Q3 2024 Palo Alto Networks Inc Earnings Call

Participants

Dipak Golechha; Executive VP & CFO; Palo Alto Networks, Inc.

Lee Klarich; Executive VP & Chief Product Officer; Palo Alto Networks, Inc.

Nikesh Arora; Chairman & CEO; Palo Alto Networks, Inc.

Walter Pritchard; SVP of IR & Corporate Development; Palo Alto Networks, Inc.

Andrew James Nowinski; Senior Equity Analyst; Wells Fargo Securities, LLC, Research Division

Benjamin James Bollin; Senior Research Analyst; Cleveland Research Company LLC

Brad Alan Zelnick; MD of Software Equity Research & Senior US Software Research Analyst; Deutsche Bank AG, Research Division

Brian Lee Essex; Research Analyst; JPMorgan Chase & Co, Research Division

Fatima Aslam Boolani; Director & Co-Head of Software Research; Citigroup Inc., Research Division

Gabriela Borges; Analyst; Goldman Sachs Group, Inc., Research Division

Gray Wilson Powell; MD & Security and Infrastructure Software Analyst; BTIG, LLC, Research Division

Gregg Steven Moskowitz; MD of Americas Research; Mizuho Securities USA LLC, Research Division

Hamza Fodderwala; Equity Analyst; Morgan Stanley, Research Division

Joel P. Fishbein; MD of Software and Cloud Technology; Truist Securities, Inc., Research Division

Jonathan Frank Ho; Partner & Technology Analyst; William Blair & Company L.L.C., Research Division

Joseph Anthony Gallo; Equity Associate; Jefferies LLC, Research Division

Matthew George Hedberg; Analyst; RBC Capital Markets, Research Division

Saket Kalia; Senior Analyst; Barclays Bank PLC, Research Division

Shaul Eyal; MD & Senior Analyst; TD Cowen, Research Division

Tal Liani; MD, Head of Technology Supersector & Senior Analyst; BofA Securities, Research Division

Presentation

Walter Pritchard

(presentation)
Good day, everyone, and welcome to Palo Alto Networks Fiscal Third Quarter 2024 Earnings Conference Call. I'm Walter Pritchard, Senior Vice President of Investor Relations and Corporate Development. Please note that this call is being recorded today, Monday, May 20, 2024, at 1:30 p.m. Pacific Time.
With me on today's call to discuss second (sic) [third] quarter results are Nikesh Arora, our Chairman and Chief Executive Officer; and Dipak Golechha, our Chief Financial Officer. Following our prepared remarks, Lee Klarich, our Chief Product Officer, will join us for the question-and-answer portion. You can find the press release and other information to supplement today's discussion on our website at investors.paloaltonetworks.com. While there, please click on the link for quarterly results to find the Q3 '24 supplemental information and Q3 '24 earnings presentation.
During the course of today's call, we may make forward-looking statements and projections regarding the company's business operations and financial performance. These statements are made today, are subject to a number of risks and uncertainties that could cause our actual results to differ from those forward-looking statements. Please review our press release and recent SEC filings for a description of these risks and uncertainties. We assume no obligation to update any forward-looking statements made in the presentations today.
We will also refer to non-GAAP financial measures. These measures should not be considered as a substitute for financial measures prepared in accordance with GAAP. The most directly comparable GAAP financial metrics and reconciliations are in the press release and the appendix to the investor presentation. Unless otherwise noted specifically, all results and comparisons are on a fiscal year-over-year basis.
We also note that management is scheduled to participate in the Bank of America Global Technology Conference in June.
I will now turn the call over to Nikesh.

