Good day, everyone. Welcome to the Palo Alto Networks fiscal second quarter 2016 earnings conference call. Today's conference is being recorded. At this time, I'd like to turn the conference over to Kelsey Turcotte, Vice President of Investor Relations. Please go ahead.
Great. Thank you very much. Good afternoon. Thank you for joining us on today's conference call to discuss Palo Alto Networks' fiscal second quarter 2016 financial results. This call is being broadcast live over the web and can be accessed on the investors section of our website at investors.paloaltonetworks.com. With me on today's call are Mark McLaughlin, our Chairman, President, and Chief Executive Officer, and Steffan Tomlinson, our Chief Financial Officer. This afternoon, we issued a press release announcing our results for the fiscal second quarter ended January 31st, 2016. If you'd like a copy of the release, you can access it online on our website. Before going further, I want to acknowledge the inadvertent posting of our earnings press release on our website earlier this afternoon. We have identified this as a manual error and will remediate accordingly so it does not happen again in the future.
We'd like to remind you all that during the course of this conference call, management will make forward-looking statements, including statements regarding our financial outlook for the fiscal third and fourth quarters of 2016, the spending environment and market opportunity for our products, subscriptions, and services, investment in and increasing demand for our products and subscriptions and services from both new and existing customers, trends in certain financial results and operating metrics, our revenue, billings, deferred revenue, and free cash flow growth rates, sales productivity, seasonality, operating leverage, ability to expand market share and deliver profitability, hiring expectations, expansion of our partner ecosystem, product and services development, and our competitive position. These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements.
These forward-looking statements apply as of today. You should not rely on them as representing our views in the future. We undertake no obligation to update these statements after this call. For a more detailed description of factors that could cause actual results to differ, please refer to our quarterly report on Form 10-Q, filed with the SEC on November 24th, 2015, and our earnings release posted a few minutes ago on our website and on the SEC's website. Also, please note that certain financial measures we use on this call are expressed on a non-GAAP basis and have been adjusted to exclude certain charges. For historical periods, we've provided reconciliations of these non-GAAP financial measures to GAAP financial measures in the supplemental financial information that can be found in the investor section of our website, located at investors.paloaltonetworks.com.
For planning purposes, we expect our fiscal third quarter 2016 earnings conference call to be held after the market closes on Thursday, May 26th. We'd also like to inform you that we will be presenting at the JMP Securities Technology Conference on February 29th, the Morgan Stanley Technology, Media, and Telecom Conference on March 1st, the Pacific Crest Emerging Tech Conference on March 1st, the Raymond James & Associates 37th Annual Institutional Investors Conference on March 8th, and the Piper Jaffray Securities Symposium on March 9th. In addition, we'd like to invite institutional investors and sell-side analysts to join an investor track at Palo Alto Networks Ignite Conference at the Cosmopolitan in Las Vegas. Our program will start with lunch at noon on Monday, April 4th. Formal presentations will kick off at 1:00 P.M. Pacific Time.
While the event will be webcast, guests who attend in person are invited to stay for our user conference, which will run through Wednesday, April 6th. To register, please email Shane at sz@paloaltonetworks.com or call him at 408-638-3200. Finally, at the conclusion of today's conference call, we will be posting our prepared remarks to our investor relations website under quarterly results. With that, Mark.
Thank you, Kelsey, and thank you everyone for joining this afternoon. I'm pleased to report that we had a very strong fiscal second quarter. In the quarter, revenue grew 54% year-over-year to a record $335 million. Billings grew 62% year-over-year to $459 million. Free cash flow grew 93% year-over-year to $136 million. We reported non-GAAP earnings per share of $0.40. I'm very proud of our results for the quarter and the team's continued hard work in delivering on our mission to secure the digital age. Security remains a top strategic priority for global enterprises and organizations, as they've realized that without a significantly improved security posture, it is likely that the productivity gains from the digital age are at risk.
With this backdrop, it is evident from our results that we continue to capture mind share and market share at very high rates as we become the primary go-to security partner for enterprises globally. There's a paradigm shift underway as legacy point products that are primarily reactive are rapidly giving way to our next-generation platform that not only provides superior proactive security, but also simplifies networks and reduces the total cost of ownership. We are unique in having this platform, and as a result, customers are standardizing on Palo Alto Networks as their security architecture. We see this in new customer additions, continued strong lifetime value growth, and rapidly accelerated adoption of our subscription services. In Q2, we added close to 2,000 new customers and are proud to now be serving over 30,000 customers across the globe.
Some examples of wins in the quarter include becoming the advanced endpoint protection standard for one of the world's largest consulting and business services companies, where we replaced McAfee, replacing Check Point in a very large U.S. retailer for both data center and in-store security, beating Cisco as a standard for company-wide security at one of Europe's largest agricultural producers, as well as at one of the Middle East's largest government agencies. Our technology differentiation and best-in-class customer satisfaction is also reflected in the continued expansion of customer lifetime value. To make our top 25 customer lifetime value list in Q2, a customer had to have spent a minimum of $11.4 million in lifetime value, compared to $7.4 million in the prior year period.
