285039c6-615b-4a1f-a707-e3c6c73ea424_F5-Networks-Premium-Analysis.pdf

F5 Networks: Premium Analysis

F5 Networks

Overview:

Like many traditional hardware companies, F5 Networks is shifting from a hardware model to a software-driven business to accommodate an increasingly cloud-driven world. The effects of the shift to cloud services are not fully reflected yet in the company’s revenue growth, which was at 7% YoY in the most recent quarter. The company has been basically range bound with revenue growth around 5% since 2016.

F5’s cloud services are distinguished from running apps on virtual machines in a single cloud from being able to run distributed, container-based microservices across multiple clouds. The services have the added benefit of security, such as advanced web application firewalls. This is important because up to 40% of internet traffic comes from botnets with 20% being bad bots. 

The three main products which work to consolidate networking tasks and deploy apps faster., are BIG-IP, the NGINX Controller and a new SaaS offering called Beacon. These three products tie together traffic management, API management, app security and end-to-end app visibility and analytics.

There are a few trends that help to support F5’s future revenue growth. Primarily, the shift away from monolithic architectures and towards microservices architectures (and the popularity of containers orchestrated by Kubernetes). Also, the complexity of multi-cloud and hybrid cloud environments. 

However, it is the 5G catalyst that I am most interested in and the reason I am covering the company. 

F5 Product Summary:

F5 Networks is well known for its hardware-based Application Delivery Controller (ADC) product offerings. The company recognized a need to move to cloud based workloads due to the decline in ADC hardware and the shift to software-based solutions.

As the number of applications grow, the complexity increases. Companies must deploy, manage and secure applications across private data centers, private clouds, public cloud, microservices environments and multi-cloud environments. This complexity is how F5 hopes to gain and defend its market share. 

The customer base for F5 are companies that need to scale and deploy applications very quickly. Essentially, developers write the code for the applications (i.e. the business logic, backend components, and user interfaces). F5 helps to deliver the application to the device, machine and browser. 

The company acquired NGINX for $670 million in May 2019. This helped the company to expand to new addressable market opportunities including web servers, application servers, and API gateways. The company is seeing promising early wins for NGINX Controller 3.0. It is also seeing real traction with the F5 and NGINX combination. 

Another major recent acquisition was Shape security for $1 billion which helped the company to target the application security market. Shape is a leader in anti-fraud and abuse protection. The company’s existing Canadian banking customer is a BIG-IP customer and experienced an account takeover attack on their web application. With Shape in full mitigation mode, it was able to block a major attack.

Load Balancing

F5’s two products are the F5 BIG-IP Local Traffic Manager and the F5 BIG-IP DNS. The local traffic manager balances loads across servers in a single data center. The DNS uses topology-based load balancing to determine the closest data center. 

Load balancing refers to distributing requests across web servers to avoid overloading any one server. Load balancing distributes the requests based on the actual load at each server to ensure availability and helps with denial of service attacks.

Microservices

Microservices is a newer architectural framework designed so that changes won’t break the entire app. The core functions of a microservices framework can be deployed independently, meaning individual services can function without affecting the others. This is opposed to a monolithic approach where the source code is built into a single deployment. With a monolithic/single deployment, there is a lot of downtime as any update requires the entire app to be taken offline. 

Microservices closely resembles service-oriented architecture (SOA). In this architecture, individual services communicate through the enterprise service bus (ESB). This allows for iteration and deployment without monolithic development cycles but it also creates a single point of failure (the ESB).

Containerized microservices allow applications to be run independently on the same hardware with much greater control. This is the foundation for cloud-native applications. 

NGINX:

The main benefits to NGINX is the software approach to application delivery and API management, as well as the brand name in open source and DevOps. The acquisition creates end-to-end application infrastructure and allows F5 to transform into a more software and multi-cloud approach. The acquisition also helps to combine security technologies with web servers and load balancers. 

The goal of F5 and NGINX is to combine the application teams, developer teams and operations under one umbrella to include AppDev, DevOps, NetOps and SecOps. 

