Good day, welcome to the Palo Alto Networks third quarter 2015 earnings conference call. Today's conference is being recorded. At this time, I would like to turn the conference over to Kelsey Turcotte. Please go ahead, ma'am.
Great. Good afternoon, thank you for joining us on today's conference call to discuss Palo Alto Networks' fiscal third quarter 2015 financial results. This call is being broadcast live over the web and can be accessed on the investors section of our website at investors.paloaltonetworks.com. With me on today's call are Mark McLaughlin, our Chairman, President, and Chief Executive Officer, and Steffan Tomlinson, our Chief Financial Officer. This afternoon, we issued a press release announcing our results for the fiscal third quarter ended April 30th, 2015. If you'd like a copy of the release, you can access it online on our website.
We'd like to remind you that during the course of this conference call, management will make forward-looking statements, including statements regarding our revenue and earnings per share guidance for Q4 of fiscal 2015 and non-GAAP operating margin for Q4 of fiscal 2015 and Q4 of fiscal 2016, as well as our expectations regarding our growth, gross margin, seasonality, future investments, CapEx, leverage, profitability, cash flow, integration with recently acquired CirroSecure, new product and service releases, and competitive position. These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today, you should not rely on them as representing our views in the future, we undertake no obligation to update these statements after this call.
For a more detailed description of these risks and uncertainties, please refer to our quarterly report on Form 10-Q filed with the SEC on March 3rd, 2015, our earnings release posted a few minutes ago on our website. Also, please note that certain financial measures we use on this call are expressed on a non-GAAP basis and have been adjusted to exclude certain charges. We have provided reconciliations of these non-GAAP financial measures to GAAP financial measures in the supplemental financial information that can be found in the investors section of our website, located at investors.paloaltonetworks.com. Before I turn the call over to Mark, we would like to inform you that we expect our fourth quarter fiscal year 2015 earnings conference call will be held after the market closes on Wednesday, September 9th.
In addition, we will be presenting at the Stephens Annual Investment Conference in New York City on Wednesday, June 3rd, and the William Blair Growth Stock Conference in Chicago on Thursday, June 11th. In addition, at the conclusion of today's conference call, we will be posting our prepared remarks to our investor relations website under quarterly results. With that, I'll turn the call over to Mark.
Thank you, Kelsey, and thank you, everyone, for joining us this afternoon. I'm pleased to report that we had a great third quarter across all metrics with revenue of $234 million, up 55% year-over-year, and billings of $302 million, up 56% year-over-year. We also continued to increase the leverage in our operating model with our non-GAAP operating margin expanding to 13.9% and Q3 non-GAAP EPS of $0.23. Security continues to be a top priority on a global basis, and security spending remains strong. Our results demonstrate our market leadership with growth that significantly outpaced the market. We are achieving these results quarter after quarter because our customers and prospects are reacting favorably to our philosophy, strategy, and platform. First, our philosophy is one of breach prevention.
We believe that the cybersecurity battle is a math battle where it's critical to alter the equation, such that the odds of launching a successful attack are significantly reduced, which dramatically increases the cost for the attacker. Second, to implement that philosophy, our strategy is to have a high degree of breach prevention capabilities at every step in the attack life cycle. Third, our platform is unique in the market, and it provides natively integrated and highly automated breach prevention capabilities that can demonstrably show the benefits of our approach. We know that we have the right platform at the right time in history as customers continue to turn to us to solve problems that legacy technologies, point products, and strategies based primarily on threat detection or remediation cannot. We saw this play out yet again in our Q3 results.
During the quarter, we added well over 1,500 new customers, bringing our total number of customers to over 24,000. We also saw a significant expansion in the lifetime value of our customers. For example, to make our top 25 customer list in Q3, a customer had to have spent a minimum of $8.2 million in lifetime value, a more than 60% increase over the $5 million required in Q3 of last fiscal year. As we mentioned at Analyst Day, we believe the potential upside lifetime value on our current install base, assuming spending patterns consistent with our early customer cohorts, is more than $5 billion and growing every quarter. In addition, WildFire continued its rapid growth. We now have over 6,000 paying customers, up from approximately 5,000 last quarter and an increase of approximately 200% compared to the third quarter of fiscal 2014.
On the endpoint, we saw continued momentum in the field with Traps wins that included a U.S.-based oil and natural gas exploration and production company, as well as an electric utility holding company in the Southeast. There's a great deal of excitement around Traps given the increase in targeted and complex attacks on the endpoint and the ineffectiveness of legacy products. Finally, we are very proud that Gartner positioned us in the leaders quadrant of the Magic Quadrant for Enterprise Network Firewalls for the fourth year in a row.
We also see the power of the platform in the field with large new customer wins that included one of the world's largest multimedia and creative companies, where we beat Check Point for a global data center project, one of Europe's largest electronics retailers, where we replaced Cisco to secure more than 400 stores and 20,000 employees, a large North American financial services provider, where we replaced Check Point and are implementing PA-7050s, and Palo Alto Networks for VMware NSX in the data center, including WildFire WF-500 and all subscriptions. A major win with one of the U.S.'s largest local government authorities, where we beat Cisco for an all-encompassing security re-architecture project. All of these wins are validation that our platform approach works, and customer feedback is very positive. Our customer satisfaction scores are industry leading, and our net promoter scores are best in class.