As an indication of the rapid expansion inside our customer base, 24 of our top 25 customers made a purchase in the quarter as they continued to invest in the complete platform. The consistent increases in lifetime value demonstrate that not only are customers adding more of our products into their architecture, they are also quickly accelerating adoption of the recurring revenue subscription services that maximize their prevention posture. The result is strong momentum across our hybrid SaaS model. For example, as of the end of the second quarter, we now have over 9,000 customers use WildFire, including over half of the Fortune 100. We saw the fastest ramp in sales in our history for a new service on our platform with AutoFocus.
We had another very strong quarter and our largest quarter ever for Traps, where sales and new customer additions continue to validate the power and prevention capabilities that come from our platform approach with protection at all stages of the attack life cycle, from the network to the endpoint. We continue to expand our presence in the data center and service provider market with both our PA-7050 chassis as well as our new PA-7080 chassis. We also had the largest quarter to date for Palo Alto Networks' addition for NSX, the joint solution of our VM-Series and VMware's NSX. Our success here demonstrates our unique platform capabilities in the cloud, and as we mentioned last quarter, we now serve well over 1,000 customers who utilize our VM-Series offering.
We substantially expanded our presence within an existing customer, a large financial services company, where we became the security standard for their software-defined data center strategy, in which almost all of our services were adopted. Our plan to drive high growth, capture market share, and have all companies adopt all of our platform capabilities is working. In fact, in Q2, we saw faster adoption of the subscription services capabilities of the platform than we anticipated, and our second-half pipeline review at this stage indicates continued strong adoption of our entire platform, especially subscription services. Very few companies have been able to sustain this level of growth at our scale, and we know the effort it takes to deliver results that consistently outpace the competition. Our go-to-market capabilities and demand generation, field marketing, sales, partnerships, and customer support are world-class.
I was particularly pleased and proud of the fact that in the second quarter, we were recognized by J.D. Power and the Technology Services Industry Association for exceptional support services. Further evidence of the team's commitment to delighting our customers, which result in a strong competitive advantage for us as we displace existing legacy providers globally. We continue to expand our partner ecosystem, including our recent announcement with Proofpoint, where we have teamed up to share intelligence on sophisticated attacks, enabling the creation of automated and coordinated protection across our next-generation security platform and Proofpoint's targeted attack protection and social patrol capabilities. As we look forward, we know there is concern in the macro environment.
While we do, of course, monitor that closely, some observations early in the quarter are that our customers continue to indicate that security is a strategic issue and hence a priority spend category in calendar 2016. Our pipeline is at a record high. Our executive briefing center continues to run at very high capacity. Our partners and sales teams around the world are well-trained and proving that a true platform allows customers to not only have a superior security posture, but also superior ROI total cost of ownership savings, since the platform simplifies their network and results in fewer vendors. Also, I'd like to welcome Frank Calderoni to our board of directors.
With more than 30 years of business and financial experience, including his current role as Executive Vice President of Operations and Chief Financial Officer at Red Hat, as well as his previous role as CFO of Cisco, Frank brings a wealth of experience and a unique perspective to the board, and we're very happy to have him. We look forward to seeing you at RSA next week and at Analyst Day in early April. With that, I'll turn the call over to Steffan. Steffan?
Thank you, Mark, and thank you all for joining us. I'll start by first covering the results for Q2. We'll describe the business trends and the financial model. We'll conclude with Q3 guidance and modeling points. I'd like to note that except for revenue figures which are GAAP, all financial figures are non-GAAP unless stated otherwise. Q2 total revenue grew 54% over the prior year to reach a new record of $334.7 million. The geographic mix of revenue for Q2 was 68% Americas, 19% EMEA, and 13% APAC. Compared to the prior year, the Americas grew 56%, EMEA grew 38%, and APAC grew 67%. We saw broad strength across a wide range of verticals and did not have any end customer concentration. The three components of our hybrid SaaS model, product, subscriptions, and support, all grew well in Q2.
Q2 product revenue of $169.9 million increased 47% over the prior year. Growth was healthy across our product portfolio. In particular, the PA-7050 and PA-7080 chassis continued to help accelerate growth in the high-end data center market. Recurring services revenue of $164.8 million increased 62% over the prior year and accounted for a 49% share of total revenue. Looking at the two components of recurring services revenue, the first component is our SaaS-based subscription revenue of $84.3 million, which increased 68% over the prior year. Support and maintenance revenue, the second component of recurring services, was $80.5 million, an increase of 55% over the prior year. Billings in Q2 were $459 million, an increase of 62% year-over-year. Total billings for the first half of fiscal 2016 were $847 million and grew 62% year-over-year.
First half product billings were $315.3 million and grew 44%, accounting for 37% of total billings. First half support billings were $250.4 million and grew 72%, accounting for 30% of total billings. In first half, subscription billings were $281.3 million and grew 77%, accounting for 33% of total billings. Renewal rates remain high, and contract duration modestly increased to just over two years. Total deferred revenue grew to $928.8 million in Q2, an increase of 73% year-over-year and 15% sequentially, underscoring the power of our hybrid SaaS model and increasing visibility into future revenue streams. Total gross margin for Q2 was near the high end of our target range at 77.2%, a decrease of 60 basis points compared to last year, and a decrease of 70 basis points sequentially. Product gross margin was 76.4%, a decline of 70 basis points year-over-year and 30 basis points sequentially.