NGINX’s main competitor is Apache. F5 Networks is popular with the Fortune 500 and NGINX is popular with developers/open source community. More than 400 million sites use NGINX and NGINX Plus, including Netflix, Dropbox and Zynga. In 2019, it was reported that NGINX was closing the gap with Apache and Microsoft in webfacing computer market share to about 30% of the market.

This also provides F5 with inroads into servicing Kubernetes nodes. Kubernetes is a leading container platform that was designed by Google and is now used everywhere. Kubernetes has exploded in popularity with 78% of developers using it for cloud native projects. This is a tailwind for F5 (although not a major catalyst as NGINX is free, open source software).

The most recent product announced from the acquisition is the NGINX Controller 3.0 which helps development teams deploy applications in multi-cloud and hybrid cloud environments. In the recent quarter, F5 secured a leading oil and gas company in the Middle East from the new acquisition. The oil and gas company had both security and API management challenges, it opted to deploy NGINX for API management and F5’s advanced web application firewall for API security. 

Shape Security:

Shape Security protects against automated attacks, botnets and targeted fraud. The company mitigates more than 1 billion attacks daily and is deployed on more than 200 million mobile devices worldwide. The company is used by eight of the top twelve U.S. banks. The company separates good traffic from bad traffic. Shape Security will augment F5’s application infrastructures.  

According to F5, the acquisition will boost its software revenue growth from 35-to-40 percent to 60-to-70 percent next year. It expects to achieve breakeven non-GAAP EPS within 24 months of closing the acquisition.

5G: Network Slicing, Gi-LAN Consolidation and Edge Computing:

F5 Networks is positioned to help 5G infrastructure scale. The new 5G architecture will have the ability to “slice” the network into different segments from the radio network (RAN) to the core in order to help allocate resources according to various use cases and traffic spikes. The existing 4G core networks do not have networking slicing built into the system. F5 Networks can provide the existing 4G systems with GTP session directors and DNS session directors. 

In addition to network slicing on existing 4G systems, F5 Networks can also improve the monolithic architecture of the Gi-LAN Networks, which are independent network functions on dedicated devices from a wide range of vendors. Latency increases with each hop in the chain the data packet has to traverse. The monolithic architectures — with individual service functions on different hardware — can have a major impact on latency. The monitoring of the system is challenging and security is also an issue. 

The solution is to consolidate Gi-LAN into one instance/appliance to reduce the latency and simplify the network design. F5 Networks offers a Gi-LAN consolidation solution that includes TCP/IP optimization, firewalls, traffic steering, deep packet inspection, URL filtering and DNS security. Most importantly, F5’s solutions are available in both physical and network function virtualization (NFV) environments. The company’s in-house load balancing is also important to scale and eliminate redundancy. 

F5 also facilitates edge computing with virtual edition software for load balancing, web application firewalls, service discovery and monitoring. The company is also well positioned for providing application delivery control and security services for microservices architectures within containerized infrastructures (i.e. Kubernetes). 

5G Case Study: Rakuten Mobile

The case study with Rakuten Mobile is especially interesting as a model for how important F5 Networks could become in the near future as telcos can reduce capex and physical infrastructure needs with cloud networks and network functions virtualization capabilities (NFV). 

Rakuten is Japan’s biggest mobile virtual network operator (MVNO). In early 2019, the company announced plans to build a network in 12 months without significant capex. The reduced capex is made possible through a cloudnative network. The goal is to shift towards Network Functions Virtualization (NFV) technology, which uses the principles of cloud computing to create service delivery platforms “with greater agility and customization.”

The end result is a Radio Access that is virtualized and running as a virtual network function on a private cloud. You can read more here and the press release regarding Rakuten’s partnership with F5 here.   

Financials

F5 Networks reported fiscal Q2 2020 earnings at the end of April. Revenue increased 7% year-over-year to $583 million with EPS of $2.23. This beat analyst estimates by $20 million on revenue and $0.24 on EPS. 

In the previous quarter, revenue increased 5% to $543 million.