Nikesh Arora

Thank you, Walter. Good afternoon, everyone, and thank you for joining us today for our earnings call. I hope everybody enjoyed our new marketing campaign teaser featuring Keanu Reeves that goes live on national media.
Let's start at the beginning. I'll update you on what we have experienced in Q3. First and foremost, cyberattacks continue unabated. We're seeing a consistent stream of nation-state activity that is systematically looking for software supply chain and hardware zero day vulnerabilities and attempting to exploit them at scale. Additionally, there continues to be a robust stream of attack activity targeted at large enterprises and pieces of critical infrastructure.
We continue to see high-profile breaches, some of which were widely reported in the press again this quarter. Most organizations faced the challenge of an ever shrinking time window for a bad actor to enter their environments, find valuable data and exfiltrate it. The window is now measured in hours. In comparison, the time it takes for an organization to discover a breach and stop the malicious activity continues to be measured in days and weeks. While not a new phenomena, with new disclosure mandates, this challenge is now clearly out in the open. With AI, we expect the attacks to come at an even faster pace.
I don't need to elaborate on the current enthusiasm around AI. Almost every one of our customers is either experimenting with AI or plans to deploy some use cases in the near future. As usual, their employees are way ahead. Almost 50% of employees of most companies are using some sort of AI application, LLM or copilot to explore, learn and make themselves more productive.
Whilst this is great for the evolution and adoption of AI, this is introducing a whole new set of threats. As some of you are aware, we have recently announced a suite of products, which are aimed to secure this AI usage by design. More about this later, but I expect this to continue to provide a tailwind to the cybersecurity industry.
On spending for cybersecurity, we see no changes, pace or trajectory. Most customers have a series of projects they want to get done, and the only limiting factor seems to be their execution capability. Customers continue to focus on Zero Trust transformations, coupled with the need for new network architectures to adapt to a more hybrid infrastructure.
The insurgence of cloud migrations is being driven by the need to get their data in the cloud to be AI ready causing discussions around the cloud security platform. And as you may all have noticed with all the M&A activity, the security operations space is getting rejuvenated, is something we've been preparing for with XSIAM.
The accelerated pace of change in cyber, even with healthy increase in cybersecurity funding, many organizations aim to simply keep pace with the volume of threat activity they see. Most cannot do this and are increasingly receptive to a better way of tracking their security challenges -- tackling their security challenges, [windless sprawl] and architectural complexity. We firmly believe that answer is platformization of cybersecurity over time.
I'm delighted to report, despite the concerns around our platformization approach after our last quarter, the customer feedback has been nothing but encouraging. We have initiated way more conversations in our platformization than we expected. If meetings were a measure of outcome, they have gone up 30%, and a majority of them have been centered on platform opportunities. In short, demand is robust, and my expectation is that we will continue to see it be that way for the next many quarters. With this backdrop, we are pleased with our strong Q3 results.
As you can see, we delivered top line growth ahead of the market and continue to drive growth while improving profitability. Our performance was highlighted by 47% growth in our next-generation security ARR. As we continue to transform our business to a security software business, and we saw a 23% growth in RPO, an uptick from last quarter, this translated into 15% revenue growth and 3% growth in our billings.
As we have articulated earlier, we don't see the billing metric as a true indicator of business trend. It continues to be impacted by payment terms where more and more customers prefer annual billing plans. However, if you implied bookings, you will note that we saw an uptick over that in the last -- over the last 2 quarters. We actually ended up billing -- booking backlog -- billing backlog this quarter.
We continue to operate our business efficiently. Our operating margins expanded by 200 basis points year-over-year, driving 25% growth in operating income and 20% in our EPS to $1.32. Our cash generation was strong, and again, our GAAP net income grew substantially year-over-year.
Before I continue with highlights from Q3, I'm aware that our accelerated consolidation and platformization strategy created significant conversation last quarter. We also had questions from analysts and investors on this topic since we reported our Q2 results in February. I thought I'd share more background on how we got here to provide context and also offer a platformization framework for you to help understand why we are convinced that we can build a much larger business over the next several years and platformization is key to achieving that.
When we embarked on our journey to transform our company, we were keen to create interest and convince our customers that if we solve their problems, not just with our next-generation firewalls and the associated subscriptions but also with a set of best-of-breed products across 20-plus categories organized across 3 platforms. That strategy was hugely successful and saw us achieving nearly $4 billion in NGS ARR. The majority of focus of our teams was landing multiple products across our [3] platforms and our customers. Whether we were able to land at a brand-new customer for Palo Alto Networks or we added products from new platforms to our existing customers, we were happy. Landing could range from a single product use in part of the organization to broader usage across the organization.
From that lens, if you look at our top 5,000 customers, we have landed 2 or more of our platforms at about half these customers, and these customers contribute just over 80% of NGS ARR. If you look at it by -- this by platform, we have landed 97% of these top 5,000 network security, over 20% of them in Prisma Cloud and over 40% with Cortex. By all means, our land the platform strategy was extremely successful.
In landing with multiple platforms, many of our customers have leveraged our capabilities across key cybersecurity buying centers such as network security, cloud security and security ops. Most of this cross-platform adoption has happened more organically with customers adopting incremental products on Palo Alto Networks on their own pace. Governed by the complexity of their environment and the friction of dealing with contracts and multiple vendors, not many of our landed customers are fully platformized; and the ones that are fully platformized, we saw encouraging results.
We realized that for fully platformized customers, while they saw better security outcomes, our ARR profile was also very different. While our average next-generation security ARR for our landed customers ranges from $200,000 to $300,000 for our land strategy, we discovered that our ARR for fully platformized customers ranges from $2 million to $14 million, depending on how many platforms the customers are standardizing on. This drove us to accelerate the rollout of our platformization strategy at the end of the last quarter, following successful pilots earlier in the year. We've created interest in the market, started conversation with customers looking to begin their platformization journey and spurring existing sales cycles toward a more strategic outcome.
Having personally reviewed over 500 of our top customers in detail this past quarter, having had a few hundred conversations with CISOs, CIOs and CEOs, I continue to be convinced of our opportunity to deliver full platformization to our strong -- to our top customers. We're still early in the results from full platformization. Across these top 5,000 customers, we have completed about 900 through Q3 2024. Our Q3 efforts resulted in approximately 65 incremental platformization sales in Q3, just up 40% since Q2.
It was this framework that was a foundation for our goal of $15 billion in next-generation security ARR by fiscal year 2030 that we first discussed last quarter. With our incremental momentum in platformization, we see a runway to delivering approximately 2,500 plus platformization sales, up from the current 900 while continuing to land our multiple platforms in our customer base and adding new customers.
I showed you the benefits we see in our ARR from our success driving platformization. Our customers also see significant benefits as they adopt our full platforms. We have talked to you in the past about reduction in median time to resolution with XSIAM, which takes less than 1/10 of the time it took before XSIAM was deployed as customers platformize on Cortex.
IDC recently validated the benefits platform customers see in a study published earlier this year, independently proving much of what we have talked about. Customers saw productivity benefits as much as 30% to 40% efficiency improvements and significant improvements in security outcomes.
