relevant and much more of a thought leader than maybe some of our competitors. I think just secondly, the team there, the performance across all regions in EMEA, without exception, was very good and very consistent.
All the way from the Middle East back to Western Europe and the U.K. and down to South Africa was just very solid. I think it's a combination of a good team, elevated brand, and just heightened awareness of the fact that legacy point products, security devices, we need to move beyond those.
Thank you. We'll go next to Gregg Moskowitz with Cowen and Company.
Okay, thanks very much. Steffan, congrats and best of luck. Mark, I wanted to follow up on the application framework because it does present a fairly radical change to security architecture as we know it. Can you talk about over what time period you see this playing out, as well as what you think this might mean for your financial model, both over the medium term and the long term?
That's a great question, Gregg. As well you know, we like to be the disruptors in the industry, so we're going to keep doing that. As I said, I think the model for security today or for some time has been increasingly broken consumption-wise, right? We did a huge amount of work around that, I'll call it the first evolution that we drove with the next-generation firewall, where we proved that you could subsume a lot of capabilities that used to be provided as point solutions as hardware into SaaS applications delivered off of hardware, and that's been a big part of our business. We did the second evolution about three years ago by proving this.
We still have a lot ways to go on this, of course, but proving that the consistency of having the same kind of security, not only in the network but also in endpoints and cloud, is absolutely critical and will grow in criticality over time. Very few vendors are going to be end up being able to make those claims that they can do that, high rates of prevention, exactly the same way everywhere where the data may be. The third major change or evolution is how do you consume all these things in the future where data and data become more and more important. That's sort of the setup. I think the specific question, though, about the model and the business is we would expect that this would be transformative to the industry over time. It's going to take time, of course, to do that.
The application framework, as we said, will be available in calendar 2018 from us. We would expect that over time, it would grow nicely and as routes to market become open to security innovators that would not be able to go build businesses and reach scale and get the data, importantly, themselves that we have because we have it in massive amounts. Just a couple other thoughts around that.
It's a very virtuous cycle, if you will, in that the more capabilities, analytics you can do and data that you have with your own things that you bring to market, like Palo Alto Networks has done in the past and will continue to do in the future, or that third parties can tap into through that application framework, makes the whole thing more valuable and will pull through the sensors, if you will, the endpoints and the hardware and the virtual capabilities, because that's actually how you consume, right? The more of those that are deployed, and we've deployed a lot of them, we continue to deploy a big amount, drive more data. Which makes the data lake more attractive to people to write applications into. Right? I think you kind of get it from, if you will, from the bottoms up and the tops down.
These things are very self-reinforcing and would grow over time.
Again, as a reminder, we ask that you please limit yourself to one question to allow everyone an opportunity to ask questions. We'll go next to Fatema Bolani from UBS.
Good afternoon. Thank you for taking my questions. Mark, I have a question for you around the lifetime value metric. That metric continues to be resilient for you and continues to slope upward. Maybe going back to the basics, can you help us understand sort of what's going in that metric and maybe what the most sensitive drivers are that are in there that we're underestimating and that continue to outperform for you for that number to breach the $20 million mark?
Yeah, sure. Well, maybe the simplest answer would be everything goes into lifetime value. If you purchase something from Palo Alto Networks, it could be hardware, it could be virtual, it could be maintenance and support, it could be subscription services, is going to count inside the lifetime value metric. Which is one of the reasons why we talk about the multiple of your initial purchase. Somebody earlier asked about ASPs, if you look at the multiple of initial purchase, it's really that and continues to grow over time. As far as the other part of the question about what might be less evident, if you will, inside of that, maybe I'll turn it over to Steffan and see if you have any thoughts on that one.
Yeah, I think as our platform resonates with customers and they're looking to adopt all of our subscription services, all of the new hardware, we have this dynamic where the expansion value of an opportunity once we acquire the customer dwarfs the initial purchase. Our customers continue to come to us and say they want less security vendors in the space. They're looking for a consolidated platform. The fact that we have a great innovation engine going on at the company, we're coming out with subscription services and products that customers want to buy, that's playing right into the wheelhouse of where the industry is moving. It's platforms are winning over time. We believe we have the best platform, and those are the key drivers.