On a non-GAAP basis, product revenue comprised approximately 45% of total revenue and it grew 10% year-overyear to $262 million. Of this, software represented 35% of product revenue and it grew 96% year-over-year. Excluding the partial contribution from Shape, software grew 65% year-over-year. Services revenue grew 5% to $324 million.

Full year revenue grew 4% to $2.2 billion with non-GAAP income of $626 million, or $10.36 per share, up from $612 million in fiscal year 2018.

The company has cash and cash equivalents and short-term investments of $820 million and $182 million in cash flow from operations. Long-term debt at the end of March 31, 2020 was at $380 million. The company repurchased $50 million worth of shares in the most recent quarter.  

For the fiscal Q3, the company expects both GAAP and non-GAAP revenue in the range of $555 million to $585 million and non-GAAP diluted earnings per share in the range of $1.91 to $2.13. 

The company withdrew the FY 2020 outlook provided in December 2019 when they announced the Shape acquisition. F5’s gross margins are forecast to be around 85% and operating margins to be 30-32% for full year 2020.

Following the Q2 report, F5 attracted some bullish analysts from Piper Sandler and Nomura who believe there is upside due to strong forward guidance and the current results coming from an acceleration of existing trends rather than a pull forward.

Despite these newly bullish analysts, the overall rating is neutral on F5. Notably, Goldman Sachs has a neutral rating due to the earnings stability being offset by the “less certain spending environment.”

F5 is holding up well with the current shift towards work from home. In the most recent earnings report, the company saw an acceleration in purchases of F5 solutions while some purchases were pushed out to future quarters. 

Here are some examples from the earnings call on how F5 Networks has been used during the coronavirus:

•       F5 enabled one of the largest banking and investment institutions in the United States to scale its VPN access from 400,000 to 500,000 remote users.

•       The company helped a multinational mass media conglomerate to increase network capacity within one day, so that 100,000 additional employees could work from home in the U.S. and London.

•       A fortune 10 Retail Healthcare Corporation added 160,000 remote workers to its network in under 24 hours. 

Addressable Market & Valuation

F5’s biggest risk is the number of competitors relative to addressable market. Often this level of competition leads to pricing wars. 

The total addressable market in the application security market has doubled to $8 billion from $4 billion with the Shape Security acquisition, according to F5’s Investor Presentation. Competitors include A10, Akamai, Cisco, Citrix, Imperva, Juniper, Radware, and Symantec.

The ADC market was valued at $2.9 billion in 2016 and will reach $4.2 billion by 2023, which is modest growth of 5%. According to MarketsandMarkets, the Application Security market size is expected to grow from $2.8 billion in 2017 to $9.0 billion by 2022. Competitors here include Citrix Systems, Radware, A10 Networks, AWS, Array Networks, Barracuda, HAPRoxy, Kemp, VMWare and Microsoft Azure. 

Application delivery controller revenue declined 4% to 7% in 2018 with F5 owning 47 percent of ADC market share at that time. This prompted the shift towards software. 

According to IDC, there were more than 700 million application instances in 2018 and this will grow to 3.7 billion by 2023 for growth of 500%. There were 314 million enterprise applications in 2018 and this is forecast to reach

1.8 billion by 2023. 

The company trades at a forward PE ratio of 15 and forward PS ratio of 3.5. This is at the low range for comparable companies. 

Conclusion:

There are reasons that F5 has a low valuation comparatively speaking. The company has been hit hard by the transition away from hardware and on-premise. The NGINX acquisition does little for F5’s top line, which has struggled to break out from 5% year-over-year growth. F5 Networks is also a company that has many competitors with a smaller addressable market than what I typically cover. 

However, as companies seek to scale application deployment, there are infrastructure-level issues that cloud software companies will struggle to solve. F5’s experience with hardware and a pivot towards software could be a winning combination. This goes beyond end-to-end application infrastructure, where the company already has a solid reputation (i.e. Datadog and IBM’s RedHat both favor F5 as a partner here). F5 is also doing a good job of staying in front of the trends of microservices and the Kubernetes platform. 