The sequential decline was due in part to product mix. Over time, we expect there will be fluctuations in product gross margin. Services gross margin for Q2 was 78.1%, a decrease of 60 basis points year-over-year and 90 basis points sequentially. The sequential decline was due in part to investments in WildFire and AutoFocus, as well as customer support. Total headcount at the end of the quarter was 3,343, up from 2,998 at the end of the prior quarter. We continue to thoughtfully add talent across the business as we scale to support our growth. For the quarter, research and development expense was 11.2% of revenue, increasing approximately $3.5 million sequentially to $37.5 million. The increase was primarily due to headcount. Sales and marketing expense for Q2 was 43.7% of revenue, increasing approximately $16 million sequentially to $146.1 million.
This was primarily due to our strong Q2 billings performance and the associated sales commissions. G&A expense for Q2 was 5.4% of revenue, increasing approximately $400,000 sequentially to $18.1 million. In total, Q2 operating expenses were $201.7 million or 60.3% of revenue. Q2 non-GAAP operating margin was 16.9%, representing growth of 450 basis points year-over-year and 20 basis points sequentially. Net income for the quarter was $36.3 million or $0.40 per diluted share using 91.7 million shares, compared with net income of $16.9 million or $0.19 per diluted share in Q2 2015. Our effective non-GAAP tax rate for Q2 was 38%. On a GAAP basis for the second quarter, net loss was $62.5 million or $0.72 per basic and diluted share. This compares with the Q2 2015 GAAP net loss of $43 million or $0.53 per basic and diluted share.
We finished January with cash equivalents and investments of $1.6 billion. Cash flow from operations, free cash flow and free cash flow margin for Q2 were $153.8 million, $136.4 million and 40.7% respectively. Capital expenditure in the quarter totaled $17.4 million. The accounts receivable balance was $254.4 million in Q2, up from $196.4 million in Q1. DSOs decreased sequentially by one day and increased year-over-year by nine days to 61 days. With the Q2 recap completed, I'm now going to provide some perspective on the momentum we've been seeing in the business year to date and an update to our target model for exiting Q4 fiscal 2016. We have been, and we remain committed to driving growth and profitability. The growth engine has never been stronger, as evidenced by new customer additions, expansion in current customers, and continually increasing sales productivity.
Billings, revenue, and deferred revenue are very robust and have far exceeded the rate of the market growth and our competition. With our hybrid SaaS model, we have delivered top-line growth with expanding non-GAAP operating margins and generated significant free cash flow. Customers are increasingly buying all elements of our platform, which has been our strategy and has long-term benefits for our financial model. As a result, we're in a good position to exceed our internal sales expectations, particularly in the rate of services adoption, which you can see in the billings mix, which is now 63% of services for the first half of fiscal 2016, compared to 58% for the first half of fiscal 2015. Over-performance in billings, which drives the mix towards ratable services, means higher deferred revenue and higher free cash flow.
It also means incurring 100% of the commissions expense in period against the higher ratable revenue, as a result, slower near-term growth rate of non-GAAP operating margins and EPS. As we head into the second half of the fiscal year, our pipeline is at record levels and indicates strong year-over-year growth in product billings. With a faster rate of subscriptions adoptions, the pipeline indicates continued over-performance in services billings relative to our original forecast. For this reason, we're making two updates to our full year guidance. First, given the timing mismatch of higher services billings and ratable revenue with higher in-period commissions expense, we now expect to exit Q4 at approximately 18%-19% non-GAAP operating margin, which represents approximately 400-500 basis point increase year-over-year.
Because of the over-performance on billings, we are increasing free cash flow margin estimates to approximately 40% for Q3 and Q4 of fiscal 2016.
We continue to refine our target model, which will call for increasing our long-term profitability targets. We look forward to sharing it with you at our Analyst Day on April 4th. With less than 10% market share in an $18 billion total addressable market, barring any systemic macro issues, we are well-positioned to continue to deliver strong top-line growth and profitability. Now, turning to the fiscal third quarter guidance and modeling points. We expect revenue to be in the range of $335 million-$339 million, which represents 43%-45% growth year-over-year. We expect non-GAAP EPS to be in the range of $0.41-$0.42 per share using 90 million-92 million shares. We are starting to see some moderate seasonality in our business with fiscal Q2 and Q4 showing our strongest sequential revenue growth.
We continue to expect CapEx for fiscal 2016 to be in the range of $85 million-$90 million, which includes investments in infrastructure, cloud services, and facilities to support the growth of our business. With that, I'll turn the call back over to the operator for Q&A.
Thank you. The question and answer session will be conducted electronically. If you would like to signal with a question, please press star one on your touch-tone telephone. If you're joining us today using a speakerphone, please make sure mute function is turned off to allow your signal to reach our equipment. Also, please limit yourself to one question and one follow-up question. Once again, that will be star one if you'd like to ask questions. Our first question comes from Sterling Auty with JPMorgan.
Yeah, thanks. Hi, guys. I know you mentioned the momentum in the business, but you're right, everybody's very concerned about the macro. Can you give us maybe a little bit of color by some of the major theaters, Europe versus North America? Are you seeing any lengthening sales cycles or anything else to be concerned about from the macro side?