We had a huge turnout and great interaction with more than 3,000 customers and partners who attended Ignite, our annual user conference. Right on the heels of Ignite, we attended RSA, where traffic at the booth was overflowing. As a result of these events and the continued scalability of our marketing efforts, our pipeline continues to strengthen because customers and prospects recognize that the platform delivers multiple benefits. It's flexible, allowing customers to utilize any part or all of the platform depending on their current budget, projects, and requirements. It's networked, which means customers quickly get the positive impact of leverage and insight from across our customer base. This is important because no one customer alone can change the cost curve on the attacker.
It's extensible, meaning that we are constantly improving our capabilities at each part of the platform, as evidenced by the introduction of the PA-3060 and PA-7050 for the data center, continued enhancements to WildFire, the addition of Traps, and the ongoing cycle of new innovation. For example, at Ignite, we announced AutoFocus, our cyber threat intelligence service, to date, more than 750 customers have requested participation in the community access program for this new service, which will be generally available in the fall. Today, we announced the acquisition of CirroSecure, which is the foundation for a new service to be launched in the fall to provide the most advanced security capabilities in the market for SaaS applications. Our sales efforts continue to scale very well, driven in part by focused execution with partners like Westcon, the largest global security distributor.
In fact, in Westcon's last reported quarter, we became their number one security vendor by revenue, surpassing Check Point and other legacy security players. At the same time, our relationship with VMware continues to expand nicely. During the third quarter, we closed several six-figure Palo Alto Networks for NSX deals and very pleased with our growing pipeline. All that we've been able to accomplish is further proof that we continue to differentiate ourselves from the competition with the only true breach prevention platform in the market. As a result, we are rapidly gaining market share and believe that like in other markets that have historically been fragmented, a platform player can gain more market share over time than any other player has historically. Given our current scale and growth rates, we believe we're on the path to being the leading enterprise security provider.
I'd like to end my remarks by thanking our employees and partners for their hard work and dedication. With that, I'll turn the call over to Steffan. Steffan?
Thank you, Mark. Thank you for joining us on our call today. Before I get into the details of our results and guidance, I'd like to note that except for revenue figures that are GAAP, all financial figures are non-GAAP unless stated otherwise. I'm very pleased with our Q3 execution as we continue to capitalize on a robust security spending environment with our highly differentiated strategy. Our breach prevention approach, delivered by the only true end-to-end platform in the market, gives us a competitive advantage you can see in our results. New customer acquisition and expansion in existing customers drove substantial growth across all components of our business, once again resulting in record revenue, deferred revenue, and billings.
At the same time, we continue to deliver the operating margin leverage inherent in our quickly ramping hybrid SaaS model with sequential and year-over-year expansion of non-GAAP operating margin, non-GAAP EPS, and cash flow from operations. As we head into the last quarter of fiscal year 2015, we remain focused on executing against the market opportunity in front of us. Now let me turn to the numbers. Q3 total revenue grew 55% over the prior year and 8% sequentially to reach a new record of $234.2 million. The geographic mix of revenue for Q3 was 67% Americas, 20% EMEA, and 13% APAC. Compared to the prior year, the Americas grew 60%, EMEA grew 42%, and APAC grew 55%. As in previous quarters, we saw a broad strength across a wide range of verticals, and we did not have any end customer concentration.
As I mentioned, the 3 components of our hybrid SaaS model, product, subscription services, and support, all grew well in Q3. Q3 product revenue of $121.5 million increased 44% over the prior year and 5% sequentially. We saw healthy growth across our product portfolio on a year-over-year basis, with the data center products growing nicely as we continue to capture share in that important part of the market. Our recurring services revenue of $112.6 million increased 69% over the prior year and 10% sequentially and accounted for a 48% share of total revenue. Looking at the 2 components of recurring services revenue, the 1st component is our SaaS-based subscription revenue of $54.8 million, which increased 71% over the prior year and 9% sequentially. Support and maintenance revenue, the 2nd component of recurring services, was $57.8 million, an increase of 67% over the prior year and 11% sequentially.
Billings in Q3 were $302.2 million, an increase of 56% year-over-year and 7% sequentially. Growth in subscription attach rates and high renewal rates are driving recurring services billings, which positively impacts deferred revenue. Total deferred revenue in Q3 was $603.9 million, an increase of 64% year-over-year and 13% sequentially. Short-term deferred revenue increased to $365.4 million, an increase of 58% year-over-year and 13% sequentially. Total gross margin for Q3 was 77.5%, an increase of 140 basis points compared to last year and a decrease of 30 basis points sequentially. Product gross margin was 76.4%, an increase of 10 basis points year-over-year and a decrease of 70 basis points sequentially. The sequential decrease was due in part to product mix.
