Kelsey Turcotte - Vice President-Investor Relations Mark D. McLaughlin - Chairman, President & Chief Executive Officer Steffan C. Tomlinson - Chief Financial Officer & Executive Vice President.

Sterling Auty - JPMorgan Securities LLC Karl E. Keirstead - Deutsche Bank Securities, Inc. Rob Owens - Pacific Crest Securities Michael Turits - Raymond James & Associates, Inc. Andrew James Nowinski - Piper Jaffray & Co (Broker) Sitikantha Panigrahi - Credit Suisse Securities (USA) LLC (Broker) Matthew George Hedberg - RBC Capital Markets Melissa A.

Gorham - Morgan Stanley & Co. LLC Ryan Hutchinson - Guggenheim Securities LLC Erik L. Suppiger - JMP Securities LLC Jonathan F. Ho - William Blair & Co. LLC Fred T. Grieb - Nomura Securities International, Inc. Gur Talpaz - Stifel, Nicolaus & Co., Inc. Gregg Moskowitz - Cowen & Co. LLC Jayson A. Noland - Robert W. Baird & Co., Inc. (Broker).

Good day, everyone, and welcome to the Palo Alto Networks Fiscal Second Quarter 2016 Earnings Conference Call. Today's conference is being recorded. At this time, I'd like to turn the conference over to Kelsey Turcotte, Vice President of Investor Relations. Please go ahead..

Great, thank you very much. Good afternoon, and thank you for joining us on today's conference call to discuss Palo Alto Networks fiscal second quarter 2016 financial results. This call is being broadcast live over the web and can be accessed on the Investors section of our website at investors.paloaltonetworks.com.

With me on today's call are Mark McLaughlin, our Chairman, President and Chief Executive Officer; and Steffan Tomlinson, our Chief Financial Officer. This afternoon, we issued a press release announcing our results for the fiscal second quarter ended January 31, 2016. If you'd like a copy of the release, you can access it online on our website.

Before going further, I want to acknowledge the inadvertent posting of our earnings press release on our website earlier this afternoon. We've identified this as a manual error and will remediate accordingly so it does not happen again in the future.

I would like to remind you all that during the course of this conference call, management will make forward-looking statements including statements regarding our financial outlook for the fiscal third and fourth quarters of 2016, the spending environment and market opportunity for our products, subscriptions and services, investment in and increasing demand for our products and subscriptions and services from both new and existing customers, trends in certain financial results and operating metrics, our revenue, billings, deferred revenue and free cash flow growth rates, sales productivity, seasonality, operating leverage, ability to expand market share and deliver profitability, hiring expectations, expansion of our partner ecosystem, product and services development and our competitive position.

These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by the statements.

These forward-looking statements apply as of today and you should not rely on them as representing our views in the future, and we undertake no obligation to update these statements after this call.

For a more detailed description of factors that could cause actual results to differ, please refer to our Quarterly Report on Form 10-Q filed with the SEC on November 24, 2015, and our earnings release posted a few minutes ago on our website and on the SEC's website.

Also, please note that certain financial measures we use on this call are expressed on a non-GAAP basis and have been adjusted to exclude certain charges.

For historical periods, we've provided reconciliations of these non-GAAP financial measures to GAAP financial measures in the supplemental financial information that could be found in the Investors section of our website located in investors.paloaltonetworks.com.

For planning purposes, we expect our fiscal third quarter 2016 earnings conference call to be held after the market closes on Thursday, May 26.

We'd also like to inform you that we will be presenting at the JMP Securities Technology Conference on February 29, the Morgan Stanley Technology Media & Telecom Conference on March 1, the Pacific Press Emerging Tech Conference on March 1, the Raymond James & Associates 37th Annual Institutional Investors Conference on March 8 and the Piper Jaffray Securities Symposium on March 9.

In addition, we'd like to invite institutional investors and sell-side analysts to join an Investor Track at Palo Alto Networks Ignite Conference at the Cosmopolitan in Las Vegas. Our program will start with at lunch at noon on Monday, April 4. Formal presentations will kick off at 1:00 p.m. Pacific Time.

While the event will be webcast, guests who attend in person are invited to stay for our user conference, which will run through Wednesday, April 6. To register, please e-mail Shane at sz@paloaltonetworks.com or call him at 408-638-3200.

And finally, at the conclusion of today's conference call, we will be posting our prepared remarks to our Investor Relations website under quarterly results. And with that, I'll turn it over to Mark..

Thank you, Kelsey, and thank you everyone for joining us this afternoon. I'm pleased to report that we had a very strong fiscal second quarter. In the quarter, revenue grew 54% year-over-year to a record $335 million. Billings grew 62% year-over-year for $459 million.

Free cash flow grew 93% year-over-year to $136 million; and we reported non-GAAP earnings per share of $0.40. I'm very proud of our results for the quarter and the teams continued hard work in delivering on our mission to secure the digital age.

Security remains a top strategic priority for global enterprises and organizations, as they realize that without a significantly improved security posture it is likely that the productivity gains from the digital age are at risk.

With this backdrop, it is evident from our results that we continue to capture mind share and market share at very high rates as we become the primary go-to security partner for enterprises globally.

There's a paradigm shift underway as legacy point products that are primarily reactive are rapidly giving way to our next generation platform that not only provides superior proactive security, but also simplifies networks and reduces the total cost of ownership. We are unique in having this platform.

And as a result, customers are standardizing on Palo Alto Networks as their security architecture. We see this in new customer additions, continued strong lifetime value growth and rapidly accelerated adoption of our subscription services.