Hey, Sterling, it's Mark. A couple anecdotal points there. One, in the quarter itself, we have January in the quarter. The linearity for the quarter was exactly the same as historical precedents, so we didn't see anything happen in the quarter that would raise any concern around that. I travel around all the time myself globally. I had the chance in January to be not only in Europe, but in Asia as well. All the places that I went to, the customers that I talked with said that security remains a priority spend item for them as well. We haven't seen anything to indicate that what we're seeing in the stock market means anything about the macro economy yet, but we watch that closely.
Got it. One follow-up. On the product gross margin, can you maybe give a little bit more color there? You mentioned the mix. In the prepared remarks, you were kind of highlighting the higher-end solutions as having particular strength. I would expect that to be good for product gross margin.
It is good for product gross margin. Remember, as I've highlighted in the past, whenever we come out with a new chassis or a new product, there's usually a slightly depressive effect on near-term product gross margins because we haven't achieved volume, so costs are a little bit higher than they will be on a go-forward basis. That's definitely true with the 7080, which was introduced a relatively short time ago. Even though we saw a very strong contribution from our higher-end products, there was a slightly depressive effect until we get to scale.
Our next question will come from Karl Keirstead with Deutsche Bank.
Thank you, Steffan. If we could go to the 4Q operating margins and the decision to lower the guide somewhat. I just want to make sure I understand. I feel like Palo Alto Networks has been over-performing on the billings actually for several quarters now, and you've been able to meet roughly the non-GAAP operating margin guide and expectations. What's changing in 4Q? Is it that you expect a particularly strong billings performance as a result of a good subscription attach, or maybe is some other element in the model changing that sort of didn't give you the lever to offset it? Maybe a little color would be helpful. Thank you.
Sure thing, Karl. What we're seeing is customers adopting all elements of our platform, which is very positive for us. In fact, the attach rate concept that we've introduced over the last few years is becoming less and less relevant, mainly because now we have seven subscriptions that we are selling, and three of the newest ones are Traps, AutoFocus, and Aperture. With the adoption of the overall platform, we are looking at outsized billings numbers, and that's driving incremental billings. Because those subscription services are effectively deferred revenue and they become ratable revenue, we have 100% of the commissions that we are getting in period. With the mix shift happening, that's what you're seeing.
Kind of bridging from, call it 22% at the low end of our range to roughly 18%-19%, the vast majority of that is commissions, and there's a little bit relative to the mix.
Okay. Helpful color. Thanks a lot, Steffan.
Yep.
Our next question will come from Rob Owens with Pacific Crest Securities.
Great, thank you for taking my question. If we look at the billing strength, you did see a shift to more long-term contracts. Is that just a function of the environment right now, people are locking in? I would think, given the speculation of weakening things will be going the other way. Just a little color, and I realize it was a modest extension duration, but your long-term did show some nice outperformance relative to expectations.
While we are seeing customers standardizing on our platform, they want to go with multi-year. The net effect of that for contract duration was actually very de minimis. It's just a modest uptick. If you look at the actual dollar growth from a short-term deferred revenue standpoint, short-term deferred actually grew more in terms of dollars than long-term. We're seeing a nice pickup in both short-term and long-term. To your broader point.
Customers want to standardize on the platform of choice, and they want to be locking in for a number of years. That's all good for us.
Yeah, Rob, this is Mark. That's exactly what we've always wanted to occur, and we hope to continue to drive that in the business where folks are making these architectural decisions with Palo Alto, and I think the market's really starting to realize that the more the prevention capabilities that they adopt, the better the prevention gets, and you can see that with the growth of the subscription services.
For my follow-up, just want to touch on the partnership with Proofpoint, and I guess at a higher level, the concept of threat intelligence and where you guys are sharing back and forth. Is there an opportunity for you to monetize some of this threat intelligence, or as a solutions vendor, is it a given that your product should inherently lever this knowledge to increase efficacy?
That's a great question, Rob. I get that from customers all the time. Big picture is the way that we monetize intelligence is in the platform itself, meaning the platform is a high proactive prevention capabilities, and the more intelligence we have in the platform, the better job we do with that. With that in mind, we have an insatiable desire for threat intelligence and being able to partner up with Proofpoint to have everything they're seeing from an email gateway perspective is beneficial for us and vice versa for them. Really interesting, when I'm talking to customers, I have a lot of customers who telling me that they think the day of security vendors trying to monetize intelligence is long over, and they're very upset with security vendors who come in and try to sell them intelligence as a service where they're trying to monetize that.
I think that's going to change pretty rapidly into the future, where you just better be able to take intelligence and put it in your platform or your product and do something with it for the customer, and that's where the value proposition will lie.
Our next question will come from Michael Turits with Raymond James.
Hey, guys. Obviously, with that mix shift, you've less than the expected EBIT margin on the exit rate, but really strong guidance at the 40% of free cash flow margins. Two questions. One, if we look out long term, and I know you said that you'd address that at the Analyst Day, do we return to reasonable amounts of growth in the EBIT margin? Also, is there anything unusual in those 40% free cash flow margins, or is that sustainable, and is that something we should see expansion in?
Well, as we indicated in the prepared remarks, longer term, this business will generate much higher EBIT margins, as we call them, operating margins here, over the longer term, for sure. What the dynamic that you're seeing now is given that there's more adoption of services and you have higher services billings because of the commissions expense being hitting in period, as the revenues coming off the balance sheet, that's going to be accretive to margins down the road. This will be a building margin story. I think one of the most important things which you highlighted, Michael, is we just grew free cash flow 93% year-over-year, and we're basically looking at very high free cash flow margins. Many companies have a correlation, a near-term correlation between operating margin and free cash flow.