The more interesting catalyst for is whether F5 can solve major infrastructure and capex issues for telcos. F5’s network functions virtualization (NFV) capabilities can enable a higher throughput, low-latency network and ensure application availability for wireless networks. I believe F5 could be uniquely positioned to solve these issues which should be in high demand as global competition increases for scalable 5G deployment.

0722c012-6ea6-4805-ba0e-87e05efb29a2_Okta-Premium-Research.pdf

Okta Premium Research

IAM Overview

Identity and access management (IAM) helps to make sure the appropriate people access the appropriate networks and applications. Features include authentication, authorization, trust and security auditing for both onpremise and cloud-based systems. 

Defining and managing roles is needed for both customers and employees. The goal is to have one digital identity per user, and to maintain, modify and monitor this digital identity to allow access to the appropriate assets and in the right context. This may include onboarding or offboarding the user. IAM systems allow for the administration of user access across an enterprise and ensures compliance.

IAM became more complicated once employee’s began to use their own devices and as companies transitioned to the cloud. This is because there was no longer a perimeter. Today there are on-site employees, off-site contractors, hybrid cloud environments, software-as-a-service applications, bring-your-own-device users, UNIX, Windows, Mac, iOS, Android – and soon there will be billions of machine to machine connections (internet of things) communicating through APIs. 

IAM is important because these devices, user credentials and access points are where the majority of security breaches occur. According to IBM, 60% of data breaches are caused by an organization’s own employees.  

According to Forrester, IAM is broken down into six technologies that have high business value. 

•       API Security: Allows for easy, single sign-on (SSO) access for B2B ecommerce and API integrations. This is especially useful for IoT, or the internet of things, device authorization as many devices must communicate seamlessly. This is important for machine-to-machine communication.  

•       Customer identity and access management (CIAM) enables organizations to capture and manage customer identity and profile data. Features include customer registration, self-service account management, access management, and directory services. Customer retention is much higher when there is less sign-on friction and fewer required steps. This is also important for omnichannel sign-in, such as switching from mobile to laptop.  

•       Identity Analytics (IA): Identity analytics evolved from the use of cloud and allows behavior analytics to identify usage and access patterns in data collected from the IAM. This creates risk profiles for the user behaviors and helps manage risk profiles based on application usage.

•       Identity-as-a-Service (IDaaS): This provides single-sign on and identity management as a software service. The benefit is to remove servers, purchase/upgrade/install software, data backups and hosting fees from the provisioning process.  

•       Identity Management and Governance (IMG): IMG helps to minimize the risk of data breaches and improve end user productivity. Offers control and visibility into inappropriate access or policy violations. Helps to achieve compliance.

•       Risk-based authentication (RBA): Allows for a variation of single-sign on and two-factor authentication.  

Overview of Okta:

Okta is the preferred name brand in identity access management (IAM). When speaking to security professionals, the company is highly regarded. Okta’s Identity Cloud is an independent and neutral cloud-based identity platform that allows its customers to integrate with any application or scalable platform. One obvious benefit is that Okta does not lock customers into an ecosystem, like Microsoft or Salesforce, hence the word “independent” is frequently used in their marketing materials. 

Workforce Identity simplifies the way an organization’s employees, contractors and partners connect to its applications and data from any device. This is the majority of the business. 

Customer Identity Cloud enables organizations to transform their own customer’s experience making use of API- level access and seamless customer experiences. There is a large product range including Universal Directory, Single Sign-On, Adaptive Multi-Factor Authentication, Lifecycle Management and API Access Management.

The company recently launched new products, such as Access Gateway or advanced server access Dynamic Scale. This helps enterprises handle traffic bursts with up to 500,000 authentications per minute. 

This month, the company announced end-to-end passwordless access with Okta FastPass. This will allow for a passwordless login experience across iOS, iPadOS, macOS, Android and Windows. The goal is to reduce friction while increasing security. The company believes that early access to FastPass will be available in Q4 2020.