In Q2, we added close to 2,000 new customers and are proud to now be serving over 30,000 customers across the globe.

Some examples of wins in the quarter include becoming the Advanced Endpoint Protection standard for one of the world's largest consulting and business services companies, where we replaced McAfee; replacing Check Point in a very large U.S.

retailer for both data center and in-store security; and beating Cisco as the standard for company-wide security at one of Europe's largest agricultural producers, as well as at one of the Middle East largest government agencies.

Our technology differentiation, best-in-class customer satisfaction is also reflected in the continued expansion of customer lifetime value. To make to our top 25 customer lifetime value list in Q2, a customer had to have spent a minimum of $11.4 million in lifetime value, compared to $7.4 million in the prior year period.

Also, as an indication of the rapid expansion inside our customer base, 24 of our top 25 customers made a purchase in the quarter as they continue to invest in the complete platform.

The consistent increases in lifetime value demonstrate that not only are customers adding more of our products into their architecture, they're also quickly accelerating adoption of the recurring revenue subscription services that maximize their prevention posture. The result is strong momentum across our hybrid SaaS model.

For example, as of the end of the second quarter, we now have over 9,000 customers use WildFire, including over half of the Fortune 100. We saw the fastest ramp in sales in our history for a new service on our platform with AutoFocus.

We had another very strong quarter and our largest quarter ever for Traps, where sales and new customer additions continue to validate the power and prevention capabilities that come from our platform approach with protection at all stages of the attack lifecycle, from the network to the endpoint.

We continue to expand our presence in the data center and service provider market with both our PA-7050 chassis, as well as our new PA-7080 chassis. We also had the largest quarter-to-date for Palo Alto Networks edition for NSX, the joint solution of our VM-Series and VMware's NSX.

Our success here demonstrates our unique platform capabilities in the cloud. And as we mentioned last quarter, we now serve well over 1,000 customers who utilize our VM-Series offering.

Finally, we substantially expanded our presence within an existing customer, a large financial services company, where we became the security standard for their software-defined data center strategy in which almost all of our services were adopted.

Our plan to drive high growth, capture market share and have all companies adopt all of our platform capabilities is working.

In fact, in Q2, we saw faster adoption of the subscription services capability to the platform than we anticipated; and our second half pipeline review at this stage indicates continued strong adoption of our entire platform, especially subscription services.

Very few companies have been able to sustain this level of growth at our scale, and we know the effort it takes to deliver results so they consistently outpace the competition. Our go-to-market capabilities and demand generation, field marketing, sales, partnerships and customer support are world-class.

I was particularly pleased and proud of the fact that in the second quarter we were recognized by J.D.

Power's and the Technology Services Industry Association for exceptional support services, further evidence of the teams commitment to delighting our customers, which results in a strong competitive advantage for us as we displace existing legacy providers globally.

And we continue to expand our partner ecosystem, including our recent announcement with Proofpoint where we've teamed up to share intelligence on sophisticated attacks, enabling the creation of automated and coordinated protection across our next generation security platform and Proofpoint's targeted attack protection and social patrol capabilities.

As we look forward, we know there is concern in the macro environment. While we do, of course, monitor that closely, some observations early in the quarter are that our customers continue to indicate that security is a strategic issue and hence a priority spend category in calendar 2016. Our pipeline is at a record high.

Our executive briefing center continues to run at very high capacity.

And our partners and sales teams around the world are well-trained in proving that a true platform allows customers to not only have a superior security posture, but also superior ROI total cost of ownership savings since the platform simplifies your network and results in fewer vendors.

Also, I'd like to welcome Frank Calderoni to our board of directors.

With more than 30 years of business and financial experience, including his current role as Executive Vice President Operations and Chief Financial Officer at Red Hat, as well as his previous role as CFO of Cisco, Frank brings a wealth of experience and a unique perspective to the board, and we are very happy to have him.

We look forward to seeing you at RSA next week at an Analyst Day in early April. And with that, I'll turn the call over to Steffan.

Steffan?.

Thank you, Mark, and thank you all for joining us. I'll start by first covering the results for Q2. Then we'll describe the business trends and the financial model, and we'll conclude with Q3 guidance and modeling points. I'd like to note that except for revenue figures, which are GAAP, all financial figures are non-GAAP unless stated otherwise.

Q2 total revenue grew 54% over the prior year to reach a new record of $334.7 million. The geographic mix of revenue for Q2 was 68% Americas, 19% EMEA, and 13% APAC. Compared to the prior year, the Americas grew 56%, EMEA grew 38%, and APAC grew 67%. We saw broad strength across a wide range of verticals and did not have any end customer concentration.

The three components of our hybrid SaaS model – product, subscriptions, and support – all grew well in Q2. Q2 product revenue of $169.9 million increased 47% over the prior year. Growth was healthy across our product portfolio. In particular, the PA-7050 and PA-7080 chassis continue to help accelerate growth in the high-end data center market.

Recurring services revenue of $164.8 million increased 62% over the prior year and accounted for a 49% share of total revenue. Looking at the two components of recurring services revenue, the first component is our SaaS-based subscription revenue of $84.3 million, which increased 68% over the prior year.

Support and maintenance revenue, the second component of recurring services, was $80.5 million, an increase of 55% over the prior year. Billings in Q2 were $459 million, an increase of 62% year-over-year. Total billings for the first half of fiscal 2016 were $847 million and grew 62% year-over-year.