If operating margins are coming down on a growth rate basis, free cash flow typically comes down. That's not the case with Palo Alto Networks. Because of our powerful hybrid SaaS model, we are actually delivering much more free cash flow than operating margin, and we feel very good about the overall growth engine in the business.
As you said, just by the follow-up, just to clarify anything, it's strong, but as we look forward, is there anything that is one time of nature in those 40% free cash flow margins? Maybe what happens with cash taxes? How should we think of that trending over time to the extent you can help us out there?
Yeah. We'll give you more color commentary on the convergence of free cash flow margin and operating margin over time. For the foreseeable future, call it the next at least three years, there should be a pretty wide separation, positive separation between free cash flow and operating margins. Over time, those numbers will converge because we will become more of a cash taxpayer, and that plus a couple of other things will see the spread narrow. For the foreseeable future, there should be a pretty wide spread between free cash flow and operating margin.
Michael, it's Mark. There's no one-time aspects in the free cash flow numbers you're looking at right now.
Our next question will come from Andrew Nowinski with Piper Jaffray.
All right, thanks a lot, and congrats on the nice quarter. Maybe just to start, I had a question on product revenue. It was up 47% year-over-year, which was not only an acceleration from last quarter, but also one of the strongest growth rates we've seen with the exception of fiscal Q4 of last year. Your total customer count continues to go up by about the same amount in that 2,000 range. Is product growth coming from a hardware refresh cycle within your install base, or are they just purchasing more of your products within your platform?
Yeah, Andrew. You can see product growth or platform growth generally, and product growth since that was your specific question is going to come from a number of areas. One is continued customer acquisition. You saw almost 2,000 new customers. That's a great land engine for us, and that continues to drive the entire platform, including products. That's very healthy. The second thing is expansion inside the existing customer base. As we get bigger and bigger, more and more of our business will come from expansion opportunities in addition to the land opportunities. Expansion is going very nicely as well. The third is we're growing a very large base of business here as far as customers all with products and all of whom at some point will refresh those things.
When we think about what that can look like into the future using sort of a five-year rule of thumb on refreshes, that would take us back basically to the 2011 cohort. If we add up 2009, 2010, 2011, it's about 4,000 customers total. Across those three cohorts, which means there's 26,000 more after 2011. When we throw in close to 2,000 customers a quarter on top of that's a gift that just keeps giving into the future.
Great. Thanks. Just a follow-up. If we go back to your comments in fiscal Q4 of last year, you said that Traps would be a material contributor to revenue in FY 2016. I'm wondering if you could put any parameters around that in terms of what we should expect now that we're in the back half of the year.
What we said was we thought it would be a more material contributor to the overall business, we've seen that. We've seen a record quarter for Traps in terms of billings. However, because it's a subscription-based revenue model, revenue will be coming off the balance sheet, coming into the P&L. That is more of a future growth driver for top-line revenue. It's definitely been a more meaningful growth driver for billings, but it's coming off of a relatively small base. We feel very good about the endpoint business. It helps complete our platform story. We'll give you more color at Analyst Day about customer counts and that sort of thing, but there's been very nice traction there.
Moving on to Philip Winslow with Credit Suisse.
Guys, this is Sithi Wanigaratne for Phil. Congrats on another awesome quarter. I just wanted to drill into the subscription business. Good to see solid growth there. Last time you gave subscription attach rate around $2.2. Wondering if you have any update on that, what you are seeing there. Also, one of your new subscription, just wondering what kind of feedback you are getting on AutoFocus. That'll be great.
Yeah, great. This is Mark. On the attach rate side, attach rates are good and growing. We'll give you more color around that at Analyst Day in about 35 days or so, the attach rates continue to do very well. On the new services, which are in the order of the history there, Traps, AutoFocus, and Aperture. Traps, Steffan just spoke to, continues to do very nicely for us. AutoFocus, you may have heard I mentioned in my prepared remarks. We've enjoyed the fastest sales ramp in the history of the company for a new service with AutoFocus. There's great demand for that and a very strong pipeline for Aperture as well as people continually get interested into the CASB space for third-party applications. Just one hearkening back to the attach rate thing as well, we'll discuss this in more detail at Analyst Day.
As we continue to have more services that don't have attach rates on them, we'll talk through how that impacts the concept of attach rates, which I think become increasingly irrelevant to the business over time. We're thinking more in terms of billings or subscription billings on those services because it's how much dollars it comes in, it really matters.
Got it. Thank you.
Our next question will come from Matthew Hedberg with RBC Capital Markets.
Yeah, guys, thanks for taking my questions. Another one on Traps. It sounds like there was a nice McAfee AV replacement in the quarter. I'm curious, do customers normally replace their antivirus solution completely with a Traps install? I'm wondering if you could talk about the drivers for adoption versus legacy solutions. Is it cost? Is it better prevention or maybe a combination of the two?