I could talk further about the benefits, but what really brings us to the forefront is some examples of our significant transactions in Q3. A U.S. county agency signed a 7-figure transaction landing our firewall subscriptions as well as Cortex XDR and becoming a Palo Alto customer for the first time. We displaced a competitor that has sold both of these capabilities to the customer and competed against us on an appliance vendor that could not offer best-of-breed capabilities across these 2 categories.
A large U.S. financial services company that was an existing platform customer faced significant challenges in their SOC. Despite a staff of 40 in the SOC, they were not achieving their goals and start a transformation plan. We signed an 8-figure deal, including XSIAM, our ITDR or identity threat detection and response offering, and our managed detection and response service.
A global data services provider was unhappy with this incumbent SASE provider facing outages that created lost productivity. He was also never able to integrate his VPN and URL filtering capabilities fully. The customer selected our SASE capability for approximately 65,000 mobile and branch office users, including CASB, DLP, enterprise browser and ADEM capabilities for many of them. This was a highly competitive situation, but our ability to deliver consolidated capabilities through a platform across a half a dozen areas as well as our superior security versus incumbent won us a business.
Finally, a large health care company experienced a breach and engaged our Unit 42 incident response services. After we helped the customer remediate and get back online, we were able to educate the customer on the benefits of platformization. The customer fully platformized with us, standardizing our network security, Prisma Cloud and Cortex. This transaction was the largest in the history of Palo Alto Networks at nearly $150 million of TCV. Beyond these showcase deals, our overall large deal activity was healthy in Q3, as shown by significant increase in our accounts and transactions over $1 million, $5 million and $10 million in the quarter.
We also recently announced our partnership with IBM. IBM and Palo Alto Networks have done what in my mind is a one-of-a-kind partnership. This partnership involves migrating the QRadar customers of IBM to XSIAM, where IBM will be able to deliver industry-specific capabilities on XSIAM using watsonx. Given their leadership position in the Gartner Magic Quadrant, now we can collectively deliver an even better solution to both their existing and new customers.
Enabling over 1,000 IBM security consultants on the entire Palo Alto Networks portfolio will allow us to drive platformization in an accelerated fashion. We will be IBM's preferred cybersecurity partner across network, cloud and SOC while driving a significant book of business for IBM. Additionally, IBM will platformize on Palo Alto products. We will extensively leverage watsonx across both our operations and products. And lastly, but not the least, we will work on co-developing solutions for cloud security.
Last quarter, when we rolled out our accelerated consolidation and platformization strategy, we also activated our AI leadership strategy. Leading up to this over the last year, we've oriented an increasing portion of our R&D investments towards AI. We have seen growth in customer interest and adopting AI to drive business value and bad actors using AI as I discussed earlier.
In early May, we announced our comprehensive suite of AI security offerings and believe we will be first to market with capabilities to protect the range of our customers' AI security needs. We rolled out 3 products to safely enable the use of AI from employees using AI to enterprises building into their applications. AI Access Security, AI-SPM and AI Runtime Security put us at the forefront of securing AI adoption.
We also believe our co-pilots across our 3 platforms, which are context-aware, can perform and automate user action, surface alerts and best practices, and provide in-product support, all with near perfect accuracy. Furthermore, we announced our Precision AI security bundle to leverage in-line AI to counter AI attacks with AI defense. We have had strong early customer engagement with these offerings, which we expect to be made generally available beginning of July. As you heard from our teaser trailer with Keanu, this isn't Sci-Fi. This is Precision AI.
More broadly than AI, it has been a busy last 3 months from an innovation perspective. Our SASE 3.0 launch, which we rolled out early this month, debuted with several unique industry defining capabilities. We announced industry's only secure enterprise browser integrated into SASE; and as end user engagement with AI applications grow, the browser becomes an important defense layer against the AI threats. Additionally, it is becoming clear that the browser offers a better way to secure contractors, mobile devices and managed devices with SASE integration providing a simpler and more secure approach to adoption.
We launched AI powered data security integrated into SASE, leveraging industry's first LLM powered data classification. This new classification engine combines the strength of context-aware machine learning model, the power of LLMs, understanding how to increase classification accuracy. Lastly, as part of our SASE 3.0, we launched application acceleration, which understands each user's journey within enterprise SaaS and cloud applications and optimize its performance for these applications. Customers see performance up to 5x faster than the user experience in general Internet.
This rapid cadence of innovation in SASE has enabled us to maintain SASE ARR growth above 50% for the sixth quarter in a row. In Prisma Cloud, we have completed the first phase of rollout of data security posture management, which came from the Dig Security acquisition. We also added support for more than 100 new APIs across the major hyperscalers to stay ahead of our customers by securing the cloud services [iota]. Based on our Cortex Xpanse technology, we did launch cloud discovery and exposure management, leveraging our Xpanse data natively in Prisma Cloud. Over 100 customers now use this capability to evaluate Internet exposure risks and discover unknown Internet-exposed cloud assets.
Also during Q3, we launched CDR, cloud detection and response, which extends our XDR capability into the cloud and give customers unified view of their entire environment from cloud to end point to network. CDEM and CDR show the power of having both Cortex and Prisma Cloud platforms as we can leverage these sophisticated capabilities to benefit cloud customers.
Last but not least, on Cortex, we launched XSIAM about 18 months ago, and this offering has already elevated the profile of Cortex in the market. We see steady demand for XDR as a foundation of Cortex, where we are landing many new customers, and now we have north of 5,800 customers on XDR. With $400 million in cumulative XSIAM bookings coming out of Q3, this offering is really going mainstream with customers understanding the value proposition versus the traditional SIEM. XSIAM has accelerated our Cortex ARR growth, and we continue to see a strong pipeline of opportunities.
We are converting our innovation recognized leadership, adding 2 new positions this quarter: one was in managed detection and response; the other in data security posture management, leveraging our Dig acquisition and demonstrating our ability to acquire technology and rapidly integrate into our platforms.
As many of you have undoubtedly seen, our rollout of platformization has stoked a long-standing debate within the cybersecurity industry about whether customers desire a platform or best-of-breed cybersecurity. From the Palo Alto Networks perspective, we've proven it is possible to deliver best of platform. This is why we have invested in building leading products, and we have now recognition for product leadership in 23 categories while also delivering on the benefits of integration across our 3 platforms.
To summarize, before I pass off to Dipak, please take away a few conclusions from my prepared remarks. One, we put our strong Q3 results in a positive spending environment where cybersecurity priorities are well funded. Beyond the continuation of a challenging threat environment, new threat vectors from AI are starting to surface as the usage of AI grows. We've been pleased with the initial traction of our accelerated consolidation platform strategy. This drove an increase in bookings with deferred payments and impacted our billings, something we expect will continue. We had a big quarter of innovation, especially as it relates to AI, where we strive to lead the industry in securing this powerful productivity medium while also doing so comprehensively.
As we look forward, we have significant pipeline heading into our largest quarter of the year. We're just beginning to see the benefits of platformization accrue to our business. We will continue to make further investments here while balancing delivering profitable growth and have chartered a path with conviction towards being a $15 billion NGS ARR company.
With that, let me pass you on to Dipak.