First half product billings were $315.3 million and grew 44%, accounting for 37% of total billings. First half support billings were $250.4 million and grew 72%, accounting for 30% of total billings. In first half, subscription billings were $281.3 million and grew 77%, accounting for 33% of total billings.

Renewal rates remain high and contract duration modestly increased to just over two years. Total deferred revenue grew to $928.8 million in Q2, an increase of 73% year-over-year and 15% sequentially, underscoring the power of our hybrid SaaS model and increasing visibility into future revenue streams.

Total gross margin for Q2 was near the high end of our target range at 77.2%, a decrease of 60 basis points compared to last year and a decrease of 70 basis points sequentially. Product gross margin was 76.4%, a decline of 70 basis points year-over-year and 30 basis points sequentially. The sequential decline was due in part to product mix.

Over time, we expect there will be fluctuations in product gross margin. Services gross margin for Q2 was 78.1%, a decrease of 60 basis points year-over-year and 90 basis points sequentially. The sequential decline was due in part to investments in WildFire and AutoFocus as well as customer support.

Total head count at the end of the quarter was 3,343, up from 2,998 at the end of the prior quarter. We continue to thoughtfully add talent across the business as we scale to support our growth. For the quarter, research and development expense was 11.2% of revenue, increasing approximately $3.5 million sequentially to $37.5 million.

The increase was primarily due to head count. Sales and marketing expense for Q2 was 43.7% of revenue, increasing approximately $16 million sequentially to $146.1 million. This was primarily due to our strong Q2 billings performance and the associated sales commissions.

G&A expense for Q2 was 5.4% of revenue, increasing approximately $400,000 sequentially to $18.1 million. In total, Q2 operating expenses were $201.7 million or 60.3% of revenue. Q2 non-GAAP operating margin was 16.9%, representing growth of 450 basis points year-over-year and 20 basis points sequentially.

Net income for the quarter was $36.3 million or $0.40 per diluted share using 91.7 million shares, compared with net income of $16.9 million or $0.19 per diluted share in Q2 2015. Our effective non-GAAP tax rate for Q2 was 38%. On a GAAP basis, for the second quarter, net loss was $62.5 million or $0.72 per basic and diluted share.

This compares with a Q2 2015 GAAP net loss of $43 million or $0.53 per basic and diluted share. We finished January with cash, cash equivalents, and investments of $1.6 billion. Cash flow from operations, free cash flow, and free cash flow margin for Q2 were $153.8 million, $136.4 million, and 40.7%, respectively.

Capital expenditure in the quarter totaled $17.4 million. The accounts receivable balance was $254.4 million in Q2, up from $196.4 million in Q1. DSOs decreased sequentially by one day and increased year-over-year by nine days to 61 days.

With the Q2 recap completed, I'm now going to provide some perspective on the momentum we've been seeing in the business year-to-date and an update to our target model for exiting Q4 fiscal 2016.

We have been and we remain committed to driving growth and profitability, and the growth engine has never been stronger, as evidenced by new customer additions, expansion in current customers, and continually increasing sales productivity.

Billings, revenue, and deferred revenue are very robust and have far exceeded the rate of the market growth and our competition. With our hybrid SaaS model, we have delivered top line growth with expanding non-GAAP operating margins and generated significant free cash flow.

Customers are increasingly buying all elements of our platform, which has been our strategy and has long-term benefits for our financial model.

As a result, we're in a good position to exceed our internal sales expectations, particularly in the rate of services adoption, which you can see in the billings mix, which is now 63% services for the first half of fiscal 2016 compared to 58% for the first half of fiscal 2015.

Over performance in billings, which drives the mix towards ratable services, means higher deferred revenue and higher free cash flow. It also means incurring 100% of the commissions' expense in period against the higher ratable revenue, and, as a result, slower near-term growth rate of non-GAAP operating margins and EPS.

As we head into the second half of the fiscal year, our pipeline is at record levels and indicates strong year-over-year growth in product billings, and with the faster rate of subscriptions adoptions, the pipeline indicates continued over performance in services billings relative to our original forecast.

For this reason, we're making two updates to our full-year guidance.

First, given the timing mismatch of higher services billings and ratable revenue with higher in-period commissions' expense, we now expect to exit Q4 at approximately 18% to 19% non-GAAP operating margin, which represents approximately 400 basis point to 500 basis point increase year-over-year.

And because of the over performance on billings, we are increasing free cash flow margin estimates to approximately 40% for Q3 and Q4 of fiscal 2016. We continue to refine our target model, which will call for increasing our long-term profitability targets, and we look forward to sharing it with you at our Analyst Day on April 4.

With less than 10% market share in an $18 billion total addressable market, barring any systemic macro issues, we are well positioned to continue to deliver strong top line growth and profitability. Now turning to the fiscal third quarter guidance and modeling points.

We expect revenue to be in the range of $335 million to $339 million, which represents 43% to 45% growth year-over-year. And we expect non-GAAP EPS to be in the range of $0.41 to $0.42 per share using 90 million to 92 million shares.

We are starting to see some moderate seasonality in our business with fiscal Q2 and Q4 showing our strongest sequential revenue growth. And we continue to expect CapEx for fiscal 2016 to be in the range of $85 million to $90 million, which includes investments in infrastructure, cloud services and facilities to support the growth of our business.

With that, I'll turn the call back over to the operator for Q&A..

Thank you. The question-and-answer session will be conducted electronically. Also, please limit yourself to one question and one follow-up question. And our first question comes from Sterling Auty with JPMorgan..

Yes. Thanks. Hi, guys. I know you've mentioned the momentum in the business, but, you're right, everybody is very concerned about the macro.