Matt. It's way more about security than it is about cost. Folks are more and more realizing that if you're thinking about security and prevention, which is what they want to do, where the data is, a lot of data's at the endpoint, and that's one of the easiest ways to get into the network as well as AV continues to be less and less relevant there for them. On your first question, folks, I think more and more want to replace AV, not because they so much want to get rid of AV, but they just want to have security that would actually work for them. In the cases where we've seen people who said, "I have to have or really want to have AV," it's become more and more places that have to do that for compliance reasons or audit reasons.
They're doing something additive on top of that. The primary driver there is security. The other interesting thing that we hear a lot, and it's really analogous to where we started in the firewall space, and then all the other components that made their way into networks over time because stateful inspection firewalls weren't working for them as they built more and more complexity in the network, is the same thing on the endpoint. People are not interested to add one more agent onto the endpoint. They have a lot of them there. The same kind of simplification for better security that would result in better total cost of ownership, but primarily simplified on the endpoint with better security is a driver, and it's very analogous to what we saw when people said, "Hey, I don't want firewall plus, plus, plus," right?
They want the simplicity of network and better security. It's working just on the endpoint as we thought it would, and we have a lot of experience in selling that kind of concept from our network genetics.
That's great. Mark, I think you called out the PA-7080 box in the prepared remarks. Could you talk about some of the performance benefits there versus some of the other high throughput boxes? How are yours holding up under pressure or under increased traffic now that you've got some more history there?
Sure. The PA-7080 for, so everybody knows, that's our latest chassis. It's a 200 gig throughput, and it has 10 slot cards in it, right? That's what it looks like. And it's pretty exciting in the data center and service provider space because it is very high throughput. But even more important than the high throughput, it has all of the security capabilities that Palo Alto Networks is known for now from a prevention perspective. You get the best of both worlds with all those prevention capabilities and increasingly a higher throughput with none of the degradation of performance that you get with stateful inspection firewalls when you have to turn on various concepts that really reduces those throughputs.
One of the favorite angles for our competitors is to talk about faster and faster stateful inspection firewalls, partially because they have to, because every time you turn on one of these other cobbled-together capabilities for IPS or filtering or APT or something like that, it seriously degrades the performance in the first place. That's something that we don't experience because we have a single throughput engine. We've gotten really high marks in the market so far for this.
Moving on to Keith Weiss with Morgan Stanley.
Hi, great. This is Melissa Gore. I'm calling in for Keith. Mark, I just have a high-level question. The growth is clearly pretty impressive or very impressive on the billings line. As you look across the universe, it seems like some of your peers are seeing decelerating growth. It does seem as though potentially, your share gains are accelerating. Is that the right way to think about it? How much runway do you think that you have in terms of share gains within the core network security market?
Yeah. It's a great question, Melissa. A couple of angles or ways to think about that, or at least the way we think about that. If you start with the size of addressable market, as you know, it's very big and, us at high single digits still or about 10% market share, there seems to be a lot of runway from an addressable market opportunity capture perspective. Inside of that, who's capturing what, right? There's money here. It's up for grabs. I did a simple math experiment the other day just because I saw some third-party numbers on market share, and they tend to be kind of confusing to me because it's really hard to tell who's doing what there. What I did was I took five vendors, Palo Alto Networks, Cisco, Check Point, Fortinet, and Juniper.
Using the last calendar reported quarter, meaning this one for us in their fourth quarter, short of it in the fourth quarter, I added up the year-over-year increase in revenue across all five of those vendors. The total amount of new revenue across all five of those vendors was about $300 million. That's the total pie that everybody added. Inside of that, Palo Alto is about $120 million of the $300. The average is roughly $58 if you did the math. We were about $120 of that. I can give you the other numbers if you care about that, but I think it's very obvious that we're taking share from everybody in the space in order for those kind of numbers to work out that way.
Okay. That's really helpful. Just one quick one on the federal opportunity. There's definitely more of a push from the administration on enacting cybersecurity laws and also incorporating more into the budget, and I know there's nothing necessarily concrete today, but can you just give us a high-level overview of what you're seeing in terms of federal traction and then what you're expecting in terms of growth?
Yeah. Our federal business is good and growing. It's a market we like a lot, not surprisingly given what our technology does and what the government more and more needs and recognizes they need. A couple things that are interesting, I think you're noting that recently President Obama came out and called for a 40% increase in cybersecurity spending. We'll see what happens with that. That's a request, not an order, right? We'll see what happens with that. Obviously, if there was that amount of spending there, it's $5 billion of additional dollars if it comes into the federal budget, specifically for cybersecurity. On the same day he announced that, the Director of National Intelligence said that cybersecurity is the number one national security issue facing the United States.
I think the amount of attention from the government on cybersecurity is very high, could even be higher. More interestingly than that, they're really trying to put their money where their mouth is here with some of these announcements of what we have to do to take legacy architecture across the federal space and get it into next-generation platforms that can really do prevention.
The next question will come from Ryan Hutchinson with Guggenheim.
Great. Thank you. Steffan, my question's on billings. I know you don't give guidance, but one way to look at it is as a percentage of revenue. It stands at 137%, which is the second highest ever, outside of Q4 of last year. Given we're going into the seasonally weak period, obviously offset by some subscription attach rates and this platform play you've alluded to, is this trend sustainable? Any color there would be helpful because basically you can look at this one of two ways. If it trends back towards more of an average of where you've been over the last eight quarters, billings will be down sequentially. You look at the other way, it trends flat to slightly flattish, let's call it. Billings actually could be flat to slightly up. That would be my question.