Dipak Golechha

Thank you, Nikesh, and good afternoon, everyone. To maximize our time spent on Q&A, I will provide highlights and you can review results available in our press release and the supplemental financial information on our website. Within our revenue of $1.98 billion, product revenue grew 1%, while total service revenue grew 20%. Within services revenue, subscription revenue grew 25% and support revenue grew 11%.
Moving on to geographies. We saw revenue growth across all theaters with the Americas growing 15%, EMEA up 20% and JAPAC growing 8%. This quarter, our lower JAPAC revenue growth was driven by lower product bookings in the region, offset by higher subscription bookings, which benefit revenue over time.
We reported Q3 billings within the range we guided, although as Nikesh and I have noted several times in the past few quarters, we continue to focus less on this metric. We saw an increase quarter-over-quarter in business transacted with deferred billings, which was also higher than we forecasted. The impact on our financials from platformization this quarter was in line with what we expected 90 days ago, and our expectations around the impact in Q4 and beyond is unchanged from what we talked about in February.
First, we saw a greater volume of large deals with some of these customers opting for deferred payments over the term of their purchase instead of paying upfront as they grapple with the higher cost of money. This drove the quarter-to-quarter increase in periodic billing plans that I noted. Also, this level of periodic billings was higher than we forecasted 90 days ago. We also saw an uptick in the array of our platformization programs we launched early in the quarter. These programs continue to ramp up as we roll them out broadly.
Within our RPO of $11.3 billion, our current RPO was $5.4 billion. Our average duration of new contracts increased slightly year-over-year but remained at approximately 3 years. On our balance sheet, you will see that our debt balance came down by $659 million. The driver for this was early conversion, which occurred at the option of the debt holders and were settled by us in cash. Our remaining debt matures in June 2025 although we may continue to see early conversions.
During Q3, we spent $500 million to repurchase 1.7 million shares of our common stock. Our buyback strategy remains opportunistic.
I know that billings has been a significant focus for investors. As you're all aware, remaining performance obligation or RPO captures the full value of our contracts independent of customer billing terms. As we have explained to you over the last year, with an increase in factors impacting payment terms on a quarterly basis, there's been significant volatility in our billings. With this volatility in mind, we've been increasingly focused on driving high-quality bookings, which add to RPO and maximize our NGS ARR in contracts. Focuses on these metrics provides a more relevant view of the business.
If we look at the history of these metrics for our company, you see that NGS ARR has consistently grown ahead of our other metrics and as it continues to contribute a higher proportion of our revenue. You also see the correlation between RPO and total services revenue growth is high. Our RPO is mainly comprised of contracts for offerings that carry ratable revenue, which are recognized through our total services revenue. Billings, on the other hand, is significantly influenced by the invoicing terms on contract signed, which adds significant volatility. In Q3, we saw RPO growth tick up along with strength in NGS ARR, including us raising our guidance here. This is in contrast to billing trends, which went the other direction, thereby showing the divergent trends and actions -- in action, our Q3 results.
Nikesh talked briefly about our first-of-a-kind IBM partnership that has multiple facets that touch each of our platforms and include significant devotion of resources from both companies. I'd like to provide more details on the financial impact we expect to see. As part of the partnership, we have agreed to acquire IBM's QRadar SaaS assets, certain QRadar intellectual property and IBM's on-premise QRadar customer list. The total consideration is $500 million plus earn-out consideration based on successfully migrating QRadar on-premise customers to our XSIAM offering over the next several years. We anticipate closing the transaction by the end of September 2024, subject to regulatory approvals and other customary closing conditions. The calendar year 2023 QRadar SaaS revenue was on the order of $100 million. However, as we work through details of the customer contracts we are acquiring and the deferred revenue associated with this business, we expect our recognized revenue could be much lower than this in our fiscal year 2025.
We will provide more information on the financial impact closer to the close of the transaction. We will invest to fuel this partnership and ensure a seamless experience to curate our customers purchasing and migrating to XSIAM. As part of the partnership, we have entered into an agreement with IBM, whereby they will operate parts of the business on our behalf on a medium-term basis. We expect we can make these investments within the profitability framework we spoke of previously. Specifically, we continue to expect 28% to 29% non-GAAP operating margin in fiscal year 2026 and 37% or greater free cash flow margin through fiscal year 2026.
Before I provide Q4 guidance, I wanted to remind you of what we talked last quarter when we introduced platformization and discussed the top line headwinds we expected it would have. We continue to expect platformization-related drivers, both larger deals with associated cost of money impacts and acceleration in platformization programs will impact our billings over a total of a 12- to 18-month period.
Consistent with what we noted in February, we expect that this will persist through fiscal year '25 as we anniversary the rollout of these programs and resulting in lower billings and to a lesser degree, revenue. Beyond this period, we expect to grow faster than we discussed in August and sustain this growth for longer.
Now moving on to our guidance for Q4 and the year. For the fourth quarter of 2024, we expect billings to be in the range of $3.43 billion to $3.48 billion, an increase of 9% to 10%. We expect revenue to be in the range of $2.15 billion to $2.17 billion, an increase of 10% to 11%. We expect non-GAAP EPS to be in the range of $1.40 to $1.42 a share, a decrease of 1% to 3%.
For the fiscal year '24, we expect billings to be in the range of $10.13 billion to $1.18 billion, an increase of 10% to 11%. We expect NGS ARR to be in the range of $4.05 billion to $4.10 billion, an increase of 37% to 39%. We expect revenue to be in the range of $7.99 billion to $8.01 billion, an increase of 16%. For fiscal '24, we expect operating margins to be in the range of 26.8% to 27.0%, an increase of 270 to 290 basis points year-over-year. We expect our non-GAAP EPS to be in the range of $5.56 to $5.58 per share, an increase of 25% to 26%. And we expect adjusted free cash flow margin to be 38.5% to 39%.
In the interest of time and to get as many of your questions as possible, we've included the modeling points in the appendix of our earnings presentation. With that, I will turn the call back over to Walter for the Q&A portion.

Question and Answer Session

Walter Pritchard

(Operator Instructions) The first question will be from Brian Essex at JPMorgan, followed by Brad Zelnick at Deutsche Bank. Go ahead, Brian. Brian, looks like you're on mute.