Can you give us maybe a little bit of color by some of the major theaters, Europe versus North America; are you seeing any lengthening sales cycles or anything else to be concerned about on the macro side?.

Hey, Sterling. It's Mark. A couple of anecdotal points there. One, in the quarter itself, we have January in the quarter and the linearity for the quarter was exactly the same as historical precedent. So we didn't see anything happen in the quarter that would raise any concern around that. I travel around all the time myself globally.

I had the chance in January to be not only in Europe, but in Asia as well. And all the places that I went to, the customers that I talked with said that security remains a priority spend item for them as well.

So we haven't seen anything to indicate that what we're seeing in the stock market means anything about the macro economy yet, but we watch that closely..

Got it. And then one follow-up, on the product gross margin, can you maybe give a little bit more color there? You mentioned the mix, but in the prepared remarks you were kind of highlighting the higher end solutions is having particular strength. I would expect that to be good for product gross margin..

It is good for product gross margin. But remember, as I've highlighted in the past, whenever we come out with a new chassis or a new product, there is usually a slightly depressive effect on near-term product gross margins because we haven't achieved volume. So costs are a little bit higher than they will be on a go-forward basis.

That's definitely true with the PA-7080, which was introduced a relatively short time ago. So even though we saw a very strong contribution from our higher end products, there was a slightly depressive effect until we get to scale..

And our next question will come from Karl Keirstead with Deutsche Bank..

Thank you. Steffan, if we could go to the 4Q operating margins and the decision to lower the guide somewhat, I just want to make sure I understand. I feel like Palo Alto Networks has been over performing on the billings actually for several quarters now and you've been able to meet roughly the non-GAAP operating margin guide and expectations.

So what's changing in 4Q? Is it that you expect a particularly strong billings performance as a result of a good subscription attach? Or maybe is some other element in the model changing that sort of didn't give you the lever to offset it? Maybe a little color would be helpful. Thank you..

Sure thing, Karl. What we're seeing is customers adopting all elements of our platform, which is very positive for us.

In fact, the attach rate concept that we've introduced over the last few years is becoming less and less relevant mainly because now we have seven subscriptions that we are selling; and three of the newest ones are Traps, AutoFocus and Aperture.

So with the adoption of the overall platform, we are looking at outsized billings numbers; and that's driving incremental billings. So because those subscription services are effectively deferred revenue and they become ratable revenue. We have 100% of the commissions that we are getting in period.

So with the mix shift happening, that's what you're seeing. And so kind of bridging from, call it, 22% at the low end of our range to roughly 18% to 19%, the vast majority of that is commissions; and there's a little bit relative to the mix..

Okay. Helpful color. Thanks a lot, Steffan..

Yeah..

And our next question will come from Rob Owens with Pacific Crest Securities..

Great, and thank you for taking my question. So if we look at the billings strength, you did see a shift to more long-term contracts. And is that just a function of the environment right now and people are locking in? I would think given the speculation of weakening things it'd be going the other way, so just a little color.

And I realize it was a modest extension duration, but you long-term did show some nice outperformance relative to the expectations..

Well, we are seeing customers standardizing on our platform. They want to go with multi-year. The net effect of that for contract duration was actually very de minimis, just a modest uptick. If you look at the actual dollar growth from a short-term deferred revenue standpoint, short-term deferred actually grew more in terms of dollars than long-term.

So we're seeing a nice pickup in both short-term and long-term. But to your broader point, customers want to standardize on the platform of choice and they want to be locking in for a number of years. That's all good for us..

Hey, Rob, and this is Mark. That's exactly what we've always wanted to occur and we hope to continue to drive that in the business where folks are making these architectural decisions with Palo Alto. And there I think the market's really starting to realize that the more the prevention capability that they adopt, the better their prevention gets.

And you can see that with the growth in subscription services..

And for my follow-up, just want to touch on the partnership with Proofpoint.

And I guess at a higher level, the concept of threat intelligence and where you guys are sharing back and forth, is there an opportunity for you to monetize some of this threat intelligence? Or as a solutions vendor, is it a given that your products should inherently lever this knowledge to increase efficacy?.

That's a great question, Rob. And I get that from customers all the time. So big picture is the way that we monetize intelligence is in the platform itself. I mean the platform is a high proactive prevention capability. And the more intelligence we have in the platform, the better job we do at that.

So with that in mind, we have an insatiable desire for threat intelligence and being able to partner up with Proofpoint to have everything they're seeing from an e-mail gateway perspective is beneficial for us and vice versa for them.

Really interesting, when I'm talking to customers, I have a lot of customers who are telling me that they think the day of security vendors trying to monetize intelligence is long over. And they're very upset with security vendors who come in and try to sell them intelligence as a service, where they're trying to monetize that.

And I think that's going to change pretty rapidly into the future where you just better be able to take intelligence and put it in your platform for your products and do something with it for the customer; and that's where the value proposition will lie..

And our next question will come from Michael Turits with Raymond James..

Hey, guys. Although, obviously, with that mix shift, you've – less than the expected EBIT margin on the exit rate, but really strong guidance at the 40% of free cash flow margins. So two questions.

One, if we look out long-term -and I know you said that you'd address that at the Analyst Day – do we return to kind of reasonable amounts of growth in the EBIT margin? And also, is there anything unusual in those 40% free cash flow margins or is that sustainable and is that something we should see expansion in?.

Well, as we indicated in the prepared remarks, longer term, this business will generate much higher EBIT margins, as we call them operating margins here, over the longer term for sure.