Okay. Yeah. Because we don't guide on billings, I can just give you directional commentary. It would be candidly be a surprise to us if we went backwards on billings on a sequential basis. The power of the platform, the pipeline that we have, you look at how the setup is for Q3 and Q4. Even though we're in a relatively seasonally weak quarter in Q3, we are still looking for growth. That would be my answer. I can't give you a rule of thumb relative where billings and revenue is, but with more subscriptions being adopted, and I'll parse that out, more being attached and then more of the three subscriptions that we're selling without being attached, there should be good growth there.
Okay. It'll grow sequentially is what you're telling us.
Directionally.
Thank you.
The next question will come from Erik Suppiger with JMP Securities.
Yeah, just first off on the duration, Steffan, can you give us a heads-up on where that was last quarter or the year-ago quarter?
Just shy of two years last quarter. I'd have to pull up with where the year-ago quarter was. We've been calling out that there's been a modest uptick in duration. Quarter-on-quarter, we're talking, it's measured by in a couple of months type of thing. Not a very big move up in duration.
Okay. On the services growth, is that driven more by the installed base going back and upselling, or is that equally driven by new products going into new customers?
It's a combination of both. What I can tell you is we've seen a fantastic opportunity going back into our install base, selling them more elements of the platform. They're adopting a lot more subscription services than they have in the past, both the ones that attach to the devices in the new subscriptions. Proportionately, given the fact that we have, call it 30,000 customers or heading into this quarter, we had about 28,000 customers, the pie is much bigger there than the new customers that are being brought into the fold. The expansion opportunity is definitely bigger than the new opportunity. The upsell and cross-sell that we are able to do is a testament to our go-to-market functionality that we put in place with Mark Anderson leading the charge there. We've been able to really put in programs to monetize the accounts.
Our next question will come from Jonathan Ho with William Blair.
Hey, guys. Congrats as well on the strong quarter. I just wanted to understand, you guys talked a little bit about strength in your NSX business, and I just wanted to get a sense from you or some additional color in terms of what may be driving this, as well as maybe what you're seeing in the data center market.
Hey, Jonathan. It's Mark. Yeah. Something we've seen for a while, and I've mentioned it before, is that when customers are thinking about security, they're thinking less and less around topology and more around data and prevention. What they want to do is make sure that they have as best a prevention posture as they can have wherever the data is. When you think about where is data going, more and more, a lot of it's going into public, private cloud environments, and next-generation data centers. When that's where it's going, they want to make sure it's secure. That's, I think, partially what's driving a lot of strength in NSX itself. With our relationship with VMware, with the integration of VM-Series in there, the better that they're going to do in that space, and they've been reporting pretty good numbers there.
That's a great opportunity for us as far as where we can hunt along with them to provide the security.
Got it. Can you talk a little bit about the investments that you're making on an international basis, whether you're sort of pleased with the performance that we're seeing out of EMEA and APAC and just sort of what you think those regions, the potential could be over time?
Yeah, we're pleased with the international performance. You can see, if I back away from that for a minute to just the North America, which is a continued powerhouse for us. It's fantastic to see a business the size of North America continue to grow at the rate that it's growing. I think that just shows how much demand there is still in a mature market for Palo Alto, a single-digit market share. When we look internationally as well, we're seeing strong international growth. You can see in our numbers there, we had a very strong quarter in APAC, quarter-over-quarter, or year-over-year, and we also had a good quarter in EMEA as well.
As we continue to make investments in various areas, we expect to continue to grow these businesses, and our market share in those markets is even lower than it is in North America today, so there's even more upside.
Our next question will come from Fred Grebe with Nomura.
Hey, thanks, guys. First up, going into RSA, can you discuss customer interest in WildFire versus Traps? I know for a few years, APT has sort of been a top priority for CSOs, but is there any chance you're seeing this shift towards the endpoint this year?
Hey, Fred. I'll make a prediction. It's RSA, and it's always dangerous to make predictions. I think you're going to see at RSA this year a lot more folks than just Palo Alto talking about prevention. Last year, we were talking a lot about platforms, and people came around to that thinking right away from a marketing perspective, and I think you're going to see a lot more people trying to market around prevention now that we've shown that that's the right approach to this philosophically. When you're doing prevention, you have to do it everywhere. Wherever the data is, as I was saying a little earlier. I think there will be a lot of focus and conversation around endpoints, given that prevention historically has been pretty weak there, and that's why people are adopting Traps so rapidly. I would expect that to be the case.
On the WildFire side, while thinking about advanced persistent threats and how do you take an unknown threat and turning it into a known threat, that's as relevant as it ever has been, and it's probably going to be incredibly relevant into the future because it's the unknown threats are the ones that are going to get you, and that's why people are adopting WildFire so rapidly as well.
Got it. Maybe can you provide a little bit of background on why it made sense to partner with Proofpoint instead of bringing to market your own solution?
Well, Proofpoint's an email, primarily email security company. They're sitting in front of an email server or a gateway with their technology, and that's messaging security. If you parse out the whole security industry, messaging security is separate from traditional network security. We're just in different markets with very complementary capabilities. Things that come through email are interesting to us from a threat perspective because sometimes it's the first place you see something, and there's obviously Phishing attacks and things like that. Getting the ability to gather the information from a threat perspective from somebody like Proofpoint and put it into WildFire makes WildFire very powerful.
