Good morning. You always like to make an entrance?
No, I can't predict traffic. Sorry. Apologies.
I'm joking. It's okay. We'll get five minutes from the end. We have enough time between meetings here. Good morning. Thank you very much, everyone, for coming here. I'll skip the introduction just for the sake of time, and everyone knows Nikesh, so that's, you know, we start high this time. I wanna start with a question that everyone has on its mind when it comes to the sector, not specifically to Palo Alto. We have companies who are doing great, like your company. We have companies who are doing poorly. Even CrowdStrike, that had good results, had some negatives, and SentinelOne, we've seen what happened. Forget the accounting, the underlying market. How is the-
We can forget accounting today?
Yes, forget accounting. Forget accounting today. How is the market itself? How is demand? How is the business environment in general?
First of all, thank you for having me here, and apologies for being a few minutes late. For the last three quarters, we've been saying it, you've been hearing in the market, I suspect you're hearing from every enterprise company. We have an aggressive Fed who's driving interest rates up. I called it the revenge of the CFO. My CFO has never been happier. People are talking to him, paying attention to him. He's been ignored for many years when interest rates were zero. Every CFO in the world is getting the attention. I mean, imagine, you know, enterprise often does three-year TCV deals. Cost of money is zero.
The customer writes you a check for three years, saying, "This is sitting in the bank, not getting me a lot of money." Now, you can make 5.5%, 6% interest, he's not gonna write me a check for three years upfront without having a long conversation about what's in it for them. I think the interest rate, purely macro changing, has caused the CFOs to get more involved. They're paying attention to how much cash is in the books. Even companies that are doing great out there are watching their dollars.
Yeah.
What is... You know, let's put that on one side. I think there's no debate that people are watching their dollars and paying more attention to how they spend their money, whether their macroeconomic environment is impacting their demand or they're just being conscious of the cost of money. If you take on the other side, cybersecurity. In the last nine months, no customer has said to me, "This is really nice, I like it, but I'll buy it another six months later because I don't need new security." Anybody who's been going down a security project is continuing to do their security projects. Are they looking at their security budget and saying: How can I optimize it? Yes. Right?
Like every team, they're being asked, the cybersecurity CISOs do not have a blank checkbook compared to any other team in the company. They're being asked to optimize their spending, which on the margin, is good for us. When you're optimizing spending, what typically goes first is a small $100,000 ACV tool or $200,000 ACV tool. They don't shut down their firewall, or they don't cut off their transformation projects. The transformation projects were being questioned in the beginning of the pandemic. It's like, oh, my God, my revenue's vanished. How am I gonna afford this? I have no money left. I'm not gonna be able to do anything. Nobody's questioning a transformation project in the current environment, right? Everybody's hurting a little bit, but nobody's hurting so bad that things are going away. The demand is there.
Customer behavior is changing, right? Buying behavior is changing. I don't wanna buy all the three years upfront. Can I do something how I pay for it? Can we phase this out into phase I, phase II, phase III? You know, what if I bought 20,000 seats first, and then I bought the next 20,000 next year? You're seeing phasing of projects, people resizing projects, rescoping. I think we have to be conscious of how we think about the demand environment and how we see it translating to the results of cybersecurity companies, currently. I think demand environment is strong, customer behavior is changing, perhaps some of the results, which gives you a head fake. There is a certain segment of the market which might be hurting more, and the way I describe it, there are two things that happen.
SMB or the low end of the market, does tend to push or postpone. I won't buy another firewall for another one year, let me push. You'll find that on the lower end of the market, because the macroeconomic environment has a bigger impact or more pronounced impact there, they might postpone a little bit. Fortunately for us, that is not a, you know, this is not a bug, it's a feature. We were never very good at that end of the market, and now it's good for us that we were not very good at that market. The other place you'll see it is, because of, as every company, I think, in the world, enterprise company has told you, sales cycles are elongating.
Now, sales cycles are elongating, I wanna say, in any quarter, about 15%-20% of business is net new business. The rest is the existing customers or existing business. The more new business you have, the more volatile your results are gonna be, because you've got to drag every deal across the transom before the end of the quarter. Does that make sense?
Makes sense.
Okay. All right.
Follow up.
I don't know the answers to any other companies. I only know one for now, so.