Services gross margin for Q3 was 78.6%, an increase of 270 basis points year-over-year, and a decrease of 10 basis points compared to Q2. Services gross margin continues to benefit in part from ongoing growth of our high-margin subscription services. For the quarter, research and development expense was 11.7% of revenue, increasing approximately $1 million sequentially to $27.4 million. This was primarily due to headcount growth and project-related expenditures. Sales and marketing expense for Q3 was 45.7% of revenue, increasing approximately $7.4 million sequentially to $107 million. This was primarily due to expenses related to our Ignite user conference and RSA, as well as headcount growth. General and administrative expense for Q3 was 6.2% of revenue, decreasing approximately $2 million sequentially to $14.4 million. This was driven in part by a decrease in outside services.
Total headcount at the end of the quarter was 2,317, up from 2,083 at the end of Q2 fiscal 2015. In total, Q3 operating expenses were $148.9 million, or 63.6% of revenue. Operating margin grew 480 basis points year-over-year to 13.9%, an increase sequentially 150 basis points. Net income for the quarter was $20.5 million, or $0.23 per diluted share using 88 million shares, compared with net income of $8.7 million or $0.11 per diluted share in Q3 2014. On a GAAP basis for the 3rd quarter, net loss was $45.9 million, or $0.56 per basic and diluted share. This compares with Q3 2014 GAAP net loss of $146.6 million or $1.96 per basic and diluted share. We finished April with cash equivalents, and investments of $1.2 billion.
Our cash flow from operations, free cash flow, and free cash flow margin for Q3 were $87.2 million, $77.4 million and 33.1% respectively. Capital expenditures in the quarter totaled $9.8 million. Consistent with the strength we saw in the quarter, linearity in Q3 tracked better than the prior year period. Our accounts receivable balance was $150.5 million this quarter, up from $135.3 million in Q2. DSOs increased sequentially by three days and decreased year-over-year by five days to 55 days. Turning to guidance, as we enter Q4, we feel good about the security spending environment and our ability to execute against that opportunity. In Q4 2015, we expect revenue to be in the range of $252 million-$256 million, which represents 41%-44% year-over-year growth.
We expect non-GAAP EPS to be in the range of $0.24-$0.25 per share, using 88.5 million-90.5 million shares. Before I conclude, I'd like to highlight a few considerations for modeling purposes. Due to continued strong growth, seasonality has been difficult to forecast, but we believe that over the longer term, fiscal Q2 and Q4 may show our strongest revenue growth. We expect CapEx for the fiscal year 2015 to be in the range of $40 million-$45 million for the year. Total consideration for CirroSecure, which closed in the fourth quarter, was $18 million, of which approximately $16 million was cash. As we've said previously, we continue to expect to exit Q4 fiscal 2015 with a low teens non-GAAP operating margin and exit Q4 2016 at a 22%-25% non-GAAP operating margin.
With that, I'll turn the call back over to the operator for Q&A.
Thank you. If you would like to ask a question, please signal by pressing star one on your telephone keypad. If you're using a speakerphone, please make sure your mute function is turned off to allow your signal to reach our equipment. Please limit yourself to one question and one follow-up question. Again, please press star one to ask a question. We'll take our first question from Philip Winslow with Credit Suisse.
Thanks, guys, and congrats on another great quarter. Obviously, you still have good product sales, but if I look at the services line and your deferred revenue, just obviously the attach rate of additional subscriptions keeps trending positively here. Wonder if you could provide us some more color, just sort of what you're seeing, is there any particular subscription that's driving this? If so, what is that? If it's not, kind of just the mix that you're seeing. Thanks.
We see a broad strength across our threat prevention, filtering and WildFire. Those continue to perform very well. Over the past year or so, we've seen a modest uptick in GlobalProtect. The power of the platform that we're delivering to customers is really resonating. There's not one in particular that is shining more than the rest. Over the last year, we have seen an uptick in WildFire in particular.
Got it. Just one quick follow-up. You guys mentioned the VM-Series product and the relationship with VMware there. I wonder if you could provide just some more color, sort of is there any particular vertical that you're seeing this adoption in, or is it more widespread? Sort of what does the pipeline, you think, look for that going forward?
Thanks, Mark. We're seeing broad interest across the board. It's not vertically specific. We're definitely seeing is customers are paying attention to virtualization in a big way, moving to the cloud. Those sort of concepts are giving us a fantastic opportunity to enter conversations for something that's brand new, conceptually brand new for them and where they want to take the future of their networks.
It's a great entry point for us. Having such a powerful partner like VMware, who is almost always in those conversation with them, really helps us a lot. We like what we've seen so far from a selling perspective. Every quarter, the pipeline's getting stronger, we like that a lot.
Awesome. Congrats again, guys.
Thanks, Phil.
We'll take our next question from Fred Grieb with Nomura.
Hey, thanks guys. Two from me. One, could you give us an update on the demand you're seeing in the service provider segment, particularly for the 7050? Is this actually becoming a meaningful growth driver for you?
Yeah, Fred, it's Mark. Generally, service provider's a good vertical for us, and it's growing very well for us. Partly that's because of the 7050. Generally, they were seeing the service providers want to secure their own networks. 7050 certainly helps in that, and we are seeing them want to be more and more a partner with us as systems integrators for other enterprises. All of our technology helps in that. Specific to the service providers as customers, that's been strong and growing very nicely for us, and they really like the 7050.
Great, thanks. Just as a follow-up, moving to Traps, can you tell us where the budget for Traps is coming from? Specifically, is this new budget that's being created specifically for Traps, or is it actually cannibalizing existing endpoint budget?
