Updates - PANW - Continued NGS Execution & Positive Financial Trends
Despite the recent slow down in consumer and enterprise spendings, the long waited hardware refreshment and continued penetration of NGS products will keep PANW's growth at a high level.
Summary
PANW’s 4Q22 ER was impressive with a continuation of positive financial trends.
We review two major product releases in FY22 that significantly strengthens PANW’s dominance.
To add some colour to our previous commentary about Arora’s NGS execution, we present some NPV analysis.
Lastly, we recap PANW’s market scope, growth outlook, and valuation considerations.
4Q22 Results Overview & Financial Trends
Relative to management’s guidance in May-22, PANW exceeded in billings and non-GAAP EPS and hit the top end of the guidance range for revenue.
Compared to the full year guidance given back in Sep-21 at the Analyst Day, the FY22 results also surpassed targets for operating and FCF margin. We’ve put together some historical financials to observe the trends in PANW’s performance. Firstly, the growth has been highly impressive considering the revenue base ($6bn run rate). It indicates that PANW is gaining market share in a fast-growing and competitive industry – probably more so than smaller-but-higher-growth names considered cloud-native BoB.
Source: Convequity
The FY23 guidance of 25% revenue growth also keeps the investment thesis intact. The expected deceleration in billings growth may sound some alarm bells, though management submitted an explanation. Billings growth had been accelerating and has peaked at 44% in 4Q22 due to exceptionally large multi-year deals being closed recently (one deal in 4Q22 is worth $100m). The expectation is that this will normalise going forward.
Gross margin (GM) has not recovered yet – 4Q22 down 230 basis points YoY – as a result of inflationary costs affecting their product division. PANW is also in the midst of a refresh cycle, that boosts product sales but adds extra expenses to cost of goods. Due to less upstream hardware integration and its infrastructure relying on public clouds, PANW is never going to achieve GM similar to FTNT’s (~75%). However, when supply chain headwinds subside GM should recover toward 70%, supported by the growing proportion of revenue coming from subscriptions.
For investors it’s also assuring to see cost items such as S&M, R&D, and SBC trend downwards relative to revenue. The decline in S&M % aligns with the narrative that PANW has become the leader in keys areas, such as cloud security. We often see cloud security startups pitting their solution against a component of PANW’s Prisma Cloud - either in YouTube videos or on their website – claiming technical superiority in some shape or form. We think these observations are a strong sign that PANW is in an advantageous market position that is allowing the company to lower its marketing expenses. Additionally, PANW’s broadening platform is also conducive to more S&M efficiency.
In prior years, R&D % has been rising in conjunction with the integrations and product innovations necessary to support the numerous acquisitions that have collectively made up Prisma Cloud (and Cortex and Prisma SASE). Though, since Feb-21, PANW has only made one minor acquisition as Prisma Cloud has now matured, so we think R&D % has peaked and will trend lower in the next few years.
These views on S&M and R&D fit in with management’s targets for GAAP profitability in FY23 and beyond. By taking a look at the quarterly trends in EBIT and net margins, it’s clear that PANW has solid momentum toward GAAP profitability. The FY23 target for non-GAAP EBIT seems unambitious, however, and questions the continuation of the downward trends in S&M and R&D.
Lastly, taking into account the FY23 projected growth of 25% and FCF margin of 33%, PANW is expected to deliver another year of elite Rule of 40 (58%). Based on prior analysis, we estimate this Rule of 40 puts them in the top 10% of U.S. software companies. On an extended timeline, when the outlook declines to single-digit growth, we think PANW will eventually be able to push EBIT to ~40%, net income to ~30%, and FCF to ~45%. Simplistically, Check Point Software (CHKP) is our benchmark for these long-term estimates, as this is a cybersecurity company with close parallels, that was once a fierce rival to PANW, that has long chosen profit over growth. Hence, we think a long-term terminal growth and margin profile for PANW can be modelled on CHKP’s in the present time. However, the longer that PANW can push out the time before it becomes the next CHKP: the greater the market share >>> more durable the growth >>> more expectation beats >>> and ultimately, the greater the share price appreciation.
Product Innovation
PANW’s product innovation is testimony that the company’s successes have not been purely predicated on M&A. And the acceleration in new product releases indicates that PANW is not stifled by legacy architecture.
Out of the 49 major product releases in FY22, the most significant ones for PANW’s future are arguably the Cloud NGFW and XSIAM – the modern alternative to SIEM.
