Palo Alto Networks (TICKER: PANW) Palo Alto Networks Inc Panw Presents Ubs Technology Conference Transcript
Start Time: 10:55 January 1, 0000 11:28 AM ET
Palo Alto Networks, Inc. (NASDAQ:PANW)
UBS Technology Conference
November 29, 2023 10:55 AM
Company Participants
Nikesh Arora - Chairman and CEO
Conference Call Participants
Roger Boyd - UBS
[Advertisement]
Roger Boyd
All right. We will get started. Thank you all for being here at the UBS
Tech Conference. I'm Roger Boyd. I cover cybersecurity for UBS here.
Very happy for this next session to be hosting Nikesh Arora, CEO of
Palo Alto Networks. Nikesh, thanks for being here.
Nikesh Arora
Thank you for having me.
Roger Boyd
Thank you for having me. For all you in the audience, we're going to do
a quick fireside. You can submit questions through the Q&A app. I'll be
happy to forward them on to Nikesh. But maybe just to start, I want to
touch on the threat environment. A couple weeks ago in the earnings
call, you pointed out that there's just a never-ending supply of
threats. And I think point in case we're seeing ransomware evolve from
encrypted encryption to double extortion to they're going to now file
SEC complaints for you. We're seeing what's happening with SolarWinds.
We're seeing attacks that are costing hundreds of million dollars in
lost revenue. Just how do you think about that contributing to the
demand environment security, which I think you would argue is still
strong?
Nikesh Arora
Well, first of all, thank you for having me and thank you for being
here. I think in the last 12 months what has begun to happen, and you
saw signs of this earlier, if you go back four or five years ago, the
cyber-attacks were, you equated a cyber-attack with some kid sitting in
a basement on a computer and trying to get into the NSA or the FBI and
say, I'm so cool. That's like you get cool cred by doing a
cyber-attack. Then sort of nation-states got into it. They started
trying to figure out how to do cyber-attacks and build offensive
capability.
And then you saw a switch. And the switch was, it said, why are we
wasting our time going after one person at a time? Let's go crack the
code on some piece of software that everybody's got. Many years ago I
used to work for a large tech company and we saw that they were trying
to get into the backend of Gmail, right? That way they could go find
anybody they wanted. And so that became a theme. So you see SolarWinds,
you look at some of the CVs that have been exploited from Microsoft or
some of the stuff from many tech vendors. Because once you get in the
backend of a software supplier, then you can go to all their customers
and hack them. So that trend began to happen.
Coupled with that, this notion of this wonderful thing called crypto,
which we figured out was a way of collecting money. And if you look
back, does anybody here know how many people have been convicted for
cyber-attacks in the last 12 months? Less than 10. Does anyone know how
much money has been paid in ransomware in the last 12 months? Billions
of dollars. This is the best ROI, bad thing in the world. You don't get
arrested, you don't get caught, you collect a lot of money. So that's
what causes this huge amount of activity out there. There's people out
there, you mentioned this, I think I found this was the funniest thing
that ever happened. This group -- this company was hacked. They didn't
respond to the ransomware emails. Four days later, the ransomware
actors filed an SEC complaint saying these guys have not disclosed the
fact that they've been hacked. So that's what's going on out there.
It's not getting, it's not slowing down. It's getting bigger and the
dollar amounts that are being asked are getting bigger.
Roger Boyd
Do you think that the buy-in from the C-level, the board level of
companies is getting there? I mean, there's a lot of talk about the new
SEC regulations and the increased oversight that they want on boards in
reports and filings. Do you think we're getting there? Is that
meaningful?
Nikesh Arora
Look, the way we parse it, and I think you'll hear that from every
cybersecurity company, not just us, there is no lack of attention to
cybersecurity as an issue at C-levels or boards around the world. Pick
your company, they're all paying attention. How does that translate
into money? How does that translate into business? The way it
translates into business is cybersecurity budgets do not get cut. You
see your Chief Security Officer shows up and says, I'd like to do this.