There are a few reasons companies are more likely to go with a proven brand like Okta for identity access management. For one, IAM allows access to the company’s most critical systems and assets. Also, in order for IAM to work effectively, Chief Information Security Officers (CISOs) must put all of their eggs into one basket, as One Identity points out. Therefore, they will lean towards the independent solution that is also best in breed. 

There are additional concerns and costs to integrating IAM with both on-premise and the cloud, and whether internal admins can properly work with IAM. Once IAM is implemented, CISOs and security teams want a solution that works effectively and does not duplicate workloads. In other words, this isn’t the place where a company cuts corners or goes with discounted solutions. 

On the larger corporate-level, Microsoft is one of Okta’s main competitors. However, Microsoft’s goal of locking businesses into Azure, Skype and Office 365 is not ideal for all companies. Many prefer the freedom of multi-cloud and multiple vendors/cloud software solutions. Ping Identity is a competitor on the SMB level, yet does not have near the revenue growth or suite of products/solutions. Salesforce also has their hat in the ring but similar to Microsoft requires vendor lock-in with their software suite.

Addressable Market & Customer Use Cases

When Okta went public in 2017, the Workforce Identity addressable market was at $18 billion. According to Okta’s

Investor Day Presentation, Workforce Identity has now grown to $30 billion and Customer Identity has grown to $25 billion. Over the past three years, Okta’s revenue has grown at a CAGR of 54% from FY 2017 to FY 2020.  

Okta derived 84% of its total annual revenue from the United States. The company believes that global demand will be a long-term opportunity.

Use cases for Okta:

•       New Corp put 75% of its computer power into the public cloud and extended their workforce operations with applications like Google Apps and Dropbox. There are a total of 150 apps across all of News Corp’s digital sites and work flows. News Corp uses Okta’s single-sign on (SSO) access for easy access to applications, secure access with multi-factor authentication, and automates provisioning for new employees to onboard quickly.

•       In the third quarter, the company won a workforce identity contract for Berry global, a Fortune 500 manufacturing and packaging company with tens of thousands of employees. The company wanted to protect itself from modern security threats. The company will improve the sign on experience for employees, reduce helpdesk request by enabling self-service password requests and enhanced security with multi-factor authentication.

•       A Fortune 50 telecommunications company for its business customers to securely access key business services. Okta was selected over Microsoft to lower maintenance and infrastructure costs and provide faster time to value.

•       Recently, Autodesk selected Okta Identity Cloud to centralize identity and access management for its customers. AutoDesk is the global leader in design and engineering software (Source: 4Q FY 2020 Earnings call transcript).

•       Fortune 500 financial services company upgraded to Okta’s Access Gateway to UniFi access to both cloud and on-premise applications and enhanced security for its over 10,000 employees.

•       For customer identity, a European film and television studio and distributor with over 8 million subscribers was recently onboarded. 

•       NTT data, a global top 10 global business and IT services provider, was a notable upsell in the quarter. 

Coronavirus Effects

Although Okta has stated that billings will face headwinds this year, the company is not revising Q1 revenue guidance of $171 to $173 million. As of now, revenue guidance for fiscal 2021 ending  January remains at $770 million to $780 million. The FY 2021 loss per share is slightly improved from $0.37-$0.42 to $0.31-$0.36.

The company expects slightly improved earnings per share of negative $0.16 to $0.17 compared to $0.23-$0.24 due to the reduced costs in Sales and Marketing from Okta’s employees working from home.  

Despite the strength in Okta’s product during the work from home trend, a few analysts have placed a hold on the stock due to valuation concerns. Canaccord Genuity states they are on the sidelines due to valuation and Needham analyst Alex Henderson recently downgraded Okta due to little room for improvement in valuation. 

Financials:

On March 5th, Okta reported Q4 and fiscal year 2020 results. Total revenue in the recent quarter grew 45% yearover-year to $167.3 million. In the previous quarter, revenue grew 45% YoY to $153 million. 

Subscription revenue grew 46% to $158.5 million. Remaining Performance Obligations (or subscription revenue backlog) grew 66% YoY to $1.21 billion and calculated billings grew 42% YoY to $225 million.