Follow-up question: Is there a difference in the willingness of customers to spend, whether it's a SaaS model or whether it's an appliance that they have to pay upfront? Is there a difference between willingness to spend on OpEx versus CapEx?
No, I mean, they will translate it to whatever... No.
No.
The short answer is no. It's not like they'll buy a software product from me more than a hardware product. There was a supply chain impact, which encouraged a lot of customers to think hard about solving the problem of software.
Yeah.
Right? If I'm sitting down, I need 5,000 firewalls, so then say: Could I design a hybrid architecture, which is 2,000 software firewalls, 3,000 hardware firewalls? Yeah, a lot of that has been tried and a lot of that has been thought through, so they don't get caught in the post-pandemic, supply chain crisis. We have seen an accelerated shift towards software in the last few quarters.
Got it. The last question is there an impact on pricing in Do you see like, for example, other vendors being more aggressive, so it forces you to also be aggressive?
Look, the enterprise business is a highly negotiated business. Depending on the product category you talk about, you will see negotiation all the time. On the margin, I think generally, most of you guys have not incorporated the impact of the cost of money to enterprise businesses. I've never heard the sell side or buy side investors didn't talk about the fact that, you know, giving you money three years upfront, that's stupid, that cost them 12% now. It never cost them 12% three years ago.
Right.
Why are they still doing it? Not every CFO is asking the question, for now we're okay, but they're all getting there. That's why I said in our quarterly call that the behavior change is more widespread and more persistent. In the end, you know, left pocket, right pocket, do I have to get a bigger discount? Well...
Got it. Okay, I wanna maybe move on to your NGS business, the most successful part of your business. There are many parts to NGS. Last quarter, you grew 60%, more than we expected. Can you break it down for us to the components and talk about the growth you're seeing in each one of the kind of big buckets within NGS?
I think the way to think about our NGS business is, in the last five years, we've transformed into effectively three platforms. We have a network security platform, where we sell hardware, software, and SASE as a combined. You can buy each piece, or you can buy it combined as a zero trust architecture. There are a lot of software-delivered capabilities there. Our SASE product is part of next generation security. We do a whole bunch of inline protection using software in our network security business, it all goes into NGS. That is driven by the robust renewal of firewalls and cloud-delivered capabilities and the SASE transformations. I think the prior quarter, we declared that we done $1 billion worth of bookings on SASE. Remember, we didn't play in the SASE space three years ago.
It was one player which took away all the SASE business. We've done $1 billion. We think we're growing faster than most other players in the space. We see a robust pipeline. You know, software firewalls are doing really well, given where the market was one year ago, where people started evaluating software in light of the supply chain crisis. That's the network security platform. There's a cloud security platform. This is all the applications people are writing. As I'm sure all of you pay attention, Google, Microsoft, AWS, Oracle, Alibaba, et cetera, have gone and done a really good job selling the public cloud to people. Well, they have to use it. They use it as they move applications to the public cloud.
You don't use your Salesforce there or Workday, take your own homegrown company applications and move there, either lift and shift or you rewrite them. As you move the applications, you have to make sure they're secure. We have a product that secures your application development life cycle, and how you run it's called Prisma Cloud. That's the second category, which is doing really well because more and more people move to the cloud, and it's somewhat different from... Everybody's like, "Cloud spending is going down?" Well, cloud commitments are going down.
Yeah.
Cloud spending is fine. People are moving more and more workloads to the cloud. The last category, which is the category where five years ago, we had identified that AI was going to have a significant impact on cybersecurity, is our Cortex set of products, where we announced that we hit $1 billion in bookings. Again, this was the area we did not play in. This includes the endpoint detection using AI. This includes the attack surface management work that we do using AI, and it includes automation playbooks and our most recently launched product called XSIAM. That's kind of the three buckets. You know, on a 12-month basis, they're all doing really well. Every quarter, you know, one doesn't does better than the other, but that's part of the running the portfolio.
What I'll do now, I'll just ask you questions about each one of them, because each one of them is very interesting on its own. Starting with the SASE and securing basically access to the cloud, how... We've seen Zscaler having some issues, then they came out and said things are becoming better. Have you seen any ebbs and flows in this business of demand going up and down? How is the acceptance of this service by customers, and specifically about you, how is the competition in the market?