The CEO doesn't say, you can't do this, do it next year, because now
they're petrified that if they're the ones who said don't do that
project, they take responsibility for postponing the project. And then
the C-level says, okay, you said I can't do it, I don't have the money.
They'll tell them, get a better deal, try and break it down into a
milestone, try and phase it out.
So you see those things which means it's one of the most robust tech
spending sectors because the budgets aren't getting cut. The more
hacks, more attacks that happen, more people need to go upgrade their
infrastructure, the more awareness there is. So I think all of the
stuff we've talked about, whether it's the threat actors or whether
it's the C-level attention or the SEC attention, it just tells you that
the demand environment does not have any systemic issues.
Now, will they negotiate? Yes, they'll negotiate. Will there be payment
duration changes? Yes, there will be payment duration changes. But it's
hard to find an industry or tech subsector where you can say, other
than possibly AI chip stuff, that the demand factor is not tucked in
the macro.
Roger Boyd
What do you think the answer is here? I mean, there's a lot of talk
about generative AI, and I think you've been pretty clear with some
skepticism around what we're seeing in security operations around
generative AI being meaningful in detecting attacks. I think you made
the comment that you don't want ChatGPT driving your car, and
similarly, I don't want ChatGPT driving my car.
Roger Boyd
I think generative AI...
Nikesh Arora
There's a Waymo stuck on the way. If you just drove up here and there's
a car stuck in the corner, there's nobody in there. It's just stuck.
It's kind of pointing towards the hedge.
Roger Boyd
It is.
Nikesh Arora
Go out and look at it.
Roger Boyd
I think one thing that the co-pilot area is shedding more light on is,
all the investments that cybersecurity vendors like yourselves have
been making for years around machine learning, detection, algorithms.
One, can you talk about the data scale that Palo has, what that means
to drive machine learning through that side of it? And then again, with
generative AI, how meaningful do you really think that will be to
security operations?
Nikesh Arora
Let's do the quick two-minute version of AI, right? The good news is
with all this ChatGPT and all this AI conversation, suddenly
everybody's focused on AI. This is a good thing, right, because people
are paying attention to AI. The way we see it is there's, on one side,
this world of precision AI where you need to be right. You need to know
this is a hedge, not the road, otherwise you'll get stuck there in your
car. So you don't want precision AI to hallucinate.
Cybersecurity uses precision AI. Most car driving algorithms will use
neural networks and machine learning and for reinforcement learning. So
there's a category of learning that uses precision AI. You need a lot
of data to get it right because you need to know where every tree,
every bush, every -- you need to know all normal behavior to figure out
the anomalous behavior, that's how we work in security.
When we see anomalous behavior, we need to know what normal looks like.
I need to watch everything to be able to find what's anomalous. You
can't look at a little bit and say, a little bit tells me the answer. I
got to look at everything. As a consequence, we have on a daily basis,
we ingest five petabytes of data. We have one exabyte of security data
stored in Google Cloud. We are the largest storers, if that's a word,
of security data in the world. Not only that, we're the largest storage
in Google Cloud of any company in the world, after Google. And we only
have 35 customers running our XSIAM products so far. We want to have
hundreds of them getting there.
So just imagine the amount of data we're going to have. What do we do
with that data? It belongs to every company. We look at all the normal,
look for the abnormal and then identify the abnormal and try and stop
it mid-flight, right. So security is interesting. It's only done in two
ways. Either you know some, a known bad, you stop it. You see a bad
URL, bad IP address, you stop it. If it's a suspicious thing, you send
an alert. Well, we've got to get better at looking at suspicious things
and having a point of view saying this is bad and stop it. And that's
what you need a lot of data for. So there's the world of precision AI.