Brian Lee Essex

There we go. Yes, it wasn't letting me unmute myself. Yes, I guess for Dipak, as we look at your efforts of incentivizing platform consolidation or platformization, I mean, obviously, you've talked about the pressure on the last 2 quarters of this year, can you maybe help me understand the duration that you anticipate pursuing these efforts? Is this going to be a more temporary type of effort where it kind of just lasts through this fiscal year? Or do you expect it to stretch into next year?

Dipak Golechha

Yes. So thanks for the question, Brian. Look, I think we will -- I mean platformization is something that is now our strategy, so I think in that sense, it will continue for a while. But at some point, it just becomes a normal motion, and then we're lapping a period where we've been doing platformization already. So really, what you're seeing in the financial metrics is the difference when it wasn't the normal motion and then it becomes the motion, and then in the future, it will just become lapping what is a consistent motion.

Nikesh Arora

I think in that context, we said last quarter that this should persist still the end of Q2 next year. We kind of started Q2 this year.

Walter Pritchard

Next question is from Brad Zelnick, followed by Hamza Fodderwala from Morgan Stanley. Go ahead Brad.

Brad Alan Zelnick

Nikesh, I was hoping you can give us an update on the state of the channel. There's a lot of noise from the traditional VAR channel. Wanted to get your sense on how they're acclimating to platformization. But you're also doubling down with the GSIs. You announced this super special deal with IBM. You also signed a deal with Accenture, too. Would just love to hear your latest thinking, in particular, more on the GSI strategy. I mean how many more can you add that are up at that level of an Accenture and an IBM?

Nikesh Arora

Well, first of all, thanks for the question. Look, I don't think there is contention between the 2 channels. We still do IBM deals with a traditional VAR involved. Very often, the VAR has -- represents the customer, helps to clear the deals, helps them work through all the financing, et cetera. So there is a role for both. What we are discovering is, in platformization deals, customers require consulting effort to re-architect the entire security stack. And typically, they engage with the SI community or GSI community first to try and do that transformation. And partnering with them hand in glove allows us to be part of that story.
And I gave the example when we did the most recent, let's just say, re-architecture, which we had to do in a hurry in the case of the recent hack, we were working with SI partners as well as other incident response teams to make sure that we build an architecture that's consistent with what the end state needs to be. And that's where partnerships like Accenture and IBM become really worthy and important because the customer is relying on them to do the heavy lift in doing the onetime transformation.
So I think both these strategies will coexist. As you know, we still have a substantive hardware business, which we also work through the traditional channel. We also have -- actually, to be fair, many of the VARs have transferred or translated their businesses into a part consulting model, where they also work with customers on transformations. So I don't think they're intentional. I think it becomes harder for the analyst community to be able to track what the channel status of a company is because the SIs are not as sharing as the traditional VAR channel is.

Walter Pritchard

Next, we'll go to Hamza Fodderwala from Morgan Stanley, followed by Matt Hedberg from RBC.

Hamza Fodderwala

Nikesh, in the earnings presentation, you mentioned you see significant pipeline heading into your fiscal Q4. I was wondering if you could give us a little bit more color into that pipeline because the Q4 billings guide does suggest a big sequential uptick as is usual, but I think this year, a little bit higher than normal. But any color you can give would be helpful.

Nikesh Arora

Yes. Hamza, look, first, thanks for the question. As I mentioned in our prepared remarks, we have been reviewing all of our customers. We have been through 500 of them with the accountant teams. And every customer, there is an opportunity. There's an opportunity to deliver a platform. There's an opportunity to consolidate. And just that gives us hope and sort of some degree of conviction that there's a lot of business to be converted out there. It's really limited by the customer speed and desire to execute or their resources to execute. So we have a robust pipeline across most of our platforms to see questions, can we go out and convert as quickly as we need to, and that's what we're guiding to.

Walter Pritchard

Next question is from Matt Hedberg followed by Tal Liani from Bank of America.

Matthew George Hedberg

I wanted to ask about the federal side. Last quarter, you mentioned Thunderdome. Any update on that transaction and just kind of how we're thinking about federal into 3Q -- or excuse me, your 4Q?

Nikesh Arora

Yes, that's a good question. Look, the Thunderdome contract got activated last quarter because of the sort of the zero-day vulnerability we found in certain VPNs out in the market. So they wanted to quickly replace some of the VPNs because they're required to replace them in the classified agencies and nonclassified agencies. So we saw some activity around Thunderdome. That contract was activated where people use that contract that we have with DISA to be able to execute some transactions, but we still maintain these are going to get one at a time. Each of these missions are going to execute one at a time. So we haven't changed our expectations in terms of how Thunderdome will evolve vis-a-vis how we will see it in our financials.

Walter Pritchard

Next question from Tal Liani at Bank of America followed by Saket Kalia at Barclays.

Tal Liani

I know we don't focus on billings, but I have a question. Just first, to clarify -- just to clarify, you -- if you won -- you said in the prepared remarks, you won a $150 million deal. Does it include -- does it go through billing? And should we exclude it from billing on a normalized level, just to understand the impact on billings this quarter? And then billing is -- it's going to recover because I -- or I'm going to ask it, not say it. But how -- what's the path for recovery for billing? If investors are looking at it and you look out into the next year or 2 years, what's the path to recovery of billings growth?

Nikesh Arora

Tal, I think if you listen carefully to what I said, we actually built backlog this quarter, which means we booked a lot more business than we build, which is a difference between contracts where we chose not to take their payment terms and just do annual billing. So we're signing big deals. We have a lot of business that we're signing, and the way it gets reflected is in RPO.
It depends on what we choose to either take as annual billings or to take through PANFS, right, which shows up in billings. What we choose not to take ends up in future or deferred payment plans or deferred billing. So I think if you look at the implied bookings, you'll see there's a double-digit number in there in the quarter.
I just think billing is an artificial metric. I think -- I understand you guys like it because it's been around for a long time. I think the cost of money has changed the quality of that metric. To me, a quality metric is implied bookings or RPO. And in both those, as I mentioned, we saw an uptick this quarter. So we actually believe we saw a recovery faster than we expected this quarter. That's why we're surprised at the reaction of the market.

