Good morning. And thank you for joining us on today’s conference call to discuss Palo Alto Networks’ Fiscal First Quarter 2021 Financial Results. I am Karen Fung, Senior Director of Investor Relations. This call is being broadcast live over the web and can be accessed on the Investors Section of our website at investors.paloaltonetworks.com.

With me on today's call are Nikesh Arora, our Chairman and Chief Executive Officer; Luis Visoso, our Chief Financial; and Lee Klarich, our Chief Product Officer. This morning, we issued a press release announcing our results for the fiscal first quarter ended October 31, 2020.

If you would like a copy of the release, you can access it online on our website.

We would like to remind you that during the course of this conference call, management will make forward-looking statements, including statements regarding the impact of COVID-19 on our business, our customers, the enterprise and cybersecurity, industry and global economic conditions, our expectations related to financial guidance, operating metrics and modelling claims for fiscal second quarter and full year, expenses contribution to our fiscal 2021 ARR, our expectations regarding the timing of completing our acquisition of Expanse, our competitive position and the demand and opportunity for our products and subscriptions, benefits and timing of new products, features and subscription offerings, including those from our proposed acquisition of Expanse, as well as other financial and operating trends.

These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today.

You should not rely on them as representing our views in the future, and we undertake no obligation to update these statements after this call.

For a more detailed description of factors that could cause actual results to differ, please refer to our annual report on Form 10-K filed with the SEC on September 22, 2020, and our earnings release posted a few minutes ago on our website and filed with the SEC on Form 8-K.

Also, please note that certain financial measures we use on this call are expressed on a non-GAAP basis and have been adjusted to exclude certain charges.

For historical periods, we have provided reconciliations of these non-GAAP financial measures to GAAP financial measures in the supplemental financial information that can be found in the Investors section of our website located at investors.paloaltonetworks.com.

And finally, once we have completed our formal remarks, we will be posting them to our Investor Relations website under the quarterly results section. We'd also like to inform you that we will be virtually participating in the Wells Fargo TMT Summit on December 1 and the Barclays Global TMT Conference on December 10.

Please also see the Investors section of our website for additional information about conferences we may be participating in. And with that, I will turn the call over to Nikesh..

Zero Trust eXtended Ecosystem Platform Providers report. Noting that we have assembled a robust portfolio that delivers zero trust everywhere, on-premise in the data center and in the cloud.

Our strategy in firewall is working as Firewall as a Platform grew billings by 16% in Q1 2021 and we added approximately 2000 more customers for a total of 71,000 next-generation firewall customers. Our software next-generation firewalls, VM-Series, and CN-Series continue to gain momentum as well.

And we now have over 10,000 customers using our software firewalls. Moving on to our SASE or secure access service edge solution, Prisma Access and CloudGenix, as SD-WAN has become the primary WAN architecture, organizations are demanding solutions with a better user experience while being simpler to deploy and manage.

In the quarter, we introduced a number of new additions to our next generation SD-WAN solution, CloudGenix. This included new AML-base capabilities to enhance our AI Ops approach and further simplified network operations.

Two new SD WAN appliances, a small form factor appliance designed for retail and small offices and home offices and high performance applications suited appliance suited for large campus and data center locations.

We also delivered the first CloudGenix and Prisma Access integration which seamlessly enables cloud delivered brand security in just a few clicks. In addition to the Gartner Magic Quadrants network firewalls, Palo Alto Networks’ CloudGenix SD-WAN was recognized as a leader in the 2020 Gartner Magic Quadrant for WAN Edge Infrastructure.

For many of our customers, COVID accelerated the digital transformation timelines, and we continue to see conversion and remote access trials and very strong pipeline generation. We now have more than 1000 Prisma SASE customers, more than double from a year ago. To highlight a deal from the quarter, we won a seven-figure SD-WAN deal with a U.S.

retailer who had already been a Palo Alto Networks customer for a number of years was an early adopter of Prisma Access. The success that we had with Prisma Access and the strong integration with CloudGenix was a winning combination. And this customer is now a full SASE customer. Switching to Prisma Cloud.

Prisma Cloud is very well positioned for sustainable growth as it is at the heart of the global shift to cloud computing.

In Q1 2021, we launched Prisma Cloud 2.0 introducing four new modules to enable customers to easily and rapidly extend their cloud security coverage in a number of critical areas, all within a single cloud native security platform.

These modules are data security, which discovers and protects cloud storage data at a scale and velocity common in public cloud environments and addressing one of the most common data exposure issues in cloud transformation, includes web application and API security, which protects web applications from attacks.

Our approach addresses the challenges of deployment, complexity and scalability by leveraging the same agent as our container and host security, making it very easy and horizontally scalable.

We launched identity-based micro-segmentation with the integration of Aporeto technology, enabling zero trust security for cloud applications in a cloud native identity based approach.

And lastly, IAM Security, which allows security teams to gain visibility into effective cloud identity permissions, user activity, implement governance and respond to issues. While only recently introduced we are excited about the strong customer interest we’re seeing.

Prisma cloud now serves 20% of the Global 2000 companies, 70% of the Fortune 100 companies and secures 1.8 billion cloud resources. This customer momentum is up from the 14% of Global 2000 companies reported last quarter and up significantly from the 43% of Fortune 100, that we reported two quarters ago.

We're also seeing substantial increase in Prisma Cloud customers are using both cloud security posture management and cloud workload protection for containers and serverless applications now at 45%, up from a third we reported last quarter.

To highlight the benefits of our consumption model, we won a high seven-figure deal with a leading technology company to use Prisma Cloud for CSBM for AWS and cloud workload protection. This customer has quickly consumed the workloads purchased and we are working with them to support the expansion to new clouds and new workloads. Moving to Cortex.

Cortex is on its way to being the industry's first proactive security platform, collecting data across the multiple security data sources, applying machine learning techniques to detect sophisticated threats before they have a chance to succeed and fully automating response for known threats.

We've seen some incredible benefits to customers who adopted Cortex from customers seeing up to 50x reduction in alerts to customers automating more than one million incidents per day. And based on a telemetry, we can see that we have recently passed the marker 400 million actions automated up 100% in just four months.