Then there's this world called generative AI, which is beautiful
because there -- the way I describe it, it's a phenomenal tool when
many good answers are possible, you don't have to be right. So, you can
go to Mid Journey or Runway and say, show me a bird with a blue
background. Show me a white bird with a blue background. It's going to
show you 17 white birds blue backgrounds. You may like one, you may
like the other, and she may like another one. That's fine. There's no
wrong answer. It's ugly answer, but it's not a wrong answer. And you
can see that, you're going to write me a rap song about the Warriors.
My eight-year-old boy does that. He goes, write me a rap song about the
Warriors in Shakespeare style and it pops up something pretty crappy,
but it's not a wrong answer, it's just a bad answer. So that's why
generative AI is very interesting.
It has three values. One, it can let you talk in natural language. Two,
it can summarize large amounts of data statistically and give you the
better answer. And three, overtime, it can give you insights from
disorganized data. So if I took all my customer calls and put them in a
large database and ran LM [ph] them against it, it might come back and
give me insights I didn't know I had.
So from that perspective, I think generative AI is going to be hugely
transformative in how we conduct our business, how we deliver --
co-pilot, how we deliver assistance to our customers who are the
cybersecurity complex. So I think every cybersecurity company is
working on some version of a co-pilot, which the purpose of co-pilot is
going to be to make your products easier to use, not solve security
problems.
Roger Boyd
Do you see that becoming table stakes or do you think it can be a
differentiator? You've done some unique things introducing...
Nikesh Arora
Look, I think it's going to become table stakes in the next 12 to 18
months. I spent six hours doing an AI review yesterday across all of
our products. The two biggest challenges are latency and hallucination,
right? And the problem is, I know when I look at the answers it's
giving that one out of seven times, one out of 10 times, it's
hallucinating. You don't know. You can't figure out which one of those
10 is wrong.
So you have to decide which one is wrong. Would you want a product
where you, when I tell you, listen, it's like playing, what is that
game people play? You put a bullet to your head and roll the thing, and
there's one bullet, and keep shooting, and one of them is going to kill
you? You can get one wrong answer in security, use it. You say, oh,
this is a great question. Reboot your firewall.
You reboot your firewall, and poof, goes the magic dragon. So we're
still waiting for the hallucinations to minimize latency to get better.
But I think 12 to 18 months we'll see co-pilots in most products. I
think the question will become how do I deal with so many co-pilots?
Because you have 40 security vendors, you have 40 security co-pilots
now. How do you deal with them? So, then that goes back and reinforces
the theme of consolidation, platformization. And then the question is,
can every small startup afford to build a security product and a
co-pilot next to it?
Roger Boyd
Makes sense. I wanted to shift to XSIAM. I think it's what you would
call a huge opportunity over the next couple of years. I mean XSIAM is
really aiming to solve pain points that have existed in security for
years. Can you just talk to those pain points and improvements you've
seen with your own deployment of the technology and what you're seeing
from the initial customers that have picked it up?
Nikesh Arora
Yes. So let me give you a little bit of background on why we think it's
interesting. If you look, security has big streams or big categories
and then smaller categories. There's a big category of firewalls or
firewalling, big category of identity, big category of endpoint
protection, big category of SOC management, now a big category in
developing cloud security. There's four or five big categories out
there. We play in four out of the five. We don't play in identity.
Now, if you look historically in security, every one of those
categories has hit an inflection point at some point in time. Firewalls
hit an inflection point. There used to be Juniper, a bunch of other
companies, I don't even know I wasn't there. And then suddenly, Palo
Alto came out with next-generation firewall that was an inflection
point. People wanted the next-generation firewall. It was good enough
for them to rip out what they had.
If you look at the endpoint business, there's McAfee and Symantec. And
you found an inflection point called EDR. You saw the likes of
CrowdStrike and [indiscernible] and all these others show up and McAfee
and Symantec had to take a backseat. You take a look at what happened
in the world of SASE. These can came out, did a great job, built what
they built, and now every one of us is chasing SASE. So there are
inflection points in the industry. And those come when technology
changes, there's 10 to 12 year-old software in that category. There's
not a lot of innovation that's happened and somebody built something
too amazing that it's worth ripping out the old stuff.