The dynamic that you're seeing now is given that there's more adoption of services and you have higher services billings, because of the commissions expense being hitting in period, as the revenue is coming off the balance sheet, that's going to be accretive to margins down the road. So this will be a building margin story.

I think one of the most important things which you've highlighted, Michael, is we just grew free cash flow 93% year-over-year and we're basically looking at very high free cash flow margins. Many companies have a correlation, a near-term correlation between operating margin and free cash flow.

If operating margins are coming down on a growth rate basis, free cash flow typically comes down. That's not the case with Palo Alto Networks. Because of our powerful hybrid SaaS model, we are actually delivering much more free cash flow than operating margin, and we feel very good about the overall growth engine in the business..

So as I said, just via follow-up, just to clarify anything, it's strong, but, I mean, as we look forward, is there anything that is one-time of nature in those 40% free cash flow margins? Maybe what happens with cash taxes? How should we think of that trending over time to the extent that you can help us out there?.

Yeah. We'll give you more color commentary on the convergence of free cash flow margin and operating margin over time. But for the foreseeable future, call it the next at least three years, there should be a pretty wide separation, positive separation, between free cash flow and operating margins.

Over time, those numbers will converge because we will become more of a cash taxpayer, and that will – that plus a couple of other things will see the spread narrow. But for the foreseeable future, there should be a pretty wide spread between free cash flow and operating margin..

And, Michael, it's Mark. There is no one-time aspects in the free cash flow numbers you're looking at right now..

And our next question will come from Andrew Nowinski with Piper Jaffray..

Hi. Thanks a lot, and congrats on the nice quarter. Maybe just to start, I had a question on product revenues. So it was up 47% year-over-year, which was not only an acceleration from last quarter, but also one of the strongest growth rates we've seen with the exception of fiscal Q4 of last year.

But your total customer count continues to go up by about the same amount, in that 2,000 range.

So is product growth coming from a hardware refresh cycle within your installed base, or are they just purchasing more of your products within your platform?.

Yeah, Andrew. Yeah, you can see product growth or platform growth – generally, right, and then product growth since that was your specific question is going to come from a number of areas. One is continued customer acquisition. You saw almost 2,000 new customers.

That's a great land engine for us, and that continues to drive the entire platform, including products. So that's very healthy. The second thing is expansion inside the existing customer base. As we get bigger and bigger, more and more of our business will come from expansion opportunities instead of the – or in addition to the land opportunities.

Expansion is going very nicely, as well. And then, the third is we're growing a very large base of business here as far as customers, all with products and all of whom would at some point will refresh those things.

When we think about what that can look like into the future using sort of a five-year rule of thumb on refreshes, that would take us back basically to the 2011 cohort. If we added up 2009, 2010, 2011, it's about 4,000 customers total across those three cohorts, which means there's 26,000 more after 2011.

And when we throw in close to 2,000 customers a quarter on top of that, that's a gift that just keeps giving into the future..

That's great. Thanks. And then just a follow-up. If we go back to your comments in fiscal Q4 of last year, you said that Traps would be a material contributor to revenue in FY 2016.

I'm wondering if you could put any parameters around that in terms of what we should expect now that we're in the back half of the year?.

Yes. Yeah, so what we said was we thought it would be like a more material contributor to the overall business, and we've seen that. We've seen a record quarter for Traps in terms of billings. However, because it's a subscription-based revenue model, revenue will be coming off the balance sheet coming into the P&L.

So that is more of a future growth driver for top line revenue. It's definitely been a more meaningful growth driver for billings, but it's coming off of a relatively small base. So we feel very good about the endpoint business. It helps complete our platform story.

And we'll give you more color at Analyst Day about customer accounts and that sort of thing, but there's been very nice traction there..

And moving on to Philip Winslow with Credit Suisse..

Hey, guys. This is Siti Panigrahi for Phil. Congrats on another awesome quarter. I just wanted to drill into the subscription business. Good to see solid growth there. Last time, you gave subscription attach rate around 2.2% per box. Just wondering if you have any update on that, what you're seeing there.

And also, one of your new subscription, just wondering what kind of feedback you're getting on AutoFocus? That would be great..

Yeah, great. This is Mark. On the attach rate side, attach rates are good and growing. We'll give you more color around that at Analyst Day in about 35 days or so, but the attach rates continue to do very well. And then, on the new services, which are in the order of history they're Traps, AutoFocus, and Aperture.

Traps, Steffan just spoke to, continues to do very nicely for us. AutoFocus you may have heard, I mentioned in my prepared remarks, we've enjoyed the fastest sales ramp in the history of the company for a new service with AutoFocus. So there's great demand for that.

And a very strong pipeline for Aperture as well, as people continually get interested into the CASB space for third-party applications. And I just want – hearkening back to the attach rate thing as well, and we'll discuss this in more detail at Analyst Day.

As we continue to have more services that don't have attach rates on them, we'll talk through how that impacts the concept of attach rates, that I think will become increasingly irrelevant to the business over time.

And we're just thinking more in terms of billings or subscription billings on this service because it's how much dollars that comes in that really matters..

Got it. Thank you..

And our next question will come from Matt Hedberg with RBC Capital Markets..

Yeah, guys. Thanks for taking my questions. Another one on Traps. It sounds like there was a nice McAfee AV replacement in the quarter. I'm curious, do customers normally replace their anti-virus solution completely with the Traps install? And I'm wondering if you could talk about the drivers for adoption versus legacy solutions.

Is it cost, is it better prevention, or maybe a combination of the two?.

Hey, Matt. It's way more about security than it is about cost.