As a result, we're winning with customers who share our vision, including 34% of the Global 2000 and 65% of Fortune 100. We continue to drive product innovation in Cortex XDR. Our recent XDR 2.5 release, includes many new capabilities that have enabled us to catch up in a number of various or passing leading EDR products.

For example, we introduced host insights. Our first add-on module for XDR, which provides vulnerability assessment, application visibility, and our new search and destroy feature.

And to our knowledge, we are the first EDR product to offer the search and destroy capability that will greatly speed up security response and eliminate the need for additional endpoint agents. This might be a good time to highlight a customer when we had recently. We won a seven-figure deal, and this is a story we hear every day.

The customer has a small SecOps team managing multiple point products that were generating too many alerts with too few resources to investigate every alert, leaving them exposed to advanced threats, being able to quickly investigate alerts and identify and remediate threats was a critical requirement.

That existing EDR product was disjointed from the rest of the security infrastructure, making it difficult and time consuming to correlate data. At the same time, there's seamless consuming a large chunk of the annual budget with little ROI.

We challenged their way of thinking by demonstrating how the Cortex platform could automate and streamline security operations allow them to consolidate multiple products, including the SIM into Cortex.

We demonstrated how Cortex will help transform the SecOps team by automating routine processes and knocking down alert volume by more than 95%, allowing them to focus on the critical field. In Q1, we also launched the XSOAR Marketplace, which opened up the platform to both our partners and customers.

And we now have over 500 content bags available to customers to enable automation for the security solutions. Additionally, we are seeing engagement and momentum within our partner ecosystem with contributions and used cases ranging from insider threat to cloud security and threat intel management.

The last deal I want to share with you is a Fortune 500, diversified financial services company. Prior to implementing Cortex XSOAR, this customer was receiving over one billion threat alerts per week. Completely overwhelming their security operations team, leading to a state where alerts were disregarded creating a significant security gap.

By leveraging XSOAR and XSOAR threat intel management, they were able to take full control of threat information by aggregating disparate information sources, automatically customizing and scoring fees and matching indicators against that environment as well as leveraging playbook automation drive interaction.

This combination of automation tactics reduced the number of threat alerts they received by more than 99%, creating a significantly more secure rand. Moving quickly to Expanse. Last week, we announced our intent to acquire Expanse and told you about what they do and how they fit within our overall vision of Cortex.

Expanse has dedicated themselves to developing an internet collection and attribution platform that constantly monitors the global internet. Mapping the exposed and untracked assets of an enterprise that comprised its attack surface. This data gives organizations a crucial picture from the outside end.

That is to say the same view that an attacker sees when hunting for potential weaknesses. It’s because of insight that their technology is trusted by some of the world's largest and most complex organizations from members of the Fortune 500 to the U.S. military.

With our user conference Ignite kicking off in a little over 24 hours, we're excited to share that outside in view with our customers. We work with Expanse to offer all CIOs and CISOs attending in EXPANSE Exec Report, which provides a vulnerability map and immediate insights to customers complete attack surface, risks and suspicious activity.

This is a great lead generation tool for us, sales teams to hit the ground running once we closed on the transaction. Expanse’s transaction multiples are very favorable compared to other companies of equivalent size and even more so when adjusting for growth. Now to the financials.

As we said in our call last week, on a standalone basis, we expect Expanse to contribute $67 million of ARR to our current fiscal year ending July 2021, continuing its 100% growth momentum. With Palo Alto Networks and subject to close, we expect Expanse to contribute $73 million of ARR in FY 2021.

Assuming a mid to late Q2 close, we expect Expanse billings to contribute about 100 basis points of our growth to our overall billings for FY 2021, and adjusting for purchase accounting, we expect Expanse revenue to contribute about 50 basis points for overall revenue for FY 2021.

I know that you get concerned about M&A strategy, perhaps because inorganic impact or P&L is hard to forecast new models. But if you look at the $2.7 billion of acquisitions we have done since 2019, they contribute approximately 15% for forecasted FY 2021 billings. A very large enterprise companies have been built by successful M&A strategies.

Good M&A strategies need to ensure the products are easy to integrate their products customers want, and that we at Palo Alto Networks can significantly change the trajectory.

We believe that our ability to acquire, integrate and leverage our go-to-market for acquisitions is a strategic competitive advantage, and we expect to continue to be opportunistic to increase our long-term growth strategy.

As I mentioned, Luis and I have spent a lot of time with all of you and you've highlighted that you love our business, some of you have questions with that our Firewall business is under pressure, others have wanted more transparency on our gross margins, while some of you wanted more visibility around ARR, eventually how to put it all together.

Well, we heard you. It has taken a herculean effort to share our quarterly results in the shortest period we've ever done. But also to deliver detailed reporting on two categories, just to show that our business is doing extremely well. Let's take a look.

Over the last quarters, we have discussed our total Palo Alto Networks’ performance and provide the details for next-generation security and firewall as a platform. We had hoped that the firewall as a platform metric shows you how we're continuing to create share in the firewall space.

The challenge has been that we did not provide anything below that number. What we decided to perhaps the best way to lay our concerns is show you the pro forma P&L around FwaaP and show you how it enjoys great margin. And it's actually higher quality business since we are transforming our hardware business to software and subscription business.

We like this shift as software revenues of higher quality and increases revenue visibility. Our next-generation security business, which has been the thrust of our innovation over the last two years, has been highlighted to share with you how we're building a bigger and better business faster than anyone else in next-generation security.

Next-generation security provides a perspective in our fast growing SaaS business on a billings basis, NGS’ nearly a quarter of total buildings up from 8% in FY 2018. NGS ARR closed Q1 at $719 million, up from $651 million of Q4 2020, and up from $568 million from Q3 2020. To provide a better understanding for business, we juggled a few pieces around.

For our firewall as a platform business, we added the related subscription, support and professional services, we call it network security. We removed the software firewall from NGS in order for the two areas to make a whole. We call this cloud & AI.

With that context, we have prepared the recast of our full year guidance, which I just raised across both categories. Let's double click it network security. Our network security business on a standalone basis is still the largest firewall business in the industry by revenue.

It enjoys double digit growth driven by transformation to solve for form factors. Our success in VMs and Prisma SASE and increased subscription attach. This has allowed us to have lesser and lesser reliance on hardware and provides better revenue visibility. We feel comfortable that these growth rates are robust and sustainable.