Remember the old ad from Avis, called "We Try Harder?
Yes.
Because we're the newer player and we're trying to go bigger, we try harder. Are there ebbs and flows? I think you're conflating ebbs and flows and deal closures with demand. The demand is strong.
Mm-hmm.
There is. It's our biggest pipeline, SASE transformation. Now, remember, what is a SASE transformation? The customer comes to you to say, "I have 1,000 stores around the world. I have large T1 lines I bought from the telecom companies, and I need to replace all those lines. I need to put an SD-WAN box. I need to read our traffic." This is a nine to 12-month implementation of a network strategy, or rereading your network. Nobody does this lightly. Nobody does this without doing tremendous amounts of testing in their own network, because they're about to get away from AT&T or Verizon and go to the open Internet and, you know, use the whatever internet access there is. We did announce this last quarter, one of our larger deals for a large beverage company that, I think is a household name around the world.
It's going to take them nine months to implement the project. They took nine months to decide that they want to do it. They took six months to decide to actually close the deal. It took a 15-month sales cycle, which happened to close magically two days before the end of our quarter. Typically, a lot of magic happens in the last four days of a quarter because customers have learned for the last 50 years, you know, taught by the large enterprise demos, that if you drag it to the end of the quarter, these guys are going to probably give you a better deal. They tried three quarters in a row. We didn't. They finally closed the deal at a price we offered them nine months ago. This is goodness.
There is long lead times in the SASE business, once it's there, it's a sticky business, because you're deploying us on 100,000, 300,000 employee laptops around the world. It's a hard problem to go rip that out. It takes six months and probably, you know, makes a lot of people unhappy if you're saying, "Give me your laptop, I need to redo the security software on it." It's a strong business. It's gonna be a robust business. There used to be one player. I joke there are two and a half players in the market.
Yeah.
I don't see that SASE transformations are going to slow down. If you pay attention to the federal registers, the U.S. government is gonna go zero trust in SASE over the next few years. So far, there's one approved vendor for SASE, for DoD.
Yeah. Do you envision... It's a big market. You're certainly one of the leaders in the space. Do you envision new players coming in?
It's a tough business. It's a very tough business because, and I think most people don't understand, we, and anybody who wants to join this business, is going from a sell a product and go away to run a service business. In the case of firewalls, we would sell you a firewall, your engineers would go deploy it. That's up to you. In the case of SASE, we take it over. When you log in from a laptop or iPad, Palo Alto Networks is running that traffic on the internet, dropping it and delivering security. I'm actually running an operating service. If I go down, your company is gonna be pausing operations.
Yeah.
We run some airlines around the world. Well, some many. We run banks, we run consulting companies on our operating software. We take the traffic, move it on to Google Cloud. If Google Cloud goes down, we switch you to AWS. Now you're running a 99.999% operating company. This is not a startup opportunity. I think people are kidding themselves if they think that a startup's gonna come disrupt the SASE business, because the first thing that they were asked is, "How do you deliver five nines in my online service?" Five nines is a large operating event. Yeah, could an AT&T do it? Possibly. Could a large company do it? Possibly. There's a lot of tech needed.
It's taken us, you know, three years of building it and 14 years before that, of having the capabilities on our firewalls.
Yeah.
I don't think it's a easy market to see new players in. I think it's an established market for one player. What it also shows is that the established market used to had traditionally be a, "Take me to the internet" market. Take me to Salesforce, take me to Workday. When I on my laptop, take my internet traffic this way. Nowadays, I move to Google Cloud, take me to my application. That is a whole different security question than take me to Workday.
Right.
Again, most people have not understood.
Right
that, I mean, that's what the difference between a ZIA and ZPA type product.
Now the question is. When in a second, we'll talk about your Prisma Cloud. Prisma Cloud, you made a lot of acquisitions. You always add more and more features. I'm guessing it's you're not done with adding more features. What about Prisma Access? Is this a set product? Do you see it growing the scope, or is it more just about replacing a lot of the legacy, the VPNs, the CASBs, replacing a lot of the legacy with Prisma Access?
It's a full product.
It's a full product.