I think it's a mix of both, with what we've seen in the market so far. What I mean by both is that as customers more and more come to the recognition and realization that the legacy AV technology is really not helping them much in today's advanced threat environment, a lot of them are starting to say, "Let me see what's in the market." They create some budget to go test, right? They're bringing folks in. Traps is definitely on that list for them to run those tests.
When they make a buying decision, which is, "I've made my mind up," what we've seen so far, at least in the customer base we've sold to, is either repurposing the AV budget, going with free AV and repurposing it to Palo Alto, or repurposing a portion of the AV budget, meaning they're just going to give less to the AV guys than they used to, and taking that savings or remainder and putting it into the next-gen, which is more and more us.
Next question. Thank you. We'll take our next question from Karl Keirstead with Deutsche Bank.
Thank you. Question for Steffan. You mentioned again on this call that typically 2Q and 4Q should have the strongest growth, but it feels, based on your guide, that this year, the third quarter just reported will end up being the fastest growth. You also mentioned earlier that the 3Q linearity was better than prior periods. It feels like 3Q was a stronger quarter than you guys were expecting. I just wanted to ask you if there was one or two areas where you saw particular growth and if there was any deal pull forward from the fourth quarter or the July quarter. Thank you.
First on the seasonality part, what we've always said is it's more of a prospective statement than anything else. We've been able to blow through typical seasonality patterns, it's just been hard to call where seasonality really will land. As we get bigger, we continue to think Q2 and Q4 will be seasonally stronger. As it relates to this fiscal Q3, we saw great strength across all geos. We saw Americas grow very nicely off of a very large base. EMEA grew 42% year-over-year. APAC grew 55%. Geographically, we saw broad contribution. When we look at product lines, our family of appliances and our chassis, they all sold very well. It was really a broad strength, and it goes back to the power of the platform.
We're going into customers. We have the versatility to sell to any enterprise security need, both now on the endpoint and on the network. We're seeing that play out.
Yeah, just Fred, it's Mark. I don't think we saw any pull-in from a deal perspective, Q4 to Q3. Pipeline's strong for the fourth quarter.
Got it. Good to hear. Congrats on the quarter.
Thank you, Karl.
Thank you.
We'll take our next question from Keith Weiss with Morgan Stanley.
Excellent. Thank you guys, very nice quarter again. I wanted to delve a little bit into the recent acquisition, CirroSecure, and maybe you could sort of help us understand why this direction in terms of sort of all the adjacent technologies where you could have gone into. What made this one most interesting to you guys? What was it about this technology in particular? Because it does look like it was a technology buy for you guys. What's differentiated? What about this technology in particular made you go out and buy these guys?
Sure. Well, Keith, as you know very well, part of what we're trying to do from a prevention perspective is to make sure that we can always safely enable the use of applications. That's been a guiding principle for us from the very beginning is to make applications that people want to use safe. There, of course, are lots of things going on in the technology lane out there around security. With that as a guiding principle, we were really interested in this area because there's such an increasing use of SaaS applications. For a very long time, our platform has done a fantastic job of securing SaaS applications that come across the network, meaning from a threat perspective.
What's interesting about this, and the reason we really like the Cirro guys, is the unique approach they've taken to go a step further in sanctioned, meaning applications that companies want to use, right? Sanctioned SaaS applications. And this technology gives us, and it is a technology purchase plus people purchase as well. These guys are in the market. They have a handful of customers, so we validated the technology. It gives us a deep level of visibility into the applications themselves from a data and user perspective, so we can see actually what's happening with the data, what is the data, who's using it. And from that, we can tell very quickly if it's being misused, intentionally or unintentionally. It's another strong, safe enablement play for SaaS applications, which is a really fast-growing trend, as you know, for customers.
That's why we really liked it, and these guys have something really interesting.
Got it. If I could ask one follow-up on the distribution side of the equation. We've been talking for a while about the ramp-up of some of these distribution deals. You guys mentioned Westcon on the conference call. Where are we in that cycle of ramping them up? How much further is there to go in getting on new distribution capacity, particularly from some of these larger agreements that you guys recently signed?
Yeah, we're very optimistic about the ability to continue to do that. We've highlighted at Westcon a few times. The reason for that is they're the largest security distributor out there, and as you can tell from the results we've talked about before, including now being their number one security provider, that's ramping very nicely. That's not the only thing we're doing. We work with other distribution partners as well, who we've been working with for quite some time, and are aggressively partnering with them in order to continue to ramp with them as well on a global basis. There's a lot going on here in that regard, and it's important for our future to be able to get the capacity.
As you can tell, people really want to buy our technology, so we want to make sure that we have the capacity to fulfill that on a global basis.
We'll take our next question from Michael Turits with Raymond James.
Michael Turits. Thanks a lot. Hey, guys. Question on discussion around a firewall spending cycle, if it exists. Firewall spending, network security spending has been strong in the last couple of years. Is there any sense that has in any way peaked last year, or that there's any shift in terms of priority of spend this year to other areas besides network security?