Our gross margins and operating margins are extremely healthy. The gross margin was slightly less than where they could be because of our SASE gross margins, which given the early stage of that product, scale, relative firewalls, it has slightly lower margins.

As we scale our SASE business and the new subscriptions we have launched, we expect these margins to improve over the next few years. Needless to say, these numbers speak for themselves. And on a standalone basis, this will be a very valuable network security business.

As we noted, our firewall business had largest industry, the industry leading financials, and we're going through a transformation. We will continue to invest in this transformation.

Palo Alto Networks has already transformed into a highly ratable business, but ratable revenue as a percent of total revenue is up from 59% two years ago to 71% in Q1 2021. Now into Cloud & AI. This story has just started. If you ask every CIO, the two trends that they're all excited about are the transition to the cloud and the impact of AI.

Well, there's no transformation unless there is a secure transformation. I think we have put the rest any questions on the idea that customers would get their cloud security from the CSPs only with 70% of the Fortune 100 being served by us. I think this is our opportunity to build upon.

We're singularly focused on continuing to improve our platform to meet the needs of our customers as highlighted earlier. On the AI front, we're in the second iteration of this trend. The first trend was around collection of data and attempted to correlate it for security.

The next trend which we are well poised to capture is a trend of normalized data, reduce the signal-to-noise ratio and to improve the security posture using data AI based practice security using Cortex. We have organized our financials for our cloud AI security category.

This business, which we started building two years ago is getting traction or ensuring that we build this as a SaaS and ARR business. We expect ARR for Cloud &AI to grow 89% year-over-year in FY 2021. Even when excluding the Expanse contribution, we expect the growth to be 71% year-over-year.

While the gross margins look lower in FY 2021 compared to FY 2020 partially because the integration of Crypsis, we expect that this business will continue to improve gross margins every year and improve significantly over the next three, four years.

Operating margins will naturally improve as ratable revenue is recognized from the balance sheet to the P&L. We believe there's a large opportunity in Cloud & AI, and this could be the next $100 billion TAM in security. That said, we will continue to invest aggressively for this business.

In summary, if you put it altogether, we have two great businesses doing exactly what we'd like them to do. In conclusion, we had a great fiscal quarter across the board. And as a result, we are raising our fiscal 2021 guidance. We've been building two businesses at Palo Alto Networks.

Our Network Security business is a largest Firewall player with sustained gross margins and operating margins. And we have fast-growing Cloud & AI business where we expect FY 2020 on ARR of 89% year-over-year.

Lastly, I am going to give you a quick update on what we call FLEXWORK, I started this morning by calling out the continued resilience of our employees throughout COVID-19, we have been supporting each and every employee with our FLEXWORK approach, a series of initiatives to give employees far greater choice as they adapt to the challenges this year in areas from work location, to benefits, to learning, all underpinned by the way we lead and communicate, with compassion and authenticity.

We continue to advance this approach through Q1. We launched the first phase of FLEX benefits, giving our employees and additional $1,000 allowance for the year to choose from a wide range of wellbeing and childcare options.

We roll out the first module of FLEX learn, an individualized learning path for our sales teams, leaders, managers, designed to support them as well as they work and lead remotely. We're delighted to see our FLEXWORK approach now gaining traction beyond Palo Alto Networks.

Last month, we launched FLEXWORK at Zoomtopia, and invite other companies to join to open source discussions and share case studies and learnings. Over 600 attendees showed interest in the work.

Simultaneously, the CEOs from Uber, Box, Splunk and Zoom all join me in formally announcing the FLEXWORK coalition, the community of leaders coming together, develop and share best practices as we focus on the future work. We all agree that pandemic has highlighted areas of opportunity, where we can bring about enduring workplace change.

I look forward to continued conversations with these leaders and about how we can accelerate new work practices that put our employees of the center. With that, I'll turn the call over to Luis..

Thank you, Nikesh, and good morning to everyone. Before I start, I'd like to know that except for revenue and billings, all financial figures are non-GAAP and growth rates are compared to the prior year periods unless stated otherwise.

As Nikesh indicated, we had a great first quarter as we delivered – as we continue to deliver winning innovation and add new customers. The strength gives us confidence to raise our guidance for the year. In Q1, total revenue grew 23% to $946 million. Looking at growth by geography, the Americas grew 27%, EMEA grew 16%, and APAC grew 11%.

Q1 product revenue of $237 million, increased 3% compared to the prior year. Q1 subscription revenue of $428 million, increased 34%. Support revenue of $281 million, increased 26%. In total, subscription and support revenue of $709 million, increased 31% and accounted for 75% of total revenue.

Turning to billings, Q1 total billings of $1.083 billion, net of acquired deferred revenue increased 21%. Strength was broad based, as we continue to see strong execution across the company. The dollar weighted contract duration for new subscriptions and support billings in the quarter was up slightly and remained at approximately three years.

Total deferred revenue at the end of Q1 was $3.9 billion, an increase of 31% year-over-year. Remaining Performance Obligation or RPO was $4.4 billion, an increase of 40% year-over-year. In addition to adding approximately 2,200 new customers in the quarter, we continue to increase our wallet share with existing customers.

Our top 25 customers, 24 of which made a purchase this quarter, spend a minimum of $57.2 million in lifetime value through the end of fiscal Q1 2021, a 37% increase or the $41.7 million in the comparable prior year period.

Q1 gross margin was 75.8%, which was down 80 basis points compared to last year, mainly driven by higher mix of our NGAs products, which are less mature. Q1 operating margin was 21.7%, an increase of 590 basis points year-over-year.

The operating margin expansion is driven by operating expense leverage as we benefit from lower travel and event expenses due to COVID, which more than offset the incremental investment in headcount. We ended the first quarter with 8,376 employees, including 156 from Crypsis at the close of acquisition.

On a GAAP basis for the first quarter, net loss increased to $92.2 million or $0.97 per basic and diluted share. Non-GAAP net income for the first quarter increased 51% to $158.1 million or $1.62 per diluted share. Our non-GAAP effective tax rate for Q1 was 22%. Turning to cash flow and balance sheet items.

We finished October with cash, cash equivalents and investments of $4.1 billion. During the first quarter, we purchased $500 million or 2.1 million shares of common stock at an average price of approximately $242 per share.