I think that inflection point is now coming to SOC management, right?
Where there's 12 to 15 year-old technology in the whole SIEM category,
in the SIEM space, which was designed to be reactive security. Now we
need real-time security. To do real-time security, you have to look at
data very differently, right? You just can't take data used to store
last year and run AI against it. As most people will tell you were here
or over here that the biggest wrong with AI is we don't have good data.
So we're all busy cleaning up data.
Well, 4, 5 years ago, we said, an inflection point will arrive in SOC
management that will require better data. So we went and instead of
buying many of the options that were out there, and the one thing got
sold recently, we went and said, we're going to build it from scratch.
That is how we're able to ingest and store 1 exabyte of data in GCP and
run AI against the machine learning against to go make that happen. So
early days. I don't want to get out of my skids, but really good
promising outcomes. We are able to bring down the mean time to
remediate a security incident from 5 to 6 days to on average 1 to 3
hours.
Now that dovetails the SEC requirement. You have to report with it 4
days. When you get brief, everybody looking at say, go, I'd like to get
my security issues resolved much sooner because I don't want to be
telling the SEC I've been breached and like, oh, I haven't solved the
problem yet. So it's promising.
We've had a few really big deployments recently, which have gone very
successfully. There's a lot of customer interest. So we're building
capacity, we building capability and we're working with third-party
partners and you'll hear more about it from us in the coming months
that we're creating other people who are going to deploy this for us
because we think this is a huge opportunity and I think most inflection
points last 2, 3 years, then everybody starts to flood in there with
their own versions of products in SASE part. So we think we have an 18
to 24 month window and it pulls down how quickly and welcome the
executed that timeframe.
Roger Boyd
Okay. I mean you've talked about this $1 billion pipeline in less than
a year of launching, it's really impressive. I think you just talked
about 18 to 24 months, but how do you think about the customers you're
going after? You have 5,300 Cortex customers that I think would be kind
of logical first step. But how do you think about it? I mean you talked
about this being a transformational shift in SOC technology. How do you
think about that being -- something that brings customers to Palo Alto?
Nikesh Arora
Yes. So there's three categories. One care of customers that already
deployed our XDR product, which is somewhat a prerequisite for us to
deliver the AI capabilities of XSIAM. So those become much easier
conversations because an upsell. You say you already have the hard work
is done. Let me sit on top and sure you all the beauty of analytics
that I can do and replace all bots of stuff. And in the meantime, I'm
building more capability every day on XSIAM, so I can create more
outcomes from my customers. That's one stream. And we know those
customers, they're fully deployed, they're happy.
Another stream is people who are going through as part of the regular
process this year, we're going to redo our SIEM or SOC, it's coming up
for renewal in 12 months. It's too expensive. We don't like the current
solution. We have to evaluate what's going on in the market. So there
we show up and say, look, please consider us, we have this very cool
product. It's new, it's amazing, please try. So it's kind of another
opportunity, right?
And the third opportunity is, where we're working with third parties
like SIs, people who advise people to redo their cyber security
architecture, we're trying to get ahead of that and say, listen, bake
us in, into the thought process as you go create this new architecture.
So they all have sort of differing lifecycle in terms of when they're
going to get done, but like it's early days. So the 3 to 5 years we're
sitting here, hopefully in turn around and say this is the
fastest-growing security category and product that we saw in the
industry.
Roger Boyd
You just talked about XDR being prerequisite. And you've been building
credibility in the EDR XSIAM market for some time. You have -- it's not
the Traps product anymore. You've got credibility from MITRE and
third-party valuations. Any color you're willing to provide on where
you think you are in terms of market share, kind of growth there and
customer awareness?
Nikesh Arora
Look, the XDR product or to start off as a replacement to the endpoint.