So folks are more and more realizing that if you're thinking about security and prevention, which is what they want to do, where the data is, a lot of data is at the endpoint, and that's one of the easiest ways to get into the network, as well, as AV continues to be less and less relevant there for them.

So on your first question, folks want to, I think, more and more want to replace AV, not because it's so much they want to get rid of AV, but they just want to have security that would actually work for them.

In the cases where we've seen people who said I have to have or really want to have AV, it's become more and more places that have to do that for compliance reasons or audit reasons, and they're doing something additive on top of that. But the primary driver there is security.

The other interesting thing that we hear a lot, and it's really analogous to where we started in the firewall space and in all the other components that made their way into networks over time because stateful inspection firewalls weren't working for them as they built more and more complexity in the network, is the same thing on the endpoint.

So people, they're not interested to add one more agent onto the endpoint. They have a lot of them there. So the same kind of simplification for better security that would result in better total cost of ownership, but primarily simplified on the endpoint of better security is a driver.

And it's very analogous to what we saw when people said, hey, I don't want firewall plus, plus, plus, plus, plus, right? They want the simplicity of the network and better security. So it's working just on the endpoint as we thought it would, and we have a lot of experience in selling that kind of concept from our network genetics..

That's great. And then, Mark, I think you called out the PA-7080 box in the prepared remarks.

Could you talk about some of the performance benefits there versus some of the other high throughput boxes? And how are yours holding up under pressure now that they are under increased traffic now that you've got some more history there?.

Sure. Well, the PA-7080, so everybody knows that's our latest chassis. It's a 200-gig throughput, and it has 10 slot cards in there, right? So that's what it looks like. And it's pretty exciting in the data center and service provider space because it is very high throughput.

But even more important than the high throughput, it has all of the security capabilities that Palo Alto's known for now from a prevention perspective.

So you get the best of both worlds with all those prevention capabilities and increasingly a higher throughput with none of the degradation of performance that you get with stateful inspection firewalls when you have to turn on various concepts that really reduces those throughputs.

So one of the favorite angles for competitors is to talk about faster and faster and faster stateful inspection firewalls, partially because they have to, because every time you turn on one of these other cobbled-together capabilities for IPS or filtering or APT or something like that, it seriously degrades the performance in the first place; and that's something that we don't experience because we have a single-throughput engine.

So we've gotten really high marks in the market so far for this..

And moving on to Keith Weiss with Morgan Stanley..

Hi, guys. This is Melissa Gorham calling in for Keith. Mark, I just have a high-level question. So the growth is clearly pretty impressive, are very impressive on the billings line. And as you look across your universe, it seems like some of your peers are seeing decelerating growth.

So it does seem as though potentially your share gains are accelerating.

Is that the right way to think about it? And how much runway do you think that you have in terms of share gains within the core network security market?.

Yeah. That's a great question, Melissa. Couple of angles or ways to think about there or at least the way we think about that.

And if you start with the size of the addressable market, as you know it's very big, and us at high single digits or about 10% market share, there seems to be a lot of runway from an addressable market opportunity capture perspective. And then inside of that, who is capturing what, right? So there's money here, it's up for grabs.

I did a simple math experiment the other day just because I saw some third-party numbers on market share, and they tend to be kind of confusing to me because it's really hard to tell who's doing what there.

So what I did was I took five vendors – Palo Alto Networks, Cisco, Check Point, Fortinet, and Juniper – and using the last calendar reported quarter, meaning this one for us and their fourth quarters for everybody in fourth quarter, I added up the year-over-year increase in revenue across all five of those vendors; and the total amount of new revenue across all five of those vendors was about $300 million.

That's the total, right, of pie that everybody added. And inside of that, Palo Alto is about $120 million of the $300 million, okay. The average is $58 million, roughly $58 million if you do the math. So we're about $120 million of that, right? And I can give you the other numbers if you care about that.

But I think it's very obvious that we're taking share from everybody in the space in order for those kinds of numbers to work out that way..

Okay. That's actually – that's really helpful. And then just one quick one on the federal opportunity. There's definitely more of a push from the administration on enacting cyber security laws and also incorporating more into the budget.

And I know there's nothing necessarily concrete today, but can you just give us a high-level overview of what you're seeing in terms of federal traction and then what you're expecting in terms of growth?.

Yes. Our federal business is good and growing. So it's a market we like a lot, not surprisingly, given what our technology does and what the government more and more needs and recognizes they need.

A couple of things that are interesting, you noted that – or I think you were noting that recently President Obama came out and called for a 40% increase in cyber security spending. You will see what happens with that. That's a request, not an order, right? So we'll see what happens with that.

But obviously if there was that amount of spending there, it's $5 billion of additional dollars if it comes into the federal budget, specifically for cyber security.

And on the same day he announced that, the Director of National Intelligence said that cyber security is the number one national security issue facing the United States, right? So I think the amount of attention from the government on cyber security is very, very high and could even be higher.

But more interesting than that, they're really trying to put their money where their mouth is here with some of these announcements of what we have to do to take legacy architecture across the federal space and get it into next generation platforms, you could really do prevention..

And the next question will come from Ryan Hutchinson with Guggenheim..

Great. Thank you. Steffan, my question is on billings. I know you don't give guidance, but one way to look at it is as a percentage of revenue. It stands at 137%, which is the second highest ever outside of Q4 last year.

So given we're going into a seasonally weak period, obviously offset by some subscription attach rates in this platform play you've alluded to, is this trend sustainable? Any color there would be helpful. Because basically you can look at this one of two ways.