We have returned $2.7 billion to shareholders since Q1 2017 through the repurchase of programs and ASR where we repurchased 15.1 million shares of common stock at an average price of approximately $179 per share. Q1 cash flow from operations of $535 million, increased by 138% year-over-year.

Free cash flow was $505 million, up 184% at a margin of 53.4%. As we mentioned last quarter, this was driven by the strong cash collections, following Q4 2020 record billings. DSO was 81 days, an increase of 18 days from the prior year period.

We expect another strong collections quarter in Q2, which is expected to bring our DSO down to historical levels. Turning now to guidance and modeling points. For the second fiscal quarter of 2021, we expect billings to be in the range of $1.17 billion to $1.19 billion, an increase of 17% to 19% year-over-year.

We expect revenue to be in the range of $975 million to $990 million, an increase of 19% to 21% year-over-year. We expect non-GAAP EPS to be in the range of $1.42 to a $1.44 using 98 million shares to a 100 million shares. Additionally, I would like to provide some modeling points. We expect our Q2 non-GAAP effective tax rate to remain at 22%.

CapEx in Q2 will be approximately $30 million to $35 million. As Nikesh reviewed earlier, for the full fiscal year 2021, we will be raising our guidance across all metrics. We expect billings to be in the range of $5.08 billion to $5.13 billion, an increase of 18% to 19% year-over-year.

We expect next-generation security, ARR to be approximately $1.15 billion, an increase of 77% year-over-year. We expect revenue in the range of $4.09 billion to $4.14 billion, an increase over 20% year-over-year. We expect revenue – product revenue to be flat year-over-year. We expect operating margins to improve by 50 basis points year-over-year.

We expect non-GAAP EPS to be in the range of $5.70 to $5 80 using 99 million to 101 million shares. Regarding free cash flow, for the full year, we expect an adjusted free flow margin of approximately 29%. With that, I’d like to open the call for questions..

In the interest of time, please limit Q&A to one question. Our fist first question comes from Walter Pritchard from Citi Group..

Hi, thanks.

Can you hear me?.

Yes. Hey, Walter..

All right. Great. Thanks. So I guess, you've seen really strong customer ads around Cortex and around Prisma and have – I think your Global 2000 Fortune 500 penetration is pretty strong here.

Can you talk about where you are in terms of standardization amongst some of those clients and how you think about revenue from those products around up-sell versus new customers going forward?.

Look, we have a different answer for both of them. As you know that our Cortex XDR platform is only about two quarters old and we're delighted that we're crossing 1,000 customers in that category. We continue to see opportunity in penetrating both our existing customer base and new customers as far as XDR’s concern.

As you know, we keep launching more capability in our XDR platform. We want to go from being able to just normalize data across their endpoints and firewalls to more and more data sources.

And with the combination of Expanse, we think that's a very powerful proposition, we think in the future, it's no longer about aggregating data and throwing it into a large data lake and running analytics. It's about being able to normalize the data.

So I think we are early in the transformation of data and AI-based security around Cortex, and this is a very long runway ahead of it.

In terms of Prisma Cloud, what's fascinating, as we highlighted an example in the call, where we had a customer who kind of estimated how much workload and how much capacity they need into cloud as they ran through it in a quarter. That's what we think over time happens to all the cloud customers because it's kind of interesting.

The gap between how much people have actually sort of move to the cloud versus how much is ahead of them is huge. I'd say it took us two years to get to the cloud, to get 70% of the capacity of our data centers in the cloud. We had to buy everything two years ago to start ramping up to get there.

So we think all of our customers are early in their ramps, relatively speaking. Some of them are further along. But we think most customers are early or maybe in the first or second innings of a ramp. And we think there's a long runway ahead as well for the cloud part. So in cloud, we're really focused on customer acquisition and landing customers.

That's why we keep sharing with you 70% of the global Fortune 100 or 20% of Global 2000 because we think the more customers we can have, we expect consumption to keep growing for each of those customers. Hence, we have a consumption base order for most of our products now because the more they consume, we expect recurring remediates show up.

Does it give you a better sense for it?.

Yes, thank you..

Our next question comes from Keith Weiss from Morgan Stanley. Keith, I think he might be on mute..

Are you went back to sleep? I know it was a long call, Keith, not that long..

We will move on to the next caller Sterling Auty from JPMorgan. And then we'll move back to Keith afterwards..

Thanks, guys.

Thank you very much for the additional disclosure, incredibly helpful, but just want to make sure I understand how should we think about, you gave the guidance for total product revenue improved to flat year-over-year, but I'm just kind of curious what impact you're seeing from SD-WAN and other areas that might actually provide some further improvement in that product growth rate as we move through the year?.

Sterling, thank you. We include the SD-WAN revenues mostly in our Prisma SASE product, which goes in the overall firewall as a platform billing. So you will see the impact of SD-WAN and our firewall as a platform billings number. Then we continue to see strengthen the SD-WAN category, as well as the entire SASE categories I mentioned.

I think most remote work transformation, network transformations are not done. They're early in their sort of journey.

And I think most of our customers are realizing that they're going to have to migrate their network infrastructure to more of an SD-WAN style infrastructure, as well as then we'll probably have to sustain a 100% percent capacity for remote working for much longer than anybody thought..

But I thought with the two products, one of it was on box.

I didn't know if that was going to have the ability to provide some pull-through for some additional product, as well as we moved through the year?.

Even that on box SD-WAN subscription is part of our subscriptions number, which again shows up in the FY billings number. In this new left-hand side we just showed you..

Understood. Thank you..

No problem..

We will try this again. The next question comes from Keith Weiss from Morgan Stanley..

Good morning, Mr. Weiss..

Good morning.

Can you guys hear me now?.

Yes..

Yes..

Excellent. So I thank you for taking the question, bearing with me and my technical difficulties. Very nice quarter. Loved the Expansive disclosure. I think it's a really good view on the overall business. I wanted to get a little bit more onto the firewall side of the equation.

I think it's going to surprise guys as both the growth in sort of the overall customer base. I think it was up 8,000 on a year-on-year basis, as well as sort of the overall and a billings growth in that business.