Cloud NGFW
PANW’s Cloud NGFW is a managed service, and is quite revolutionary when it comes to cloud network security, as it removes the operational responsibility of managing firewalls in AWS. From watching the webinar, it appears to be an unprecedented level of cooperation between AWS and a security company that has made the Cloud NGFW possible (apparently a project team of 100+ engineers from PANW and AWS). It is the first NGFW to integrate with AWS’ Firewall Manager – which is the key to enabling PANW to offer Cloud NGFW as a managed service across AWS. The other innovation is the close integration with the AWS Gateway Load Balancer, which directs traffic across a suite of individual VM-Series firewalls, according to host capacities in CPU and memory, etc.
Deploying and managing firewalls in public clouds is extremely time-consuming – doing NAT (Network Address Translation) for the source and destination, managing cloud formation scripts, setting up external IP interfaces, managing load balancers, changing firewall rules, etc. PANW’s Cloud NGFW removes much of the work in order to get firewalls up and running within a short amount of time and to streamline operations. This fits in with the overarching trend of vendors increasingly offering new products to unburden IT personnel from the back-end provisioning of cloud infrastructure, so it should be a successful new product. And it’s not just the simplicity it affords, because making it easier to conduct network security gives SecOps more visibility to help detect malicious behaviour across their networks.
To summarise, Cloud NGFW is a differentiated move that, until now, hasn’t been on the roadmap for many network and cloud security vendors. Bringing the cloud and network security together in this way is only going to strengthen PANW’s position in securing public infrastructure.
XSIAM
XSIAM (Extended Security Intelligence & Automation Management) is the other standout FY22 innovation. XSIAM is a modern alternative to legacy SIEM (Security Incident & Event Management) systems that are incredibly slow and inefficient at ingesting data and having data queried and retrieved. PANW’s XSIAM is the data lake that will support its XDR (endpoint security), XSOAR (security orchestration & automation), and Xpanse (attack surface management) products. We think it has a good chance of becoming the category-defining SOC (Security Operations Centre) platform that can replace tons of manual work typically done by SOC analysts.
Disrupting the current status quo of using SIEM for cybersecurity has been a top priority of Nikesh Arora’s ever since he took charge in 2018. In many previous earnings calls, Arora has expressed his disapproval of it taking SecOps days and weeks to fully investigate and remediate security threats. This is in large part attributed to orgs storing logs in legacy SIEMs which have struggled to modernise for the current era. The first step in PANW’s attempts to revolutionise the SIEM industry was when they acquired SOAR startup Demisto for $560m in 2019. From there it appears that they’ve worked backwards to discover the optimal data lake to build to maximise Demisto’s technology in automation and machine learning. And as we’ve pointed out in a few previous reports, a radical back-end transformation for data management is very much needed as cybersecurity aims to improve and take full advantage of AI/ML and modern cloud infrastructures. PANW, S, and CRWD are the only security players to have paid big money to address this, and we think it separates them from the rest of the industry when it comes to endpoint security and adjacent areas.
In the 4Q22 earnings call, it was implied that XSIAM will be a key catalyst for continued growth in the number of millionaire customers. Considering XSIAM serves as the foundation for the range of Cortex products (XDR, XSOAR, and Xpanse) and more broadly has the potential to improve the efficacy of PANW’s entire suite of products, we agree that it could emerge as a primary differentiator. The Cortex platform is now at the cutting-edge of using AI/ML and automation to detect threats earlier, speed up remediation, alleviate the burden on SecOps teams, and reduce operational costs for orgs. Thus far, PANW has over 4,000 Cortex customers and in 4Q22 they closed 52 transactions worth over $1m.
NGS Execution
In previous PANW reports we’ve touched on Arora’s superb execution in M&A and integration for building their Next-Gen Security offerings – across the Prisma and Cortex platforms. In this report, we wanted to add more colour with some simple financial analysis.
In 3-4 years from Oct-18, PANW spent $3bn in M&A, and based on an aggregated basis, we’ve previously estimated that PANW spent 25x the acquirees’ revenue, making the collective revenue, or ARR, $120m at the time of the acquisitions. The following Net Present Value table shows that the ARR at the end of FY22 stood at $1.9bn, growing at 60%. Management offered a 40% growth guidance for NGS during FY23, so we’ve used that for the first year in this Net Present Value exercise. We’ve decelerated the NGS growth down to 15% by FY28 – six years from the present. As aforementioned, during the FY19 to FY21 period, PANW spent $3bn on acquisitions, and we estimate they spent another $300m related to the subsequent integrations. Based on the company’s total FCF margin of 33% and the revenue/ARR split between NGS and the rest of the business, we estimate that the FCF margin for NGS in FY22 is around 0%, or breakeven. From FY22, we incrementally increase the FCF margin to reach 27.5% by FY28.