If it turns back towards more of an average of where you've been over the last eight quarters, billings will be down sequentially. If you look at the other way, the trends flat to slightly – flattish, let's call it, billings actually could be flat to slightly up? So that would be my question..

Okay. Yeah, so because we don't guide on billings, I can just give you kind of directional commentary. It would be candidly be a surprise to us if we went backwards on billings on a sequential basis.

The power of the platform, the pipeline that we have, you look at how the setup is for Q3 and Q4, even though we are in a relatively seasonally weak quarter in Q3, we are still looking for growth. And so that would be my answer. I can't give you a rule of thumb relative to where billings in revenue is.

But with more subscriptions being adopted – and I'll parse that out – more being attached and then more of the three subscriptions that we are selling without being attached, there should be good growth there..

Okay.

So it'll grow sequentially is what you're telling us?.

Directionally..

Thank you..

And the next question will come from Erik Suppiger with JMP Securities..

Yes. Just first off on the duration.

Steffan, can you give us a heads-up on where that was last quarter or the year ago quarter?.

Yes, it was shy of two years last quarter. And I'd have to pull up where the year ago quarter was, but there has been – we've been calling out that there's been a modest uptick in duration. But quarter-on-quarter, we're talking it's measured by in the couple of months type of thing. So not a very big move up in duration..

Okay.

And then on the services growth, is that driven more by the installed base going back and up-selling or is that equally driven by new products going into new customers?.

It's a combination of both. But what I can tell you is we've seen fantastic opportunity going back into our installed base, selling them more elements of the platform. They are adopting a lot more subscription services than they have in the past, both the ones that attach to the devices and in the new subscriptions.

So proportionately, given the fact that we have, call it, 30,000 customers, or heading into this quarter, we've got 28,000 customers, the pie is much bigger there than the new customers that are being brought into the fold. So the expansion opportunity is definitely bigger than the new opportunity.

The up-sell and cross-sell that we are able to do is a testament to our go-to-market functionality that we've put in place with Mark Anderson leading the charge there. We've been able to really put in programs to monetize the accounts..

And our next question will come from Jonathan Ho with William Blair..

Hey, guys. Congrats as well on the strong quarter. I just wanted to understand you guys talked a little bit about strength in your NSX business.

I just wanted to get a sense from you or some additional color in terms of what may be driving this as well as maybe what you're seeing in the data center market?.

Hey, Jonathan. It's Mark. Something we've seen for a while and I've mentioned it before is that when customers are thinking about security there, you're thinking less and less around topology and more around data and prevention, right? So what they want to do is make sure that they have this best prevention posture they can have wherever the data is.

So when you think about where is data going, a lot of – more and more and a lot of it's going into public and private cloud environments and next generation data centers, right?.

And when that's where it's going, we want to make sure it's secure; and that's I think partially what's driving a lot of strength in NSX itself, right? And then with our relationship with VMware with the integration of VM-Series in there that's better and better that they are going to do in that space, and they've been reporting pretty good numbers there.

That's a great opportunity for us as far as where we can hunt along with them to provide the security..

Got it.

And then can you talk a little bit about sort of the investments that you're making on an international basis, whether you're sort of pleased with the performance that we're seeing out of EMEA and APAC, and just sort of what you think those regions, the potential could be over time?.

Yeah, we're pleased with the international performance. You can see, if I back away from that for a minute that just the North America which is continued powerhouse for us. So it's fantastic to see a business of the size of North America continue to grow at the rate that it's growing.

I think that just shows how much demand there is still in a mature market for Palo Alto with single-digit market share. And then, when we look internationally as well, we're seeing strong international growth.

I think you can see in our numbers there, we had a very strong quarter in APAC quarter-over-quarter or year-over-year, and we also had a good quarter in EMEA, as well.

As we continue to make investments in various areas, we expect to continue to grow these businesses, and our market share in those markets is even lower than it is in North America today. So there's even more upside..

And our next question will come from Fred Grieb with Nomura..

Hey. Thanks, guys.

First up, going into RSA, can you discuss customer interest in WildFire versus Traps? I know for a few years APT has sort of been a top priority for CSOs, but is there any chance you're seeing the shift towards the endpoint this year?.

Hey, Fred. I think – I'll make a prediction. It's RSA, and it's always dangerous to make predictions, but I think you're going to see at RSA this year a lot more folks than just Palo Alto talking about prevention. Last year, we were talking a lot about platforms, and people came around to that thinking right away from a marketing perspective.

And I think you're going to see a lot more people trying to market around prevention now that we've shown that that's the right approach to this philosophically. And when you're doing prevention, you have to do it everywhere, right? Wherever the data is, as I was saying, a little earlier.

And I think there will be a lot of focus and conversation around endpoints, given that prevention historically has been pretty weak there. And that's why people are adopting Traps so rapidly. So I would expect that to be the case.

On the WildFire side, while thinking about advanced persistent threats and threats and how do you take an unknown threat and turning it into a known threat, that's as relevant as it ever has been.

It's probably going to be incredibly relevant into the future because it's the unknown threats are the ones that are going to get you, and that's why people are adopting WildFire so rapidly, as well..

Got it.

And then, maybe can you provide a little bit of background on why it made sense to partner with Proofpoint instead of bringing to market your own solution?.

Well, Proofpoint's an email – primarily email security company, right? So they're sitting in front of an email server or gateway with their technology, and that's messaging security. So if you parse out the whole security industry, messaging security is separate from traditional network security.