Can you talk to us a little bit about one kind of where the customers are coming from, how you guys are expanding that overall firewall base? And then two, what are the kind of vectors of growth we should be thinking about on a going forward basis? Like where are we in terms of subscriptions per customer? How far can that go on a going forward basis? As well as kind of like the virtual versus physical mix, like how much further is that taking up your spending per customer?.

Yes, I think, Keith, the best way to think about it is that the software side of that business continues to see strong growth. The SASE pieces, Prisma access pieces, the SD-WAN capability and CloudGenix, that is also where we capture our subscription growth. Our subscriptions have gone from four to eight.

We just launched the LP, which is getting sort of lots of interesting – a lot of interest from our existing customers. IoT which is very early still for us. It's also getting a lot of interest from our customers.

SD-WAN ends up being part of a larger SD-WAN sort of infrastructure deal where they will turn on the SD-WAN capability in the firewall, and then they will also buy pure SD-WAN with CloudGenix and the architectures work, so they work together. So we expect most of the growth is going to come from the software side of the house.

As we shared the VMs, I have gone over 10,000 customers. We've seen a lot of interest and activity there in the VM space. As we highlighted, we've launched the 5G capability, containerized firewall 5G capability, which is unique in the industry.

We're going back to our service provider partners and saying, look, this is what you need to get 5G done, right? And to help your customers leverage 5G use cases that they're deploying. So I expect a lot of the growth should come in the software side. The hardware customers are mostly refresh and some are existing customers.

In some cases, you'll see people go away from legacy vendors who provide hardware firewalls. Sometimes we will see hardware wins, which come as part of an overall platform deal where people want to deploy the entire Palo Alto blueprint across their infrastructure. So hardware is harder than software, especially in the current environment..

Got it. Excellent. Super helpful. Thank you guys..

Our next question comes from Fatima Boolani from UBS. .

Good morning. Thank you for taking the questions.

Can you hear me?.

But just for you, because you didn't believe that we were growing a business on the other side..

I could see that. Thank you for that. I'll keep it tight. Nikesh, if I can ask you to put a mix hat on for a second. Into fiscal 2021, you're going to have an even bigger portfolio than you did in fiscal 2020.

So I'm wondering if you can speak to, or at least quantify to what extent enterprise adoption agreements or enterprise licensing style agreements are becoming a bigger part of your overall sales motion particularly as you look to drive more next-gen solution adoption activity?.

Yes, the enterprise agreements typically kick in stronger in renewables than in the first phases of our deal. So a lot of the deal – a lot of the original, the only business comes as on a product by product basis until we get to a scale where customers is, wait a minute, it makes much more sense for me to go consolidate all that stuff.

It's rarely you'll see somebody walking in salon a $20 million, $30 deal. And let's go rip out everything in our infrastructure and replace with Palo Alto Networks.

We see that it happens incrementally over time with our customers, as they get one product, they enjoy it, they get the next set of products, and we've seen that happen on a recurring basis in the last two, two and a half years I've been here. We expect they will continue to be important, but they're typically kicking in renewal.

So we have reasonably good visibility as to which customers are up for renewal where it makes sense for them to be pitched enterprise agreement. But they play their fair role in our renewal capability. Well, we make sure that our teams understand that you cannot just renew somebody and call it an enterprise agreement.

There has to be a significant amount of upsell and deployment of new products into the customer base before qualifies for enterprise agreement. And this hat is a little smaller. I tried on the weekend..

Our next question comes from Jonathan Ho from William Blair. .

Hi, good morning. And congrats on the strong results. I just wanted to start out with, getting a sense for how the integration with CloudGenix is going and maybe what the initial customer feedback has been with the combined products? Thank you..

I'm going to have my friend Lee Klarich to answer that question, since he's been sitting, just smiling. Go ahead, Lee..

Thank you, Nikesh. Good question, Jonathan. We’ve seen in the SD-WAN space in particular is even though it provides obviously a lot of value to customers, it's still can be very clunky. It can still be very difficult to roll out deploy operationalize.

And obviously the approach for CloudGenix, we think we address many of those challenges, but further the integration with Prisma Access, where we can also deliver the cloud network and integrate those two together. And as you heard Nikesh stated earlier, we recently introduced an ability for those to be deployed with basically one-click integration.

And so all of that combination that we bring together as SASE is starting to resonate with our customers, and we see that as the future architecture for how customers are going to connect their branch offices, remote sites to a cloud of our network with cloud security and address those deployment challenges while gaining the best security they can..

Our next question comes from Brian Essex from Goldman Sachs..

Hey, good morning. And thank you for taking the question. Thank you for me as well, and the additional metrics around NGS. It's really helpful. I know investors have been waiting a while for that.

Maybe, Nikesh or Luis, how should we think about two things, one the gross margin progression is that just a function of the delivery on cloud infrastructure? And then two, seasonality, so comparing this to your overall business from a margin perspective, at what rate might this business be in parity with the rest of the business? And then from a seasonality perspective, I noticed that billings were seasonal this quarter similar to the larger business.

How do we think about that on a go-forward basis? Thank you..

Yes. I think we – to the second part of your question, we will always see a little bit of seasonality with Q4 being stronger than Q1, right. So that would be kind of normal. In terms of gross margin, yes, we have strong plans, as you would imagine. And as Nikesh mentioned, we do expect to get very competitive gross margins over the next few years.

We have very clear plans that include efficiencies in our cloud and AI business, so you should expect that business to significantly improve over time. And as I said, we have very concrete plans to achieve that..

Is that maybe just on infrastructure side? Or is there something else driving that margin?.

As I mentioned, Brian, on the last call, the two largest parts of the gross margin are clearly are cloud infrastructure pieces. And we have worked hard both in Luis' team and in Luis' efforts in trying to lease those cost down.

And we have a very clear line of sight as to how and when those costs will go down, so we're very comfortable saying that those gross margins should improve significantly in the next two to three years, that’s one part of it.

The other part is, as you know, this is the revenue against cost metric and revenue comes in ratably, the costs come in front-loaded in customer success. Our deployment costs and customer deployment requirement is like we have to deploy $1 million deal in two months right now. At our cost to point the deal is now the $1 million come over two years.

So you will see as that business scales, the customer success pieces in the pre-course gross margin numbers become relatively smaller compared to the total revenue side, but that also gives you a natural margin progression in the right direction..