Walter Pritchard

Next up is Saket Kalia from Barclays followed by Gabriela Borges from Goldman Sachs.

Saket Kalia

Nikesh, maybe the follow-up is on that point. So just to that point, it was great to see RPO bookings, I think, actually accelerated year-over-year in this quarter, right? So last quarter, I think we talked about more flexibility for customers with platformization, right, just consolidating and creating some of those ramp contracts. How much of that -- how much did that sort of play into the difference between bookings and billings.

Nikesh Arora

Well, remember, the acceleration -- the ramp contracts really impact us in the way that we have higher exit ARRs in many of our newer contracts, right? So the year 1 ARR may be lower than the year 3 ARR for a contract. But that is not visible to you yet in the numbers because there's no way to represent that, right? The only way you'll see it, you'll see it in a consolidated TCV deal, which is going to show up in RPO. So the ramp contracts show was a total whole sum in the RPO number and you'll see an uptick in the ARPU number, which tells you that business is stronger this quarter than we expected it to be.
I think the only difference is we chose not to take -- remember, when a customer says I don't want to pay you up front, you have 2 choices. You can take annual billings or you can get them financing through PANFS, right, where it takes away from revenue and becomes interest income. And then we decided we didn't want to take so many of these deals, so our quantum of deferred billing went up compared to last quarter.

Walter Pritchard

Next question, Gabriela Borges from Goldman Sachs, followed by Gray Powell from BTIG. Go ahead, Gabriela.

Gabriela Borges

I want to ask on the $15 billion NGS target for fiscal year '30. Either for Nikesh and Dipak, a little bit of color on how you arrived at that number. There's an interesting footnote here on assuming 5% annual growth per customer. And then within that target, how do you think about cyclicality? Any comments on the cyclicality of firewall or the cyclicality of platformization impacting the linearity of getting to that target.

Nikesh Arora

Yes, 2 things. One, the firewall is not in there. That's hardware. That's not next-generation security. The services that work on top of firewalls are obviously in there because they're all now AI enabled and next generation. Cyclicality is consistent with our cyclicality of our quarters, right? We see more business in Q4. You should expect more platformization deals in Q4, hopefully, higher growth in NGS ARR, which you are used to. I think the cyclicality of that slide is no different than the cyclicality you've seen in the growth of NGS ARR over the last 3 years. We have been sharing that number with you.
Yes. Sorry, was there another part to that?

Gabriela Borges

Yes. Just on the footnote here on the 5% within -- yes, benchmark that for us.

Nikesh Arora

Well, what we discovered is as platformization grows for a customer, as renewals come up, we're able to upsell them more capability. For example, in SASE, now we can sell them ADEM and AIOps. For example, on our firewalls, we can send them 10 subscriptions. For example, in Cortex now with XDR, ITDR, we can sell them CDR. In access, we will be able to sell the AI Access. So every time these deals will come up for renewals, we will have the opportunity to present more services and capability onto the platform with a customer driving NRR for us, so we've made a simplistic assumption that the combined effect of NRR is approximately a 5% increase in ARR over the course of those years.

Walter Pritchard

Next question, Gray Powell from BTIG, followed by Gregg Moskowitz from Mizuho.

Gray Wilson Powell

It was good to hear the 50% growth on Prisma SASE this quarter. So a question on secure service edge. If I look at industry analysts' estimates there, I think secure service edge is probably about 25% of the network security market today give or take. That's rough. I'm just kind of curious like where do you think that penetration goes in maybe 3 or 4 years. Or maybe said differently, how should we think about the growth profile of that market going forward and your ability to grow at or above that?

Lee Klarich

Yes. Look, I think it's important to start with a view on this, that the market will be hybrid for a very long time, meaning customers will need a combination of hardware form factors, software form factors and SASE. And the reason for that is campuses still exist and hardware is still the fastest approach to this. And public and private cloud, software-based approaches are the best. SASE comes in with all of the remote users and branch offices. And so the -- that hybrid nature, from our perspective, means that the customers will increasingly choose to go with a platform-based approach where they can shift traffic across those different form factors as is optimized for that form factor.
And so some of the SASE growth that you've seen and you've seen it with us, we're 50% growth with SASE over the last several quarters, is showing that, that portion of the architecture is going to grow faster for some time and then ultimately, see this come into the total growth of the platform being what really matters. And then on top of that, we can deliver the security services, such as the newly announced AI Access Security across all of those form factors.

Walter Pritchard

Next up, Gregg Moskowitz from Mizuho, followed by Fatima Boolani from Citi.

Gregg Steven Moskowitz

Nikesh, in order to reach your fiscal '30 goals, it looks like you'll need to sign an average, give or take, of around 75 new platformization deals per quarter, a little higher than what you did -- just did in Q3. But if we're in the early days of this strategy and if you're just now building your go-to-market muscle around this, why shouldn't new platformization customers be a lot higher than that on a multiyear basis?

Nikesh Arora

Look, we told you last quarter we're going to do platformization. I have to say, I have to commend our team. We spent a lot of time over the last 90 days working hard on analyzing all this data to make sure we could give you a framework, so you can look at it and measure us over the next few quarters as we show you the benefits of platformization. So that's one part.
The other part is, look, it's positively surprise, a good thing that we've got 60-plus deals done in this quarter. We'll see what happens in Q4. We've just started going down this journey, and of course, if prospects get better, we will be happy to update our targets in the future. But for now, that seems like a robust goal that will still make us the first company in the history of cybersecurity to ever get ever close to that kind of aspirational number.

Walter Pritchard

Next up, Fatima Boolani from Citi, followed by Shaul Eyal from Cowen.

Fatima Aslam Boolani

Nikesh, you talked a lot about the multiplicative impact and the monetization acceleration you can get from platformization. I'm curious if we can put a profitability lens on this because you are driving between $2 million and $14 million of ARR, you mentioned, from a platformized customer. But from a contribution margin perspective, can you share with us what that incremental profitability impact would be like? And why should we sitting here not think that structurally your business, as it moves towards being increasingly consolidated, can see 30%, 35%, maybe even 40% operating margins?