Yeah, what we're seeing, Michael, is a really good question. Across the board, security spending remains very strong, which is fantastic. The reason it's great, obviously for all security companies, but us in particular, is what the trending is we're seeing. Traditionally, you'd see people refreshing from a firewall perspective or other technology perspective, and that would be the opportunity to talk to somebody. Those refresh cycles continue to happen all the time, what's really good for us is since we've got the platform, the customer can be inserted or onboarded at any point in that platform for whatever they feel like the most pressing use case may be. It might be the firewall, it might be IPS, it might be advanced persistent threats, it might be the endpoint.
It doesn't matter in the sense that we can deliver the solutions they need at the time and grow from that. We see cycles of buying being very strong as a general matter, and specifically, we're pleased with the ability to be differentiated to come in at any point in whatever those buying cycles are.
Okay. Just to follow up to that, if I can, a similar question about cycles. Someone asked last quarter if you were beginning to see a refresh of your own base. Do you have any further visibility into that at this point?
Yeah. We watch that closely, of course, and what we said earlier on that is we are seeing our own customers starting to refresh in the earlier cohorts. That's not surprising given four to five-year refresh cycles. We also like the fact that when we're seeing those folks come back to us, that we've been able to, in a lot of cases, sell them larger devices because their needs have grown. More subscription services because they realize the power of the subscription services, and we've brought more to market as well. One of the most interesting data points for me on that when I think about it is if you look at the 2009 and 2010 cohort combined, it's like 2,000 customers, and we have over 24,000 now.
If that pattern holds from our own refresh in our customer base, there's a lot of buying in there in the future.
I'll take our next question from Matthew Niknam with Goldman Sachs.
Hey, guys. Thank you for taking the question. Just a couple on CirroSecure. Any color you can share on how you plan on pricing the CirroSecure technology once that's rolled out later this year? Maybe if you can talk to any sort of incremental spending, whether it's sales and marketing, R&D, tied to rolling out that subscription. Want to get a sense of any sort of margin impacts we can expect in upcoming quarters. Thanks.
Yeah. From a pricing perspective, we'll give more data around this when we get closer to the fall, Rob. Generally, we're anticipating we'd price it on an application user basis, and we'll get more specific about that when we bring that to market. Steffan can answer the margins.
Yeah. With the technology acquisition and the small team of people coming over, we plan to absorb this from an R&D standpoint, and from a sales and marketing standpoint, we're not going to be adding an overlay sales team. This will be sold by our normal teams here. The impact will be modest, and we reiterated our low teens operating margin exiting Q4, and also the 22%-25% non-GAAP operating margins exiting Q4 of next year. We feel good about the ability to execute without any dilution.
That's great. Thanks.
Thank you.
I'll take our next question from Shaul Eyal with Oppenheimer.
Thank you. Hi, good afternoon, guys. Congrats on another set of strong results. Two quick questions on my end. Thank you guys for the color on the VMware partnership on the Westcon, but any color you can share with us on the Splunk relations at this point?
Yeah. We love Splunk. They're very good partners of ours, and I think they feel the same way about us. I think you can see from Splunk results as they continue down the path with their platform, that security becomes an increasingly large use case for them. Not surprising given what they do with the data. What we have found, and I think they found, from our joint customers consistently tell both of us is when you put Palo Alto Networks data off of our platform through a Splunk platform, you get very actionable intelligence to use for security purposes, and customers like that a lot. We continue to work with them, not only on the technology side, but also on the go-to-market side as well.
Got it. We've all heard that over the course of the past few quarters, board of directors have started to get involved in the security decision process, spending process. Mark, what can you tell us on that front? Are you meeting more with boards? Are you being called into those urgent board meetings?
Yeah. I think boards are definitely becoming more involved. It's a total top-of-mind issue right now, and it's growing in nature. I do get the opportunity to speak with board members and boards. I would tell you, as I said before, it's not that they're the urgent meetings, meaning it's not the panic meeting. It's more and more folks being very thoughtful, saying, "Hey, we got to think about this over a multi-year basis, not what we read in the paper yesterday." How do we come up with a solution that takes care of us on a longer period of time in the best possible way? The way we speak to that is through a security reference architecture about what the next generation reference architecture should look like from a security perspective.
Obviously, Palo Alto has a lot to bring to bear on that, and we certainly talk through that with them. It's more at the level of saying, "Here's what's happening in the world. You have to have a prevention philosophy first and foremost." Doesn't mean you shouldn't do other things, but it means if you're not doing prevention first and foremost or thinking that way, then you're going to be behind the curve in a way you can never recover from. Here's what a reference architecture would look like that has that mindset. Obviously, Palo Alto's got a important part of that, and we get the chance to talk about that too.
We'll take our next question from Jayson Noland with Robert W. Baird.
Okay, great. Thank you. I wanted to ask about AutoFocus first. You mentioned 750 customer requests. Do you have a feel for the size of the market and what the trajectory of adoption would be?
Yeah. What we mentioned there, Jayson, was that if we back up for a minute, at Analyst Day, we said we would do a community access program the first thing, because that would give us the chance to put the technology into market, let customers play with it and give us fantastic feedback, which we're now getting. When we announced that and said anybody who'd be interested in being part of the community access program, we had over 750 of our existing customers show up for that Webex to raise their hand and say, "I want to be in that," which is fantastic. I think it's a sign of strong interest in the technology also a sign of hopefully a strong pipeline for folks who may want to purchase the technology when we bring it to market.