Fair enough. Thank you..

Our next question comes from Philip Winslow from Wells Fargo..

Great, thanks for taking my question. And again, thanks for the added transparency in terms of disclosure. Obviously, it's a very strong quarter with a lot of very positive metrics here. One that really stood out to me was on Prisma Cloud. Customers using compute – shift to cloud security is something that we've been focused on for a while.

But it feels like that's hitting an inflection point. So I guess a question for Nikesh and Lee.

What are you hearing from customers about sort of adoption of computes or understanding of sort of the evolution of security in the cloud?.

I think we've maybe mentioned before the – I think a lot of early cloud adoption from enterprises was sort of more lift and shift. We saw take an application in the data center and simply move it to the cloud without rearchitecting it, without leveraging a lot of the benefits of the cloud.

And the more mature companies, from a cloud perspective, are now taking more of a cloud-native approach. And those cloud-native approach sometimes is obviously leveraging PaaS services, but one of the key aspects is increasingly using containerized security architectures and deployment architectures.

Interesting enough, that also sometimes comes back on-premise as well. And so as there is a greater and greater usage of containerized architectures, cloud-native architectures, the Prisma Cloud compute security capabilities become very important. And this obviously, for us, comes from the acquisition of Twistlock. We made about 1.5 years ago.

And at the time it was best-in-class. We continue to invest in it and continue to receive great feedback from our customers when they do take advantage of it..

Great, thanks team, keep up the great work..

Thanks Philip..

Thanks..

Our next question comes from Gray Powell from BTIG..

Great. Thanks.

Can you hear me okay?.

Yes..

Cool. So yes, I maybe want to go back to an earlier question on the core Firewall side. How should we think about attached subscription growth on the core Firewall side? Because I think you have four new subscriptions, some of them seem to be getting pretty good traction.

You introduced a higher cost premium support to your – but at the same time, product revenue growth is flattening out, which means that the installed base and subscriptions going to attach to is flattening out.

So I'm just trying to think like how those two things should net against each other?.

Well, they shouldn't net against each other because you see the four new subs that we've added, we believe, should be applicable to majority of our customers. And most of our customers don't have them.

I mean, the one which has seen some traction, which we talked about last quarter, was our DNS Security sub, which is penetrated over 5% or 6% of our base. So we expect there is still a lot of runway in the new subscriptions to be able to penetrate our base of 70,000-plus Firewall customers.

So we don't think that, that should all be on top of the product base that we have out there. And whilst product revenues are flat, our install base continues to rise because this is a one-time sale. Every time we sell, it's to, hopefully, a new set of customers. And over time some of them renew.

So I think you are still seeing customer acquisition as is it evident from the 8000 new customers we have between last year and this year. Although they are prime candidates for subscriptions that get attached.

In addition to that some of these customers whilst they might be flat from product revenue, they are deploying Prisma SASE or Prisma Access, also deploying VMs where VMs and Prisma Access also allow you to do subscriptions. The subscriptions are not specific only to our hardware business.

You can get as of soon DLP with Prisma Access, you can get IoT with Prisma Access. So our subscriptions go past, they apply not only to the 70,000 hardware customers, they apply it to a significant part of our 10,000 software virtual firewall customers or a 1000 Prisma SASE customers..

Got it. That's really helpful.

Did you say DNS is already at 5% to 6% penetration about that's only been out like a year?.

About 18 months? Yes, I'd say we said 3000 last quarters, 3000, I think, my math says is approximately….

Your math is good. .

My math is good in the morning. Yes..

Alright, thanks..

Early in the morning..

Thanks..

That’s great..

Just want to make sure, 5% was right..

Next question comes from Andy Nowinski from D.A. Davidson. .

Great thank you. And congrats on a good start to fiscal 2021.

At a high level question, when you look at the thousands of new customers, you added this quarter, I'm curious what percentage started with just your cloud AI products, or do most customers start with the network security products? Just trying to get a better understanding of which one is driving a new logo growth. Thanks..

Yes, my CFO will not, let me tell you the number of exact number of new cloud AI customers. But I will tell you there's a significant part of the – both of the Fortune 100 and Global 2000 base, where they have no interest in some of our hardware products, because these are born in the cloud companies, so they are going through cloud transformation.

So we are seeing a reasonable number, a significant number of customers, be our first time customers in Prisma Cloud customers who had no interest in buying a firewall because many of them don't have a substantive data center, but they have a cloud presence because that's kind of what they chose to go with.

And now with the eight modules, seven modules we provide in Prisma Cloud, they find it interesting to go down that platform route.

Many of our customers who are on the defense side or the financial services side where we've not had such a strong presence are getting – we are seeing renewed interest, both in the cloud transformation, as well as the data collection capabilities, Cortex XDR and hopefully expense in the future.

So, we're seeing a new set of customers we're able to address with our cloud AI solutions, which we were not able to address with our hardware capabilities..

Thanks Nikesh..

You are welcome. .

This question comes from Saket Kalia from Barclays..

Okay. Hey, good morning.

Can you hear me okay?.

Yes, Saket.

How are you?.

Okay. Excellent. Good. Nikesh how are you? Luis, maybe for you, maybe just shifting gears to profitability for a second. I think the operating margin guide for fiscal 2021 is going up slightly. And I believe that too is consolidating the Expanse cost base. Maybe the first part of the question, my thinking about that right.

And then secondly, more strategically, longer term on that cloud and AI business, who do you sort of benchmark yourself against in terms of where that profitability can go long-term?.

Yes, to your first question, yes, margin is off slightly year-over-year. So yes, we are raising our guidance on margin, so you are right. And you are also right our fiscal year margin is impacted by Expanse, which we basically offset all of that. Right. So we factored that in and we covered the cost and even though – even despite of that we’re going on.

And yes, we're benchmarking ourselves against the best you have in the market, right. And we want to get towards those margins as well. And we think it's very reasonable to do that as we gain scale and as we deliver the savings that we talked just a few minutes ago, right.

Some of the savings that we are working with Lee’s team, Lee and his team, and some of the savings that we think we can get just as we gain more scale. So that should clearly improve. But that's kind of where we're going. Now think about some of the best-in-class companies out there. And that's where we're benchmarking against to deliver..

Yes, Saket just to add to that and this is not a reporting question.