On the flip side, for them as well, everything that we're seeing from endpoints and networks that are related to threats that they, in turn, can use to make their technology smarter about the threats as well, makes sense too. It's a very symbiotic relationship.
Next question comes from Gur Talpaz with Stifel.
Great. Thanks for taking my question. As customers migrate workloads into the public cloud, have you seen any sort of pickup in interest for the VM-Series for AWS? I guess more broadly speaking, following up, how do you feel about AWS and public cloud adoption more broadly impacting your business? Thank you.
Hey, Gur. It's Mark. Yeah. For AWS, I think we mentioned in the last call that we had Well, on this call, we mentioned we had over 1,000 of our customers and growing using our VM-Series. Start with that as sort of the baseline. The VM-Series capability in use and integrated at different places is growing well too, like NSX in a private cloud environment. I think last quarter we said we had over 100 customers currently using our VM-Series in AWS, that's growing too, and we'll update you all on those kind of things at Analyst Day. What we're seeing again is folks saying, "Where is my data? I need to protect it." We don't want security to be an inhibitor about where the data can be.
If it's going to the public cloud and workloads, a lot of times developers just put it up there and the security guy doesn't even know about it yet. Those are the kind of things that worry security people, so they want to make sure that they can secure those things. On the general question of AWS as a platform versus security, AWS is doing a lot and will do a lot to secure the platform itself. From a security perspective of things like applications and network connections back to the ones who are consuming this stuff, the enterprise who consume this stuff, that's not something that they do, and I doubt that they will, because that's where companies like Palo Alto Networks have spent a decade honing prevention capabilities, and that's why having our capability in AWS is very powerful.
Next will be Gregg Moskowitz with Cowen and Company.
Okay. Thank you very much. Mark, I'd like to go back to your comment on AutoFocus being the fastest ramp of any Palo Alto subscription. My understanding is it's sold per security operator, and because of that, I was always wondering, how big would this market be, and would it just be relevant to a fraction of your very high-end customers? Is the strength that you saw mostly a function of high ASPs, or are you also seeing pretty broad customer uptake out of the gate? Anything you can do to sort of help size the AutoFocus opportunity would be helpful.
Yeah, sure. If I back up for a second, just say for AutoFocus, list price for that is $35,000 a year per operator. Think of this as a tool that an operator would look at and get highly correlated, relevant intelligence that can give them things to do proactively about threats in their network based on everything we're seeing from 30,000-plus other networks today and growing. That's what it is, and that's the price point today. As I noted, that is the fastest-growing service we ever had, which is fantastic. I think the appetite for people to want to do proactive prevention is very high, and the ability to bring that kind of hardcore, correlated analytics to bear is interesting. It's been interesting to large companies and medium-sized companies as well. What we've seen so far in selling is that people understand it very quickly.
In the base of customers, large companies are going to have a lot more operators than small companies. We've seen and we expect to see some companies will buy one of them, from a license for one of them for one operator, and larger companies will buy multiple license for multiple operators. The early view on this is it's got a very wide applicability.
Our last question will come from Jayson Noland with Baird.
Okay, thanks for fitting me in. Mark, I wanted to ask about non-perimeter defense. Palo has a network segmentation gateway. Others have talked about their internal segmentation firewall. What are your thoughts on this market today, and what should we expect down the road?
Yeah, I think segmentation is very important, and customers want to do that, and I think they're going to try to do it, and rightfully should do it everywhere they can. They may do segmentation on the internal networks from a user perspective and segmentation of data on externally facing servers and data centers. That's a good idea. I really don't think there's any correlation between the two, from what are your needs internally versus what are your needs going to be externally. There's no correlation about doing more in one area is going to reduce your needs in others. It's just a good hygiene idea to do segmentation wherever your data is. The more they want to do it in your internal, that'll drive internal business. The more they want to do external, it'll drive the external business.
I wouldn't think of that as an either/or. I think of that as both.
Okay. As a follow-up, you mentioned the seven subscription modules earlier. In CAL 16, is the focus on ramping some of these newer modules versus launching new modules?
What you've seen us do in the past is be thoughtful. We think we're thoughtful. Hopefully, you would agree with this, but being very thoughtful from a platform perspective that does prevention as to what should be in the platform. We're not attempting to roll up the security industry just to have a lot of stuff. What we are trying to do is to make sure that when we think about the attack life cycle and every chance we can get to interdict an attack before it can ultimately be successful across a life cycle, can we have a very good and increasingly better and better prevention capability at every one of those points? That's really the philosophy that's driven the company and our entire roadmap over the last 10 years and will into the future.
I would expect that we will have more services later as the attack landscape changes, and we'll definitely want to make sure that we are wherever the data's going to be.
That does conclude the question and answer session. I'll now turn the conference back over to you for any additional or closing remarks.
Great. Well, thank you, everybody, for joining us this afternoon. I'm really excited about the future, and I'd like to thank our customers, partners, and the whole Palo Alto Networks team for their hard work and support in Q2. We look forward to seeing many of you at Analyst Day in April. Thank you.
Thank you. That does conclude today's conference call. We do thank you for your participation today.