As far as what the market looks like for that, there is an increasingly high demand for intelligence and analytics in security. I've not yet met a customer that has told me, "If I just had some more data I would be better off." All of them tell me that, "What I need is to make sense of what I have," frankly, whether it comes from Palo Alto or anybody else, right? What AutoFocus does is it takes the data off of literally billions of pieces of information that we have across our very fast-growing customer base, and it burns the haystack down and it just leaves the needles, and it shows which of the needles are sitting on top of each other and which are separate, right? That is very actionable intelligence that people are finding to be very interesting.
We anticipate that there'll be a good degree of interest in this, and we look forward to getting it to the market in the fall.
Okay. That makes sense. Steffan, any color you can provide on over/under performance by vertical? I think you'd said at the Analyst Day that high-tech is the largest vertical at 14%.
Hey, we saw a very broad distribution again across all verticals. High tech continued to perform well. Financial services, public sector, those are our top three. When I say top three, the largest one lifetime to date is, call it 14% individually. We saw a very nice broad strength across all verticals. Which again, goes to the point that we underscore every vertical needs a platform solution, and we're in the business of helping every industry and every customer.
We have a question from Gregg Moskowitz with Cowen and Company.
Okay. Thank you, and congratulations on a very strong quarter as well. Steffan, I think last quarter you extended your product lead times from 2 weeks to 4 weeks. Just wondering where that stands today and what you expect going forward.
Our product lead times are again, call it standard 2 weeks. We worked through some of the issues that we had, and we never had any customer satisfaction issues, so we were good on that front.
Perfect. On WildFire, Mark, are the paid users primarily coming from mining the install base, just looking over the past 90 days, or are you seeing higher new customer attach as well?
We're seeing great attach on new sales as well as the existing customer base. I think the distinction there is no longer relevant between the two. We brought that to market. We gave it for free for a while on the installed base just to get people to use it. The free aspect is no longer relevant whatsoever. We're over 6,000 paid customers and growing very rapidly.
We'll take our next question from Rob Owens with Pacific Crest Securities.
Hey, guys, this is Ben on for Rob. Thanks for taking my questions. I wanted to start with the traction that you're seeing in the data centers. Maybe you could provide a little bit of color as far as where you're seeing the most traction. What's the split between internet-facing data centers versus the internal enterprise data center type market?
We're seeing broad strength across the board in data centers. I think just fundamentally because there's so much increase in application usage bandwidth and what folks are doing. It's a very positive trend across the board. As between the two you mentioned, we're seeing a lot of the use case on the internal side.
Okay, great. Then on the Traps endpoint solution Is there any functionality that we should view as needed to increase the endpoint functionality up to a level that can completely replace the existing endpoint products that are out there? Do you believe that where it sits right now provides all the functionality that is needed?
That's a great question, Ben. A couple things. At the very highest levels, the way we've viewed the road map from an endpoint perspective, when we decided to buy Cyvera, we pitted against this road map concept of saying a great endpoint would have real prevention capabilities. It would have good detection capabilities. It would also have the ability to do some level of, I'll call it automated remediation, find that stuff and remediate it. When it did those things, it would not break the native application experience, and it would use as little compute and battery power as possible. Before we bought anything, that was our road map that we had in mind. If you think through that, the highest order bit in there is prevention. Of all the things that I just mentioned, the most important one would be prevention.
That's why we focus very heavily on that. That's why we bought Cyvera because it brings real prevention capabilities into the market, and we'll fill out the rest of that road map over time. Now, your specific question, though, is can you use Traps and replace AV? I think that's what you're asking, right? What we've seen customers do is they think of a different way. They say, "I'm interested in security. I need secure endpoints," right? That road map I gave you gives you secure endpoints, and the most important part is prevention. I think when they want to have security, they're saying, "Give me something different. It can be different or complementary, frankly, to my legacy AV, but I need security, not AV," right? We're seeing some customers, like I mentioned before, run them side by side.
We're seeing some customers just say, "I'm just going down the security angle. I don't really need the AV since it's not doing a lot for me anyway." It's really a mixed bag. It's a very dynamic market right now, meaning it's moving quickly, and I think it's moving in the direction of security, and that's where we're primarily focused.
Great. Thank you.
Thank you.
We'll take our next question from Matthew Hedberg with RBC Capital Markets.
Thanks for taking my questions, guys. Congrats on the quarter. Mark, I had a follow-up to the prior question on Traps. Can you talk about maybe just the pace of business coming out of Ignite? Is there anything else you can help us with to help quantify the trajectory of that as we think to 2016?
Yeah. We like the market. It's a big addressable market opportunity. There's a hell of a lot of interest in it as well. We're selling well in there. We continue to close dozens and dozens of deals every quarter. We've sold multiple millions of dollars worth of Traps to date. We would expect that we continue to have a good ramp as we go into 2016, that 2016 will be a good selling year for us.
That's great. Steffan, your hybrid SaaS model certainly is resonating. Can you remind us about the amount of in-quarter revenue you need to obtain in order to hit the midpoint of your guidance?