Part of the reason we wanted to make sure you understand this split and the difference in the two businesses is you want to reinforce that our firewall business is as good as any other firewall business out there in the industry because I got calls about, hey, you are seeing an overall decline in gross margins that because your firewall was under pressure.

No it’s not. I think the other part I want to make sure that you see is that it's kind of like maybe we do and we're looking, but it's very hard to build a $735 million [indiscernible] business from scratch in 18 months. I want to show you that we're building that business in parallel to continuing to focus on the firewall business.

And to an extent, the overall gross margin, operating margin are somewhat not fully in our control as management. And we want to show you the reason that we're investing in the right hand side is because we can drive that ARR growth at very high double digit for a longer period of time. For that we need to continue to invest.

And we're just showing in the run we invest. You'll see the – you will see the transparency where we're investing, where we're not investing, where we're leveraging and showing your expansion where we're continuing to invest. We're investing in both, obviously not to the same levels.

Prisma SASE is a brand new product category for us in our firewall business.

And to be honest, I will tell you this in two years from now when you look back, you'll say, yes you guys did a great job, transforming your business to hardware, to software because there's a high probability the industry starts to slow down on hardware because people realize they are moving faster to network transformation, cloud transformation.

And when that happens, you need two years of prep work together..

Very helpful. Thanks guys..

Cool. .

Our next question comes from Patrick Colville from Deutsche Bank..

Hey there, thanks again for the new disclosure. It's going to echo to others. I mean, absolutely awesome to see that. So I just want to circle back to Fatima's question about enterprise agreements.

So can you just help us understand, I guess at Palo Alto Networks what you define as an enterprise agreement versus just a kind of regular, multiproduct deal. And the reason I asked is because we know in our conversations with resellers we're hearing Palo Alto and enterprise agreement a lot more.

So I guess – and I guess the second part of my question is, is there any disclosure you can give us around what proportion of billings are from enterprise agreements? Thank you..

Thanks Patrick. Thank you for the congratulations. And first of all, I'm looking at Lee just to confirm what I'm going to say, is that we have no enterprise agreements wherever we blend Cloud AI and network security..

Correct? We don't. .

So first and foremost, any of the cloud and AI stuff does not get bundled with our hardware deals or does not get bundled with software deals. We probably have no enterprise agreements where we blend all of our Prisma SASE and hardware and software firewalls. We don't. So Prisma SASE deals and also independent of that.

So most of our enterprise agreements are still firewall plus subscription agreements, whether they are hardware and software and a subscription, they are still the agreements that have continued in Palo Alto Networks for the last 15 years.

None of the new stuff is included in enterprise agreements because we don't believe that we have to create cross-product discounting to try and encourage customers to use them.

We want our new products to stand on their own, and be sold on their own and be able to – be on a consumption model, which is much more transparent and much easier to manage if they're not part of it, large bundle discount deal. So that's answer number one. Our enterprise deals refer to hardware plus subscription updates.

So in that context, any customer who wants to do an enterprise agreement with us is probably an existing hardware customer with subscriptions, where they are going to buy more subscriptions and promise to buy more hardware from us over the next three years.

And that's why you do an enterprise agreement, saying hey, I'm going to go from a 100 firewalls to 200 firewalls if I paid you so much money for all your subscriptions in the next three years, can I have a deal where I don't have to keep being every time I buy a new firewall for subscription.

So most of our enterprise deals take on the form of if you commit to a large amount of hardware purchase, you can get a bundled price for subscriptions, which you don't have to pay incrementally for. That's the nature of our deals. Hence, our EAs are pretty much dependent on our hardware business.

And as I said to a question earlier that most of our EAs are based on renewal deals because nobody walks in front saying, I want to buy the state of thousand firewalls tomorrow sign me up.

It's typically I've got 200 more I'm going to get 200 because I'm through a transformation of Palo Alto Networks, can I just hurry up and get a renewal of a larger number if I commit to more hardware because I love your product..

Our next question comes from Matthew Hedberg from RBC..

Hi guys. Thanks for taking my question. And I'll offer my congrats again. Disclosures are really, really helpful. I guess I have a question for Lee. In a post-COVID distributed world, I have to think DLP takes on a new level of importance.

Can you talk a little bit more granular about how you guys differ in your approach to cloud DLP versus others? And how much of that is a new business i.e., as a result of distributed work or increased cloud migration, or how much of it is legacy DLP replacement?.

Yes. Thanks for the question, Matthew. When you look at the DLP market, it's been around for a long time. It hasn't changed a whole lot during that time. And it was therefore sort of designed and architected for a very on-prem world.

It largely assumes that employees all show up to the office, applications are all in the data center and everything is sort of well contained. As you look at today's world, users are – employees are working from anywhere, applications are increasingly running into cloud and the legacy DLP on-prem architecture does not work as well anymore.

And so what we've done is built a DLP service that runs in the cloud and then can connect into all the different enforcement points that are needed, whether that's one of our hardware devices in the data center, prem whether that's Prisma Access, whether that's Prisma Cloud for cloud workload and storage security.

And so we can take that single DOP cloud engine and integrate it with all of those enforcement points, really designed for this new way in which networks are deployed, applications are deployed.

And so we think that's a very more appropriate architecture and we're getting it's early, but we're getting very positive feedback from our customers and interest in that approach..

Thank you..

Our next question comes from Rob Owens from Piper Sandler..

Good morning. And thank you for taking my question.

Given you are the first to report in October quarter on this really early Monday morning, I was curious if you can give us kind of a broader read in terms of what's going on internationally looked like domestic was strong, but rest of the world growth rates ticked down a little bit versus where they were in the back half, or even the quarter from a linearity standpoint, given your dates, billings outstanding, ticked up, I guess, on a year-over-year basis and went a little higher than it was previously.

Thanks..

Well, there's a varied impact around the world, given where people are on this pandemic scale and degree of difficulty in terms of being able to execute in their own environments here, we still see that different parts of Asia are doing better than the others because they're going through their emotions of trying to deal with the pandemic.

See similar behavior in Europe, we saw in early part of the quarter was normal in Europe. It's gotten subsequently harder because Europe has started to shut down. So we're seeing different impacts across the Board. But as you know, these deals don't happen in days. These deals happen in months.