The whole -- the last version of endpoints was, I pushed a lot of
signatures to your endpoint. It checked at the door. If it's a bad
thing, I told it's a bad thing and I stopped it. And the world figured
out, well, latency is gone, you can send stuff to the cloud process and
send the signal quickly back. So we came in at EDR, where you collected
data the endpoint, you ship in the cloud, you analyze it, and you stop
things mid-flight, much better because it's more real-time and then you
can do all kinds of wonderful AI stuff.
We're taking it one step up, so they can now collect more data from
there, send to the SOC and use that as a basis of cross-curating and
cross-multiple security categories. So yes, XDR is a prerequisite to
doing better SOC management. It also is a category in itself. But I
think over time, it's going to blend into this category of redoing SOC,
especially AI is going to be relevant.
So if you think about it 5 years ago, there were north of 10 players in
the endpoint space. Some of them are sort of naturally attriting. Some
of them are up for sale, some of them being shut down. So there's a lot
of movement. I think we're down to 4 or 5 real contenders in that
space. I think we probably end up with 2 or 3 as it starts to
consolidate around AI plus soft management plus sort of the endpoint
capability. It's not hard to figure out who those 3 are likely to be.
Roger Boyd
Do you think that Palo needs to be more aggressive in that space in
particular, or do you think that, kind of to your point, as people look
at SOC modernization, that kind of just pulls along that category?
Nikesh Arora
I don't know what more aggressive means. We're not aggressive when it
comes down to it. We don't say, yeah, you take this one, I'll take the
next one. We don't do that. We fight every one of them like everybody
else. So we do have a broader portfolio. It's kind of -- I guess the
question becomes, there are two or three ways you can think about
business. One way is that, I want every customer, every small,
medium-sized customer gives me $5,000, $2,000 and I need $1 million of
those, and I'll make a lot of money. Now, that's great if you have a
self-signed product, and you don't have to have a truck drive and do a
sales call. You don't have to have customer support. That works
beautifully in products which are sort of developer-led or user-led.
It's harder in complicated security products where you actually, they
want to talk to you, and they want to deploy it, and it's a really
important product. So there's theories out there. If you can sell one
customer a lot of things, your cost of sales goes down, right? I think
the hard-known understanding of this enterprise is that, the largest
enterprise companies in the world that are out there, their cost of
sales is about 30%. If you look on my P&L, the biggest cost is, cost of
sales and marketing, even today. If you look across enterprise, R&D is
10% to 15%. Pick your favorite tech company, amounts of $5 billion to
$10 billion. That's roughly where it is, 8% to 15%. 8% will be
struggling in a year, in a few years, 15%. It's probably where they're
doing lots of innovation. Look at G&A, it's between 4% to 8%. If you're
Broadcom, it's probably a lot less, but whatever. 4% to 8%. So the
majority of your difference in your operating margin and your sort of
revenue is cost of sales.
So enterprise CEOs should pay attention, how do I minimize my cost of
sales long-term as I scale my business, that's the way to get lots of
operating margin expansion. The only way to do that is to sell more
things to the same customer. So we're trying to make sure that we can
sell more things to the same customer, which is good for them, by the
way, because it gives them consolidation from a platform perspective.
It gives them a better security outcome. It's better business for us.
So from that perspective, I don't look at these things as individual
streams that I've got to go sell individually a lot of them, I look at
collectively, how can I give a platform to a customer which gets them a
better security outcome? Maybe make Palo Alto a big trusted partner. I
think there's tons of room out there in the market to do that.
Roger Boyd
Maybe shifting to Firewall, you've been very candid about your
expectation that that market should slowdown to kind of a low
single-digit pace for a couple quarters now. The last two years have
been maybe abnormally strong periods of demand for a number of factors.
And then within your medium-term guidance is, an expectation that the
hardware side of product kind of grows at the low-end of that.
How should investors think about the software piece of Firewall? You've
been kind of a leader on the software form factors, how should we think
about growth of that, especially as you push into areas like Firewall
as a service and personal cloud?