It's a full product. Nobody's gonna give me $25 million to go take their entire business and have their employees on me, or nobody's large aircraft manufacturer is not gonna have me have more than half a million employees around the world running my system, saying: "Yeah, we trust you. You'll build the rest of it later." No, it is a full product. It works, people use it. We don't need to go do anything. We have to keep evolving it in a positive way. You know, but I know, I'm sure we'll talk about this, if you want to, the whole new world about AI and-
Yeah
generative AI and how does that evolve any product. We'll keep evolving it, but it's not something we need to.
Got it.
plug a whole bunch of stuff on it.
Switching to Prisma Cloud, you are the largest company in the space. By the way, I'm hosting a panel on this later. I don't remember if it's today or tomorrow, but it's one of the fastest-growing markets. You have the most complete portfolio with pluses and minuses. First, let's talk about the pluses. How do you see this market evolving? I'm not asking about the number, just asking about to understand the size of it, to understand the scope of it. What is your next big hurdle? Meaning, you are already now the leader. What do you have to accomplish over the next three to five years in order to establish yourself as a leader, and so we don't see these small startups that are coming, taking some of the market share away from you?
You should not confuse small events in life. When I started the Prisma Cloud product, there was a company called Dome9. We don't see them anymore. They got acquired. There was a company called Divvy Cloud. We don't see them anymore. They got acquired. There was a company called Orca. We don't see them as much anymore. We have seen many startups on this journey. I think the way to understand the cloud security market is, people go make a commitment, move to Google, to AWS, to Microsoft, and over time, what has happened is, they've ended up in more than one cloud. I think the Fortune 100, there's very few single cloud customers. They're probably all of them on more than two clouds or on two clouds.
The whole process is, I'm moving an application. It's a trading application. It's a back of the office, back of the house application. I'm moving it, rewriting it in Google Cloud. When you rewrite it and it runs over there, it's your job to make sure that it runs securely. For example, what does that mean? I've got an application where you upload your resume into my app, which I've written in GCP. I'm a recruiting company. You're gonna make sure that app is secure, because if I upload the resume and you've left a security breach in there, I can go steal all the data of all the applicants. The person who writes the application has to make sure it's secure, and it runs securely all the time.
What we do is, we help people in the process of writing the app, all the way till it's deployed and monitored in deployment, and tell you what the security vulnerability does and track it for breaches. The way the industry has evolved in the last three, four years, is as people have moved there was a small problem. Oh, I need to figure out how to make sure that when I'm writing the code, there are no security breaches, so they go by IaC.
They say, I need to make sure I'm deploying it on Google Cloud or AWS, that I'm deploying it right, I'm not leaving any deployment holes when I'm deploying it. Say, when I'm running it, I will need to watch it. What has happened in the last three to five years, is people have bought some solutions to understand this problem. What we have done, is we have stitched the entire process. If you find a problem in production when something is running, say, my God, this is a security breach. You can't fix it there. You can block it there, but you have to fix it back where you wrote the code, and you have to have a stitch between what code was written, who wrote it, how do I fix it so it never happens again?
All point products in industries do not deliver this code-to-cloud integration.
Yep.
That's what we've done buying these seven companies that we've integrated. What we need to do is we need to make this more and more prevalent. We need to make sure more and more customers deploy it. I'm, I don't want to say I'm sanguine. I'm like, I'm calm about it, but we're working really hard to make sure that this happens across the board. So far, we don't think that the long term is threatened by all the stuff that's going on in the market.
Yeah.
That doesn't mean we have to stand our toes and work really hard. Again, this is not a flash in the pan opportunity that you come in and say, I did this, and I used this, and, you know. If it was so easy to build seven modules, I would not have bought seven companies.
Right.
I'd have built them as fast as I could. If somebody else says, I've done A, and I can do the other six in the next six months, I'd like to have those people work for us, perhaps.
Do you work now on integrating it into... One of the innovations that we see other companies, they can't compete with you on features, so they compete on presentation. They present it nicely and things like that. Where, by the way.
That sounds like a long-term competitive mode.
I know. However, when they go to customers, they tell them we are inherently integrated, while Palo Alto is a series of acquisitions. The question, there's some truth in the fact that when you acquire many...