Nikesh Arora

Yes. Look, Fatima, I -- in concept, principally, I have no argument against what you're saying because, remember, if you look at an average enterprise company's P&L, the largest cost is sales and marketing, right? Gross margins are, give or take, 75% to 80%. Take your favorite enterprise company. That leaves you most of your costs are -- majority of the costs are sales and marketing. If you can consolidate and concentrate your sales and marketing costs to very large deals and be able to generate large amounts of ARR or ACV/TCV from those customers, the cost of sales as a proportion of your revenue goes down. As you are constantly upselling it to the same customer base, it also makes it a little easier.
So I think we -- our opportunity is to, first, create enough breadth in our sort of coverage to make sure that we can actually go address all these landed customers. We've only done 900. We said we got to get north of 2,500, which means we have to go address a lot more customers on our existing landed base. We don't have to go make new friends. We just have to go work with our existing friends. But yes, in the long term, I have no argument against your thesis that this should allow us to continue to aspire to higher profitability, not counting the impact of AI, which should get us to be a much more productive organization over the medium term.

Walter Pritchard

Next question Shaul Eyal from Cowen, followed by Andy Nowinski from Wells Fargo.

Shaul Eyal

Question for Dipak or Nikesh on finance receivables. So finance receivables, up 34% sequentially. I know you don't guide, cannot guide this metric. If we look into next quarter and take into account your commentary about the strong pipeline, will we be seeing the finance receivables still expanding? Or maybe asked differently, will there be a point where would you like to see like this metric actually decelerating to a degree? What's the thinking along these lines?

Dipak Golechha

Yes. So I think -- thanks for the question, Shaul. I think as the business grows, like having tools like PANFS can only help you. And if that's what the customer is looking for in terms of deferred payment plans, I think I don't have a problem if it goes up because it just ends up giving you even more like knowledge of what your cash flow will be in the future, like -- so all of that receivable, we collect it eventually.
Honestly, I think more of it is related to the cost of money than anything else. So I think this becomes a larger issue in the current environment where interest rates are higher. I think if we're in an environment where the interest rates will go down, that's when I would expect this to potentially ratchet down.

Walter Pritchard

Next up is Andy Nowinski from Wells Fargo, followed by Joe Gallo from Jefferies.

Andrew James Nowinski

So I wanted to ask you about the IBM deal. What was the impetus for acquiring those assets? Because it looks like their SaaS revenue is pretty small at $100 million. And given how well XSIAM is doing, couldn't you just capture those on-prem customers for free over time?

Nikesh Arora

I think, Andrew, there's more than that. Remember, we explained to you that part of platformization is going to be able to transition customers off their existing contracts. Now the good news is we can transition these customers irrespective of term when they expire. That's great option value, right? I don't have to wait for 3 years to migrate them. I don't have to wait for an RFP. I can just walk up to them saying, "Listen, you're already my customer now because I've acquired the contract. Why don't you come? We work on transitioning you to XSIAM." Not only that, it also allows the opportunity not just to go after the SaaS customer base but also allows us to transition the on-prem customer base, which is a much larger prize, where IBM has economics from us where they're able to -- they will get earn-out based on how many of those customers transition to us.
So I mean, honestly, it's -- I think it's an amazing deal for us. I'm just delighted that IBM agreed to do this deal with us and partner with us and also gives me access to -- look, in the history of IBM, they have not sold anybody else's cybersecurity portfolio with the enthusiasm we hope we can generate together with 1,000 cybersecurity sellers. Until now, they would sell one portfolio that was IBM. And today, we -- this deal allows us to train all of them, all 1,000 of them, work with them on XSIAM and get it out to customers.
Just I think it's -- hopefully cements our place in the SIEM/SOC category at a pace that nobody would have anticipated, right? Until yesterday, there were 3 players in the Magic Quadrant, which was not us. This allows us to participate with one of the biggest players in the space and migrate as many of these customers based on merit and based on great proposition as quickly as we can. That [$5] million, I didn't have to spend -- what's the number? Never mind, I won't quote a large number. I didn't have to sell many, many, many billions of dollars and transition the customers then.

Walter Pritchard

Next up, Joe Gallo from Jefferies, followed by Ben Bollin from Cleveland Research.

Joseph Anthony Gallo

I want to follow up on Fatima's question. I don't think many disagree with the strategic long-term potential of the platform or the ensuing financial strength. But when you look at fiscal '25 specifically and free cash flow being 37% plus margin there, how should we think about the visibility or durability of that free cash flow margin given what's impacting you now with deferred payment terms, discounting, fatigue, hardware digestion should in theory impact you for a couple of quarters next year?

Nikesh Arora

First of all, do not introduce the word fatigue in our conference call. Secondly, yes, as it relates to the free cash flow margins, I'll let Dipak jump in, in a minute. But look, it's the fine balance of making sure that we can let our annual billings continue to grow as a proportion because we think this interest rate environment is here to stay, and we can manage our free cash flow margins in the same time frame.
But the good news is because of a nicely increasing profitability, that allows us to have the capability to let our annual billings continue to get bigger and bigger because, eventually, that's what gets you. Take the extreme example on the other side. The other side extreme example is a SaaS company with annual billings, which can go back to the same degree of free cash flow margins that they have. So our opportunity is to see if we can migrate our customers to more to more, more annualized billings and continue to maintain the margins without creating a kink in there. That's what Dipak is very focused on. I don't know if you have something you want to add to that, Dipak.

Dipak Golechha

No, the only thing that I would add is like, look, the more that you do deferred payments now, the more you actually understand your waterfall of what will come afterwards. So as long as the shift doesn't happen all at once and it's a gradual shift that you're managing, it actually gives you even more certainty than less certainty in your ability to deliver. So happy to talk offline about how we see that and why we believe that, but I think the data doesn't lie there.

Walter Pritchard

Next, Ben Bollin from Cleveland Research, followed by Jonathan Ho from William Blair.