Nikesh Arora
Let's go back to basics. What are Firewalls? They inspect traffic. When
there's traffic, you've got to look at the traffic to see if it's got
bad IPs, bad internet, bad DNS, [indiscernible] bad stuff floating in
your network every three to five years, generally speaking. And each
one of those bits has to be inspected. There's no free traffic, you
have to decrypt it, inspect it, and recrypt it. Some people don't
decrypt it, don't look at encrypted traffic and that's kind of one part
of it.
So, A, volume is continuing to double. This is like whatever the right
version of Moore's Law for traffic is, it's happening and it's not
going to stop. It doesn't stop. More internet shit, more videos, more
everything, more Zoom. There's more and more traffic in the world. So
the act of inspecting traffic is not going to go away.
Historically, the act of inspecting traffic happened at the data center
where large volumes came in you had a big box of firewalls, which was
hardware. Now, hardware, by the way, is the most efficient way to
inspect because hardware is generally cheaper than software, right?
What happened though is that, people said wait a minute, now I need to
inspect traffic when everybody's working remotely, traffic's getting
distributed. I don't need a big box. I can have small boxes. And people
said, well, you don't need a small box. You just spin up a piece of
software that does that for you. So what has happened is the form
factor is changing, but the demand is not going away.
Now some companies are very over-indexed on hardware, so they don't
have a lot of software form factors, they don't have SASE, they don't
have software firewalls. Some companies like us have hardware,
software, and SASE. In the last five and a half years, I'd say we've
shifted 50 -- 30%, 40% of our demand to software. And we know that, we
can somewhat control it. You go to a customer and say, hey, give me a
solution to inspect this traffic. I'm like, you can have the small box,
or I can run a VM. I think, technically, VM is much better. I can
upgrade it much easier. You don't have to have somebody go upgrade the
firewall if it goes down. I can remotely upgrade, and I can remotely
upgrade all the software. That's a good idea, we'll take the software
one.
Now, if you only have hardware, you can't sell them a software one. So
we've done a lot better. We have north of 50% market share of software
firewalls. We have SASE, which we think we had a 50%, 60% of these get
out of business, give or take. So we've been shifting there. We see
what's happening in hardware. The only problem is, for investors,
hardware is recognized as instant revenue, software becomes ratable, so
it gets confusing. You took a dollar of hardware, you recognize the
revenue. Took a dollar of software, you recognize the third, the third,
the third. Oh shit, now what do I do?
So all you're seeing is, you're seeing dollar transitions happening on
our P&Ls. The volume is not going, the demand's not going, yes,
hardware is constrained because software is winning compared to
hardware in the firewall space for lower traffic volume use cases.
Roger Boyd
On SASE, I think including Palo, there's maybe three or four vendors,
let's call it 15.
Nikesh Arora
I said 2.5, but okay.
Roger Boyd
3, 2.5, we'll call it...
Nikesh Arora
Maybe 4 or 5 now, yeah.
Roger Boyd
With maybe 15,000 customers total and it's been a huge growth area for
Palo, 60% growth over the past couple of years, but it still feels very
early in the adoption curve. And I'd love to get your perspective on,
if you think we're going to start to see SASE become more mainstream? I
mean, there's a reason why?
Nikesh Arora
I heard people here in the States say firewall's going to go away and
it's all going to be SASE, so that's great. We're in the SASE business
too, I like that. I think the more simplistic way of thinking about
SASE is like this. When everything was going back to the data center,
you had a big box there. Now everything's distributed between public
cloud, between remote access from home, between the data center. So you
have a new network topology. It used to be one topology going back, now
it's a distributed topology. Re-architecting your network security on
the distributed topology can be called SASE.
The right way to do it is to have some hardware for a data center, it's
still cheaper to do it that way. Have some VMs for your certain use
cases and have remote access for certain use cases. So that sort of
hybrid architecture is what is the zero trust SASE architecture, I
think the whole world is going there. So you will see in the next 5 to
10 years that SASE as we know it is going to become bigger and bigger
because hardware as we know it is going to become smaller and smaller
and more software firewalls are kicking because the traffic continues
to increase.