I joined five years ago, today actually is June sixth. I joined on June sixth, five years ago. I've heard this story for the last five years. Palo Alto is a collection of too many acquisitions. You guys have an acquisition story. You're still short how to do $2.7 billion in next-generation security with 17 acquisitions. I think at some point, I just got to give it a rest.
Got it.
It works. It's integrated, it works, we make it happen. Yes, we understand the presentation challenge. I think the way I would describe that is, we have a lot of hardcore security researchers who have lived their lives trying to build security products. They don't spend time thinking about pretty things.
Yeah.
We're working on that. We're trying to get less security people, get more pretty people, as in people who care about pretty presentations. We got to be careful, right? We can't just be all looks and no substance.
I understand.
Right now, we're all substance, let alone the looks category.
Perfect.
Unlike other things in life, this one we can take.
Cortex. Another leg of your NGS growth. There are many products inside, and I'm trying, first, at a high level, to understand what's the difference between Palo Alto Cortex and between those endpoint companies like CrowdStrike or Sentinel, that are bringing to the market an endpoint platform, and then they try to go elsewhere?
I think the best way to describe it, for us, the endpoint is a means to an end. It opened it. What I mean by that is, when I came to Palo Alto, we had a SOC, and the SOC was designed to ingest data from a lot of security vendors, and whenever there was a security breach or security issue, our researchers would go in there, figure out tools that would prioritize and tell you what to go pay attention to. I was horrified to learn that it took us days to figure out what the issue was, because there's a lot of data, a lot of vendors. Having spent a little time in your side of the house, I had learned that if your financial services enterprise is down for three days, you get shut down by the regulators.
It is taking me more than three days to figure out what the security issue was, and being a security company, I'm pretty sure our customers would leave us if for three or four days if I have a breach, I don't know what happened. Long story short, in five years, we got it down to under one minute. We can identify a security issue at Palo Alto and resolve it in under one minute.
Mm-hmm.
It took us five years, a lot of technology, collecting a lot of data, and redesigning the endpoint strategy. Our endpoint, XDR, competes technically with every endpoint product in the market. It's better or as good. The magic sauce is when we take all of that data, put it into our new product launch called XSIAM, cross-correlate all the data, and are able to resolve security incidents for customers in under one minute, if they have the right tooling. Right now, we're working on getting them from days to hours, and I think the way to think about our Cortex strategy is the sum total integration of SOC capabilities, endpoint capabilities, attack surface management capabilities, automation capabilities, because at the end, my... I have two pieces.
One piece was, people don't buy platforms because there were no good security platforms that existed. I didn't buy the story that they only want to buy best of breed, you know. Before Salesforce came around, before Workday came around, everybody had their own tools to do Salesforce capabilities or HR capabilities. I worked for a company, we wrote applications. I wrote applications to do financial. At that time, there was no Salesforce, no Oracle Financials. I think the same problem exists in security. There were no platforms. We are slowly seeing the shift to platforms. I think that was one part of the thesis. The other part of the thesis is that the reason we end up in RFPs and people say: Here's 200 things you have to do, is because we don't sell outcomes.
Now I walk up to chief security officer and say: Listen, I can take your response time down from days to hours to possibly minutes. They become less entrenched in what exactly my features are. They want the outcome. For the first time in Cortex, in the last four months, we have built a product that delivers an outcome. I will tell you this, I have not in the last five years, only been in security five years, I have not seen a security product build a pipeline faster than XSIAM in the history of security.
Got it. Okay, one last question.
That doesn't mean translation.
Yes, I understand. One last question, because people need to go to their next meeting. The question that is on everyone's mind, how AI and generative AI impacts your business, good or bad?
I think it's great. I think it's great because I've never seen my team so excited about doing cool stuff with generative AI. I could talk about that for the next 30 minutes, but I have one minute. I would say in one minute, let's not overestimate the short term and underestimate the long term. I think in the three to five year time frame, this thing is gonna change pretty much how every product in the world interacts with consumers, whether it's enterprise products or consumer products. I also believe the resulting tooling that is already happening in AI, and you can see glimpses of it, is gonna make our workers extremely productive around the world, but they will require to be upskilled and relearn things, and there will be new platforms that will have to be deployed in companies.
Got it. Great. I think we need to stop here.
All right.
Thank you so much.
Thank you for having me.
Thank you.