No, we don't get into that level of specificity. What I can tell you is, you look at just the mix from a revenue standpoint, if you look at product revenue this quarter, it was about 51.9%. That product revenue number is typically the go-get number that we need in order to hit the overall guidance. Of course, there is some subscription services that we can count on as revenue in the quarter, but most of that's ratable in nature. It's really a focus on product revenue as the go-get. That's the primary driver. We've seen very nice traction with our appliances. You look at the year-over-year growth rates, they've been very healthy. We have increasing subscription attach rates. You're really seeing the power of the overall model when you look at the revenue results.
We'll take our next question from Brent Thill with UBS.
Steffan, you mentioned the Q3 linearity was a lot better than last year. Is that better sales execution just a sign of the overall demand environment being so good for your sector? Just curious if you could give a little more comment on what you saw in the quarter.
Yeah, it's a combination of things. As we get more quarters under our belt, sales execution, which is already very high, continues to excel. That was a big boost when you do a year-over-year comparison. From a market standpoint, we see lots of great traction across all verticals. We've seen a healthy spending environment, and that's also contributed. Those two factors really help with the linearity.
Just real quick, on the long-term deferred revenue, you've continued to see acceleration over the last several quarters. Can you maybe just walk through what you're seeing in that line item that is yielding that type of result?
Yeah. We see very good growth in both short-term and long-term deferred revenue. The dynamic that we're seeing in long-term deferred revenue is we have lots of customers. In fact, some of our largest customers are looking to do multi-year deals with us. That's great, and that's goodness because we are now designed into their fabric, and we can participate knowing that we have a long-term partner with those customers. The sales force, they're not more incented to sell long-term deals. They do have a little bit of skin in the game. They do get commission on long-term deals, there's no extra incentive on that front. We feel good about any time we can get long-term deals that are booked into the business.
Thank you. We'll take our next question from Gur Talpaz with Stifel.
Great. Thank you. With CirroSecure, there are a lot of vendors out there trying to do cloud/SaaS security. Can you maybe talk about the advantages Cirro has versus players like Adallom or Skyhigh or Elastica that have been sort of well-funded and picked up a lot of steam over the last year? Maybe going one step further, the advantage the customer might have by deploying a unified solution with a firewall as opposed to a standalone solution. Thank you.
Yeah, Gur, great question. Well, a couple thoughts there. There are a lot of players in the market. Just the one commonality I'd put at the very top of the list is, enabling SaaS applications is an aspect that should be part of the platform. Just as a general matter, this is, I think, another example of the market of things that will be part of platforms over time. As the leading platform provider, we absolutely intend to provide that capability so the customers are not forced to buy yet another point solution in the market. When you think about what those various vendors are doing, there's a whole mix of approaches. One thing they do is they give visibility into SaaS applications being used.
Again and again and again, when we talk to our customers, we hear them say, "All they're doing is taking your log data from Palo Alto Networks and presenting it." Now, they do that in a very nice manner, but that's one of the value props, is take the Palo Alto log data and present it to us. There's no reason we can't do that, and we will do that. Another approach they've taken is doing reverse proxy technology to try to get in the traffic flow to see things. We're extremely experienced folks from a networking perspective. That is not a great approach. It just doesn't scale over time, breaks applications.
A third aspect of this is what we described and what Cirro has really cracked the nut on, and that is actually having the hooks into the applications themselves in order to see the data and the users of the data and having a really great analytics tool associated with that so you can see what's happening in the application itself with the data and users. We like that approach a lot. It's about safe enablement. It's scalable. It doesn't break applications. It's got a lot going for it, and that's what we really particularly liked about those guys. Combining that capability set with us providing our own level of viewpoint off of our log data about SaaS applications is what you can expect us to do.
Awesome. Thank you very much. Great quarter.
Thank you.
We'll take our next question from Michael Kim with Imperial Capital.
Hi, good afternoon, guys. Can you talk a little about customer adoption of Traps? Is it primarily new customers to WildFire, including Traps or existing WildFire customers adding Traps? Are you seeing it primarily in the Global 2000, or is it pretty much across the customer base?
The good news is it's across customer base, there's not a pattern there in a good way, right? There's a lot of interest from customers, from smaller customers, larger customers, doesn't matter in the vertical. I think naturally those customers who are already using Palo Alto technology tend to get the story faster because they have Palo Alto technology from a platform perspective. Those who are using WildFire already have seen the value and benefit of WildFire, and the combination of Traps and WildFire is a very powerful thing. They get it even faster than others. Just as a general matter, we're seeing interest across the board.
Great. Just briefly on AutoFocus, is your plan to continue to expand the program beyond the 750 customers before you go GA, or do you feel comfortable with this kind of level of initial interest to really get you to a comfortable level in GA?
Yes, that's a really good question. Actually, we would have less than 750 people in the community access program. Just to run a good program like that'll be measured in the dozens, not the hundreds. We just mentioned the fact that 750 people wanted to be in it, just as an indication of interest. Just to have a really focused effort, get good feedback, it'll be much smaller than that.
We'll take our next question from Jonathan Ho with William Blair.
Hey, guys. Just wanted to get a sense of what you're seeing out there in terms of competitive win rates and whether you're seeing maybe continued improvement or whether it's become fairly stable at this point.