So there is a natural demand of traffic which is causing the drive in
SASE and there's a shift from hardware to software going on. So I don't
think it's a category. So that's why in the early years we used to have
this thing called firewall as a platform and that thing is still
growing at double digits. It's still growing at 15%, 20% rate, has been
consistently. So we think the market is growing at 15% to 20% and
there's a form factor shift happening in the middle of it. So yes, SASE
is going to be a very large category, will continue to be a large
category. Now it's sort of bringing in SD-WAN into it as well.
Roger Boyd
A lot of talk about all the entrants into that market. Some of your
direct competitors ramping up investments there and Microsoft wants to
be in the conversation. How do you think about the competitive
environment and how important is it to customers to have that track
record of having had this solution in the market for four or five
years?
Nikesh Arora
It's very funny. I was on holiday last week and some other security
companies were going to report this week and my wife said to me, she
was like, what do you think's going to happen? I said, I'd like all of
them to do well, which means the market is strong and demand is strong.
And they all did.
The way I think about competition, remember, five years ago we had 1.5%
market share of $180 billion market. We probably have 3.5% now, which
means 96% of the time somebody else has got the business. I live
happily with competition. It's great, it's wonderful, drives more
innovation. Our platformization continues to get us more and more
share. The more people there are in the market, the more innovation
there is, the more they could tell customers and say, listen, you
should move to SASE.
You know what happens when a customer is told you should move to SASE?
They say, let's do an RFP and see what Palo Alto have? So I'm happy
that people are out there telling them that SASE is important and they
should go deploy SASE because then it allows us to go participate in
that market. So I think right now we can all grow without trying to
steal from each other.
Roger Boyd
Fair enough. Maybe last question on cloud security. You recently
disclosed some pretty impressive module adoption stats. I think the
pushback I get from investors, maybe that's not directly translating to
ARR growth, but it's still very early market, architectural decisions
are still being made.
How do you think cloud security evolves from here? Are we at a point
where we're moving past visibility as the main pain point, some of the
vendors that have done very well solving that use case into a place
where detection response and code to cloud are becoming more important
and driving more?
Nikesh Arora
That's a great question. I think we all get confused because you need
large numbers from the hyperscalers that come out there, they did so
many billions of dollars of business. If you look at the world of
actual deployment on the other side, I'd say there's three sets of
companies. There's the cloud SaaS companies. You take the workdays and
the ServiceNow and all these people who deliver SaaS products. They
have to have good cloud security.
Those guys are busy buying platforms. They're not buying point
solutions because they know their entire business depends on making
sure they can keep those customers' data secure. So most SaaS companies
are moving to platforms already out there. Then there's a bunch of
people who are early in their deployment lifecycle of public cloud. If
you go ask your traditional companies, say, how much your
mission-critical applications are in the public cloud, the answer is
not many, 10%, 15%. So they haven't moved their mission-critical stuff
there.
The moment they move their mission-critical stuff there, they're going
to get more serious about cloud security. The third ones are people
still dabbling around, still doing development, looking at point
solutions. So I think you're right, it is an early market. There's no
doubt in our mind that it's going to be a large market. It's going
through its paces. It's slowly growing. We track consumption.
Our consumption shows that 30% to 40% growth is consistent over the
last few years. We think that stays at those levels for the next 5 to
10 years. If something is consumed on a consistent basis at 30% to 40%
a year, I think revenue's follows that consumption track. We're very
happy that we keep building the platform in the process. We need growth
levers in the future. Otherwise, you guys won't like us.
Question-and-Answer Session
Roger Boyd
Right on time. Thank you so much for an insightful discussion. Thank
you all for being here.
Nikesh Arora
Thank you for having me.
Roger Boyd
Thank you, guys.