We're just in different markets with very complementary capabilities. Things that come through email are interesting to us from a threat perspective because sometimes it's the first place you see something, and there's obviously a lot of phishing attacks and things like that.

So getting the ability to gather the information from a threat perspective from somebody like Proofpoint and put it into WildFire makes WildFire very powerful.

On the flipside, for them as well, everything that we're seeing from endpoints and networks that are related to threats that they in turn can use to make their technology smarter about the threats, as well, makes sense, too. So it's a very symbiotic relationship..

And next question comes from Gur Talpaz with Stifel..

Great. Thanks for taking my question. So as customers migrate workloads into the public cloud, have you seen any sort of pick up in interest for the VM-Series for AWS? And then, I guess, more broadly speaking following up, how do you feel about AWS and public cloud adoption more broadly impacting your business? Thank you..

Hi, Gur, it's Mark. Yeah, so for AWS, I think we mentioned in the last call that we had – well, on this call, we mentioned we had over 1,000 of our customers and growing using our VM-Series, right? So start with that as sort of the baseline.

And then, the VM-Series capability in use and integrated at different places is growing well, too, like NSX in a private cloud environment. I think last quarter we said we had over 100 customers currently using our VM-Series and AWS, and that's growing, too, and we'll update you all that – on those kind of things at Analyst Day.

So what we're seeing, again, is folks saying where is my data, and I need to protect it. And we don't want security to be an inhibitor about where the data can be.

So if it's going to the public cloud, and workloads, a lot of times developers just put it up there, and the security guy doesn't even know about it yet, right? Those are the kind of things that worry security people. So they're going to make sure that they can – they want to make sure that they can secure those things.

On the general question of AWS as a platform versus security, AWS is doing a lot and will do a lot to secure the platform itself, right? But from a security perspective of things like applications and network connections back to the ones who are consuming this stuff, the enterprise who consume this stuff, that's not something that they do, and I doubt that they will, because that's where companies like Palo Alto Networks have spent a decade honing prevention capabilities.

And that's why having a capability in AWS is very powerful..

And next will be Gregg Moskowitz with Cowen & Co..

Okay, thank you. Thank you very much. Mark, I'd like to go back to your comment on AutoFocus being the fastest ramp of any Palo Alto subscription. My understanding is it's sold per security operator.

And because of that, I was always wondering how big would this market be, and would it just be relevant to a fraction of your very high-end customers? So is the strength that you saw mostly a function of high ASPs, or are you also seeing pretty broad customer uptake out of the gate? Anything you can do to sort of help size the AutoFocus opportunity would be helpful..

Yeah, sure.

So if I back up for a second, just say for AutoFocus, list price that is $35,000 a year per operator, right? So think of this as a tool that an operator would look at and get highly correlated, relevant intelligence that can give them things to do proactively about threats in their network based on everything we're seeing from 30,000-plus other networks today and growing.

So that's what it is, right, and that's the price point today. As I noted, that is the fastest growing service we've ever had, which is fantastic. I think the appetite for people to want to do proactive prevention is very high, and the ability to bring that kind of hardcore correlated analytics to bear is interesting.

It's been interesting to large companies and medium-sized companies, as well. So what we've seen so far in selling is that people understand it very quickly. Now in the base of customers, large companies are going to have a lot more operators than small companies.

So we have seen, and we expect to see some companies will buy one of them – from a license for one of them for one operator, and larger companies will buy multiple licenses for multiple operators. So the early view on this is it's got a very wide applicability..

And our last question will come from Jayson Noland with Baird..

Okay. Thanks for fitting me in. Mark, I wanted to ask about non-perimeter defense. Palo has a network segmentation gateway. Others have talked about their internal segmentation firewall.

What are your thoughts on this market today, and what should we expect down the road?.

Yeah, I think segmentation is very important and customers want to do that. And I think they're going to try to do it and basically should do it everywhere they can. So they may do segmentation on internal networks from a user perspective and segmentation of data on externally facing servers and data centers, and that's a good idea.

I really don't think there's any correlation between the two from how many, what are your needs internally versus what your needs are going to be externally. There's no correlation about doing more in one area is going to reduce it in others. It's just a good hygiene idea to do segmentation wherever your data is.

And the more they want to do it in the internal, that will drive internal business. The more they want to do external will drive the external business. But I wouldn't think of that as an either or, I think of that as both..

Okay. And then as a follow-up, you mentioned the seven subscription modules earlier.

In calendar 2016, is the focus on ramping some of these newer modules versus launching new modules?.

It is. So what you've seen us do in the past is be thoughtful, I – we think we're thoughtful. Hopefully you would agree with this, but be very thoughtful from a platform perspective that does prevention as to what should be in the platform, right? So we're not attempting to roll up the security industry just to have a lot of stuff.

What we are trying to do is to make sure that when we think about the attack lifecycle and every chance we can get to interdict an attack before it can ultimately be successful across the lifecycle, can we have a very good and increasingly better and better and better prevention capability at every one of those points.

And that's really the philosophy that's driven the company in our entire roadmap over last 10 years and will into the future. So we would, I'd expect, that we would have more services later as the attack landscape changes. And we'll definitely want to make sure that we are wherever the data's going to be..

And that does conclude the question-and-answer session. I now turn the conference back over to you for any additional or closing remarks..

Great. Well, thank you, everybody, for joining us this afternoon. I'm really excited about the future, and I'd like to thank our customers, partners and the whole Palo Alto Networks team for their hard work and support. And we look forward to seeing many of you at Analyst Day in April. Thank you..

Thank you. And that does conclude today's conference call. We do thank you for your participation today..