Benjamin James Bollin

Nikesh, one of the initial attributes around platform seems to be the potential for use periods and as companies displace other vendors. Could you talk about what you've seen from the use -- [potential] for use periods in those first 60-plus deals? And then maybe, Dipak, could you talk through a little bit about what it means for revenue, RPO, ARR billings and like how that waterfalls over time?

Nikesh Arora

Yes. So in the first 50 or 60 deals, I think we've got a little sort of portfolio, all kinds of stuff that's happened. There are some customers we've had to basically wait for 6 months to be able to charge for our services because they have an existing contract, and we start implementation. So we wait that period out. Typically, those deals where we end up waiting out end up with longer duration because we don't want to give away that period over a shorter period of time, so you'll see that those deals are north of 3 years. In the case, we end up giving some sort of free use period. In smaller situations, sometimes we'll provide migration services, which allows them to get off an existing solution and move to Palo Alto as quickly as possible.
And remember, because most of these implementations have some sort of ramp element, nobody goes and deploys 65,000 end points and turns them on in 1 day. Typically, it takes them 3 to 4 months internally to deploy those. So that actually doesn't impact us from a COGS perspective as much and allows them to have that execution flexibility, which we've always talked about as part of platformization.
So I think we've seen all variants, and I'll say, right now, the -- we're seeing more of an impact on our business from deferred payment than we are from the free periods, to be honest, right? In every case, we want to make sure the exit ARR is what we want from that customer. So our ARR, we expect it to ramp in some of these deals, which are 3- to 5-year duration where we provided free periods. But we're still -- as I said, more impact is from the billings, deferral in annual billings than it is from free periods right now. And we'll know better after Q4 because you'd expect the volume of Q4 business given the expectations and numbers should be substantially more than Q3.

Walter Pritchard

Next question, Jonathan Ho from William Blair followed by Joel Fishbein from Truist.

Jonathan Frank Ho

As you add more AI capabilities to your platforms, what are customers looking to benefit from? And how do we think about the monetization opportunity here?

Nikesh Arora

So I think if you look at some of our products, as we articulated, there are 3 specific products we announced at RSA and then we said all of our co-pilots will be available and already are available to customers for beta reasons. And then we have underlying capabilities in our products, which are AI-enabled.
Now in most of our advanced services and firewalls, and I'm making a broad statement here, so -- we've increased prices from 20% of the cost of firewalls as a sub to 30%. So we have had an uptick in AI delivered services on the firewall. The customers see the value, and majority of customers have opted into that capability, which we've had for the last 2 or 3 years. And today, we've just launched the most recent one, which is Advanced DNS, which will also be uptick to a 30% instead of 20% subscription.
AI Access will be sold as an incremental capability and incremental subscription for all of our VPN and for our SASE customers. So you will have monetization capability there. AI firewall would be, again, an uptick on our virtual firewalls where you have AI capability, so you'll pay a premium to protect AI installations over a traditional VM.
We're still debating whether we provide AI SPM to the market, which is effective security posture management capability as part of our firewall optionality or we charge for it separately. We will do that closer to when we launch the actual product towards July.
Our co-pilots are, for the most part, available to our customers as a productivity tool, as an enhancement tool. In certain cases where we require them to ingest data to get advanced telemetry, they would have to buy the advanced telemetry modules to make the copilot even more useful for them. So that's roughly the lay of the land.
But one should expect that there should be 3 capabilities: one, better productivity for our customers, so they don't have to understand more complex UI; two, they will have to pay certain more -- somewhat more in certain use cases where they are getting incremental value and we're making incremental effort from them; then three, they might require to upgrade their underlying capabilities from base to advanced because we need the telemetry to make AI useful.

Walter Pritchard

We'll take our last question from Joel Fishbein from Truist.

Joel P. Fishbein

I have an AI question, too, Nikesh, just to follow up on that. In terms of -- can you talk about the customer appetite for AI security and maybe a couple of comments about the competitive landscape around companies that are delivering products around AI security as well?

Nikesh Arora

Yes. Look, so we had an amazing reception to our AI -- Precision AI sort of preview at RSA. We have north of a few hundred customers who signed up to have discussions with us and engage in the beta of these products. That's very good, a. B, as you'll appreciate, AI Access is an overlay product on all of our access customers. So it's a good thing because our customers say, "I don't have to go somewhere else and get something add on and go make that happen because I expect Palo Alto will have it in 6 weeks' time. So I'm just going to wait for Palo Alto." And those who are keen to deploy sooner, we are able to discuss with them, show them the beta and continue to have design discussions with them.
So it sort of reduces any risk of competitive activity into our customer base where somebody else is providing AI Access Security in our own cases, one. Two, in the case of AI firewalls, I think what is unique is we are possibly the only security vendor, which has a native integration. I say native, not on top but native integration with AWS, Azure, GCP and Oracle in their public clouds, which means our firewall sits in their cloud. You can activate it from their UI, not just from our UI, and you can launch it natively in all those cloud providers. AI firewalls will be built into that capability so that you get a native capability in most large cloud service providers or a VM that you can deploy in your data center.
So again, for somebody to compete with us, they would have to have that native capability first than build it. So do we expect that Google will have it? Possibly. Microsoft? Possibly. AWS? Possibly. So the cloud providers might have that capability because they had native firewalls, but again, if you had a multi-cloud infrastructure with an LLM running in one cloud, another one running in the other cloud and some running in data center, we hopefully are the only option that allows that capability to happen. So we're trying to make sure that we do the early innovation in this space, so our customers don't have to or we don't create more fragmentation with other people having to deploy point products in that [outcome].

Walter Pritchard

With that, we'll conclude the Q&A portion of the call. I'd like to turn it back over to Nikesh for his closing remarks.

Nikesh Arora

Well, I just want to thank all of you for joining our earnings call. I appreciate your attention. I also want to thank all of our employees for all the hard work that goes into delivering great quarters and all the innovation that they've delivered. And last but not the least, thank you for all of our customers for their trust in us. See you guys next quarter.