Competitive win rates are very high. We continue to take share from all the legacy providers that are out there. When we get into a deal, which we're able to do more and more, given just the brand recognition, the size of the team that Mark's running, increased global coverage from a distribution and reseller perspective, we win a very high amount of the times. I think that's not obvious. It's showing through from the results.
Got it. Then as you broaden sort of the product base, are you seeing more sort of, I guess, tips of the spear or opportunities to get into accounts with now multiple touch points? Has that helped to sort of bring the platform in from a variety of different angles?
Yeah, there's two things that are really helpful there. The first is that our sales team is very quickly being educated and being out of conversations, I'll call it, at a higher strategic level with folks. It's a platform-level conversation. The customer's going to say, "I have a need," or, "I have a pain point," right? The sales force knows that before you jump in on that, the right conversation to have with them is what is our philosophy and how do we bring that philosophy to bear with the platform? Because it shows how not only we're going to solve that pain point for you, but other pain points that are associated with that, maybe even ones you're not even thinking of yet. Then, of course, we'll address specifically why they ask us into the room in the first place.
We're just going to do it in the context of the platform.
We'll take our next question from Matt Williams with Evercore.
Hi, good afternoon. Thanks for taking the question. I'm just curious if there's anything or any geos specifically in the international market that you guys are particularly focusing on. I know it's obviously a huge opportunity. Just curious if there's specific sort of sub-geos that you're more focused on than others or any commentary around that would be great.
Just two just real general comments around it, Matt. One is we like to go where the money is. That may be an obvious statement. Not all of this, sub geos inside of theaters are the same from a wallet and a spend perspective. I think we're educated about that. Like Australia is a great market, for example, in APAC. The Middle East is a fast-growing market. There's a lot of money there as well. We're also very focused on the Global 2000, and when you actually write them down on a piece of paper, who are they and where are they headquartered, that's pretty telling about where they are. More than 50% of them are in Asia, for example.
We're trying to be thoughtful and educated about where we put our resources, and those are two of the guides that I've given you about how we think about that outside the United States.
Great. That's helpful. Maybe just one quick follow-up, if I could. Are customers in that initial commitment to you guys, are you seeing much change in sort of the average initial commitment from a dollar perspective? Meaning, are they more comfortable committing a higher dollar value than maybe they were a couple of quarters ago? Is that continuing to trend up in terms of the larger and larger commitments right out of the bat?
Yeah, two aspects to that. One, just as a general matter, I'll call it the ASP, right across the board of all their customers, continues to rise quarter after quarter. That's just a general deal, a comment, regardless of size of the customer. In more and more customers, again, with a focus on larger accounts, we're definitely seeing folks sign up to larger initial purchases and larger follow-on orders as well if they're already using our technology. The trends are very positive there.
Thank you. We'll take our last question from Andrew Nowinski with Piper Jaffray.
Great, thanks for squeezing me in. Just two quick questions. Number one, will customers deploy CirroSecure as a subscription on your firewall? It can be deployed as a standalone product like Traps, and then will it integrate with WildFire?
It can be standalone. It's possible to do it that way. I think the real power would be in using it in conjunction with the firewall. If you think about what I said earlier, we're already safely enabling applications across the network from a threat perspective. There's real power in associating it with the firewall. Yes, it will be integrated with Traps. That's a very good point that I didn't mention before.
WildFire.
I'm sorry, with WildFire. One of the things we'll do right away is we'll take the technology over the next couple of months and integrate it with WildFire. We'll take it off the market like we do with Traps. We'll do the integration with WildFire like we did with Traps, and we'll bring it back to market. WildFire has shown a very compelling value in being able to look at traffic. We'll definitely provide that capability set with the CirroSecure technology as well.
Great. Then I just want to go back real quick to one of the high-level spending trends that you mentioned, I think there's some concern that spending on firewalls maybe is starting to peak. Are you seeing customers trying to consolidate their security infrastructure? Is the firewall the most logical place for that? If so, do you think then there's a lot of firewalls that are at a disadvantage for growth over the next three-plus years?
What we see an inexorable trend toward is trying to do prevention, the best way to do it is with a platform that is very integrated with highly automated outcomes. That's what's happening in the market. You can think about it as consolidation, I think customers think it's less about consolidation than they do is what's the outcome of the consolidation, which is a higher level of security because you have those integrated and automated outcomes. For that reason, over time, I don't know how long, but over time, I think if you're providing point solutions in a traditional legacy model, you have a real problem there because the solutions should be at the firewall level because that's the device that sees all the traffic in the first place. That's why we started there.
That's why we've consistently natively integrated these capability sets into the firewall because it has the total visibility.
That concludes today's question and answer session. Mark McLaughlin, at this time I'll turn the conference back to you for any additional or closing remarks.
Great. Thanks, everybody, for being on the call this afternoon. As I said earlier, we are right in the right place to market at the right time in history with the market's leading breach prevention platform. I really want to thank all the Palo Alto Networks team for their hard work and their support of our customers and our partners as we continue our march to becoming the global leader in enterprise security. Thanks a lot for your interest, and we'll talk with you in September.
That concludes today's conference.