So there's already always work that's been going on for the last many months for these deals to culminate towards the end of the quarter. So generally speaking, as I said, you know, Europe is okay, it is scattered, the U.S. continues to be strong.

I think as I said, we are going to get tested in the, and I don't mean COVID testing the COVID is going to test us. We do get tested pretty much, very often, but COVID is going to test all of us in the next three months, because I think the winter is coming.

And we're hoping that all the work that the teams have been able to do in the last few months will bear through the winter. But yes, I think, international continues to be – look, there's two parts to it, one is native strand, the other is investment.

So we are continuing to invest internationally because we were not as invested, I would say internationally two, two and a half years ago. We're making investments around the world.

We're also investing in making sure our cloud and AI businesses are visible across various customer bases because in many cases, the hardware business, hadn't been able to be of much significance many countries around the world, but we're going back and re-investing in cloud and AI.

So I think that counteracts some of the natural weakness based on the pandemic. But we'll see what happens the next few months..

Alright, thank you..

Our next question comes from Gregg Moskowitz from Mizuho Securities..

Okay. Thank you for taking the question. Nikesh, your next-gen security ARR and billing and growth for me is impressive. Especially now that you're lapping tough comps. What I'm wondering is what are the one or two NGS products that haven't yet contributed much, but that you think is only a matter of time before they move the needle on growth..

That was, that was a, quite an impactful way to end the question. But the NGS products, it's kind of interesting as I parse them down, we include Prisma SASE and NGS. We continue to see tremendous amounts of traction in Prisma SASE. Prisma Access continues to go from strength to strength.

As I mentioned, we think we four or five, 10 quarters ago, Prisma Access was GPCS, it didn't kind of have enough traction. Now we see tough comps being lapped with great numbers, partly driven by the pandemic response, partly driven by the fact that finally near standing at the top of the roof and claiming the proxy solution that don't fully work.

If somebody is hearing him because people want a full-stack firewall and the firewall in the cloud. So a lot of success for Prisma Access front. We think that continues to sustain itself SD-WAN and SASE going forward for the next few years. Prisma Cloud is kind of a different story.

It was kind of like, we'll see more benefits in the future because right now we're in expand mode, land mode and we're getting more and more customers, but really we are dependent on the customers’ ability to transform their existing infrastructure to the cloud.

So we're getting in there, we're getting our modules in, we're trying to do upsells, get them to use more and more of our product. As they spend more – put more workloads in the cloud Prisma Cloud will see continued ARR growth in the future. On the Cortex XDR front, it's competitive with many XDR vendors out there.

Again, we're seeing traction because we have a large install base of traps, which many of that is converting to XDR. We're also seeing new customers where we compete to the likes of Cylance, Crowdstrike and [indiscernible], et cetera.

And there, XSOAR, we think is now way larger than any other automation product out there from a security automation perspective. And we think the combination of Expanse, and XDR and XSOAR holds tremendous promise. But I think that's more a next fiscal year thing.

This fiscal year I expect Prisma Access, Prisma SASE, I expect the Prisma suite to do really well and XDR to really – XDR to do really well independently. I think we'll see more and Expanse expense plus XDR in the next fiscal year. That gives you a better sense.

And of course, VMs continue to do great for us because people are finally realizing you can put a virtual firewall against your third instance and they need one..

Our next question comes from Tal Liani from BofA. Okay. I don't think we have Tal. So I'll move on to our last question and will come from Brent Thill from Jefferies. .

Thank you.

Nikesh just on the go-to-market this year can you speak to any changes that you're making in the go-to-market motion? Is it anything new this year largely unchanged from last year?.

Brent, thanks for the question. Look last year, the year before that, when I started, we had a large kicker to get our NGS jump-started and hopefully a billion dollars ARR by the end of this fiscal year, it tells you that we were able to jumpstart it, although that caused some consternation in our product business, as you guys are fully aware of.

So we normalized that last year. So we did not create that much of a jump between NGS and a product and things have stabilized.

I'll tell you that the one change we've made this year and you should see it in the left side and right inside, be sure you, we have focused our cloud AI team to believe, to build ACV and ARR, right? And our Network Security business is more TCV oriented.

So if you were ever to see an impact or shrubs, the way what's going on your billings versus ARR, and that's why we started this disclosure today about showing you the left-hand side is very focused on revenue, operating margin, gross margin and billings, the right-hand side is a very much an ARR business because we believe the huge opportunity we have in front of us should be focused on ACV.

And that's why, answering Patrick's question about what do we do with the EAs, I don't want to, bury next-generation regarding revenue products in the EAs because sometimes the EAs you get customers buying a lot of stuff then they choose what they want to use later.

I'm focused on making sure every one of our cloud and AI product gets deployed the time to value is very high or short, the time to value short and value is very high. I want to make sure there's consumption increased, I want to make sure there are contracts in place will allow people to spend more as they consume more.

So the big shift we made at this time of big or minor shift is we've made sure people focus both on the ARR side and the TCV side, in our business, our sales team. As you can imagine, we didn't have an ARR business. We can report ARR, but we didn't have any ARR focus on our firewall business. I hope that helps answer the question..

Thank you..

That concludes the Q&A portion of our call. Thank you all for your questions. I'm going to turn it back to Nikesh for closing remarks..

Well thank you, Karen. And thank you everyone for dialing in. And, I want to normally not what I would do in an earning’s call but I want to applaud the work of Luis and our finance teams. This was a tough, close to get done in 10 days before our user conference.

At the same time, based on your feedback, we spent a lot of time with auditors and others to make sure that we were able to show the split because all of you wanted more transparency in our cloud AI business and network security business.

I hope you see, by just disclosure, we are building two great businesses at Palo Alto Networks, and we are going to continue to focus on trying to build a share of our value across both these segments and we'll keep looking as to what's the best way to increase more transparency and see if it makes sense on the longer-term to be more regular about these updates.

But hopefully you found that disclosure useful. I want to thank you again. I wish your families and you have very safe and happy Thanksgiving next week. We look forward to seeing many of you in our upcoming weeks at our investor conferences. I know I'll be talking to some of you shortly after.

I also want to, once again, shout out to our Palo Alto Networks family, our employees, our customers, and our entire ecosystem thank you very much, everybody. And go Palo Alto Networks..