Yeah, there's probably a dozen different places in a large enterprise that we can sell our use cases to. We're constantly looking to pull more arrows from our quiver, and which we've certainly done with amazing innovation over time. We can do that in multiple places within the enterprise. With the right account coverage, we're looking to continue to expand at all times.
Thank you. We'll go next to Erik Suppiger from JMP.
Yeah. Steffan, good luck with retirement. Great working with you. My question has been, as you look into 2018, how do you see the expansion into cloud services progressing? What kind of adoption did you see in Q4, and how do you plan to position the company for that in 2018?
Sure. Hey, Erik, it's Mark. We saw very strong adoption in cloud, and in cloud, there's a number of things inside of there. One is the VM-Series. We've seen lots of strong customer adoption. That's a good-sized business for us as well that keeps growing at very rapid rates. We also saw good adoption from Aperture, which is our CASB offering. We'll throw that into cloud category as well because I think customers they do that. Then the third thing of the services we just announced on the logging service and the GlobalProtect as a cloud service as well, will also add into the ability to serve use cases into the cloud for customers. We'd expect good adoption over time from that as well. Very good.
Thank you. We'll take our final question from Karl Keirstad from Deutsche Bank.
Thanks. Maybe given I'm last, I'll squeeze in two. One is, Mark, on the federal government side, we've heard from Juniper and most recently Ciena this morning about some expected softness in the federal government side. Obviously, they're big quarters right now. Your guide for Q1 doesn't seem to reflect weakness, but I'm just curious what you're seeing there. If I could squeeze in a second, it seems like Palo Alto is replacing John as the head of U.S. sales, and I'm wondering if you could put that in context, and is that sort of the last big piece on the sales leadership front as you close on your reorg? Thanks so much.
Sure, Karl. This is Mark M. I'll take the Fed question and give Mark Anderson the John Skoudis question. On the Fed side, just as a big picture item, we're a very well-diversified company from a revenue perspective, no vertical and many quarters representing more than 12%-14% of revenue, which is good because verticals go up and down, obviously, in sentiment and spending patterns. Fed's been a very good business for us for a long time. We'd expect that to be the case in the future, but I believe that there's a lot of uncertainty in the Fed space right now, giving budget anxiety.
If you just pick up a paper, you can read about whether we're going to have a budget, a continuing resolution, and I think that is cast a cloud over what's going to happen from a spend perspective, unfortunately, into the end of the Fed year for spending, which ends in September, as you know. We've taken all that into account from a guide perspective, and we hope there'll be more clarity in that space in the not too distant future, but we're watching like everybody else. I'll turn the other question to Mark.
Yeah, sure. Karl, with regards to Skoudis, he was with us for over four and a half years, gosh, what an incredible job he did building the business. He came to us over a year ago and said that, mostly for family health reasons, he wanted to shut it down at some point, just in a move of incredible character, said, "What would be the best time for Palo Alto Networks?" As we went through our transition challenges in the second quarter, John was there leading the changes and really driving that, finished up with a really good strong Q4, just hats off to him. I've known him for 25 years, he's a good friend and a tremendous guy, he deserves to take a rest, which I know he's going to do.
With that much time, we were able to do, I think, a good discreet search and spent a lot of time with Patrick Blair. Patrick comes with incredible credentials. He's a good guy, great culture fit. He's inheriting a team that's just got incredibly strong bench strength and a lot of tenure in the senior leaders of that team. We're excited about what Patrick brings to the mix. Patrick's got scale, managing thousands and billions, which is important for us as we look to our future. He had an incredibly warm welcome at our SKO last week, I think people are excited to have him on board because he's got a great reputation here in the Valley.
Okay. Thank you both.
Yep, great.
We're going to quickly wrap up. Before I turn it over to Mark, I know we gave you a lot of modeling information today. By practice, we post our script to the website as soon as we hang up this afternoon, so please do go look for that information because there's a lot of detail in there that I think you'll find helpful both for Q1 and for the full year. With that, I'll turn it over to Mark.
Yeah. Thanks, Kelsey, and thanks again, everybody, for joining us on the call today. As Kelsey mentioned in the opening remarks, our Investor Day will be September 27th in New York. We hope to see everybody there. Appreciate your time on the call. Bye-bye.
That does conclude today's conference. Thank you for your participation.