Subscription revenue makes 94% of FY 2020 revenue while professional services and others make up 6%.

Okta is not profitable yet with non-GAAP loss per share of negative $0.01 EPS in the recent quarter compared to negative $0.04 EPS in the year-ago quarter.  

Full year revenue grew 47% YoY to $586.1 million. Subscription revenue grew 49% YoY to $552 million and calculated billings grew 44% YoY to $703 million. Non-GAAP EPS was negative $0.31 EPS compared to negative $0.32 EPS in the previous year. 

Revenue guidance for fiscal 2021 ending January remains at $770 million to $780 million. The FY 2021 loss per share is slightly improved from $0.37-$0.42 to $0.31-$0.36. This will represent a growth rate of 31% to 33%.

Consensus estimates for Okta is $771.65 million in FY 2021 and $1.0 billion in FY 2022.  

In the earnings call, CEO and Co-Founder Todd McKinnon stated the company is investing in growing its base of large enterprise customers. The company added 142 customers with annual contract value greater than $100,000 bringing the total number figure to 1,467 – or an increase of 41% y-o-y. Total customer base is 7,950. 

Operating cash improved 266% from $15.2 million to $55.6 million. Free cash flow also saw a big improvement from negative -$6.8 million to $36.3 million for fiscal year 2020. The company ended the year with $1.4 billion in cash, cash equivalents and short-term investments. Okta carries current liabilities of $546 million and long term debt of $837 million.

The company has been expanding internationally over the past two years, namely, Stockholm, Munich, Amsterdam, Paris, and Toronto. 

Prior to the Coronavirus, the company’s operating expenses were expected to rise due to an increase in headcount. The company’s headcount rose 40% in the first half of FY 2020 and 44% in the second half of the year.  

Valuation:

As stated, a few analysts pointed out that Okta is reaching maximum valuation. I believe most tech growth stocks will go through a valuation adjustment this year. Okta will not be an exception, although the company should fare better than most. 

By my estimation, Okta will fare better than most because its core business of IAM for the cloud is a stable market (comparatively to others right now). We know Okta is not reducing guidance as of yet and I imagine this will be an anomaly come May/June when the majority of companies will have revised guidance or will decline to offer guidance. 

When considering Okta’s valuation, it’s important to note that Okta spends more than 50% of its revenue on sales and marketing. I’ve been critical of this in the past and continue to question the runway of a few cybersecurity companies. Some companies spend heavily to stave off competition (this is my thesis for cybersecurity). Others move very quickly and spend heavily to gain market share while the opportunity is nascent. This is essentially what Amazon did and Netflix has been doing. I am initiating coverage on Okta because of the company’s name brand status in the B2B/enterprise world and because I believe it will be the de facto IAM company. 

Okta has a current price to sales of 26 and a forward price to sales of 20.7. During the Q4 2018 selloff, Okta was at a current price to sales of 14-15 and its lowest forward price to sales has been 17. This would place Okta at a market cap of $12 to $13 billion with an addressable market around $50 billion (combining both workplace and customer identity markets).

Keep in mind, a $12-$13 billion market cap places Okta where the stock traded during the momentum rotation in Sep/Oct 2019; which was a 1-year low for many cloud stocks. Therefore, this is not a drastic discount given the current economic uncertainty. 

However, you have to balance the fact that Okta’s customer base and market is more likely to stay intact this year compared to other tech companies. Assuming forward revenue will remain in the $770M range in the current fiscal year (as the company has stated it will) and $1 billion in the next fiscal year, then Okta will stand apart from companies that are lowering guidance.

Catalysts and Competitors:

Ping Identity carries a much cheaper valuation yet the low growth reveals a company that struggles to compete. Ping is forecasting full year revenue growth of 9%-11% from $242 million to $263 million. This growth is too low for me to personally consider, especially considering total addressable market in IAM has been growing rapidly.

It’s important to note that Gartner and Forrester place Okta above the competition. This matches the overall reputation of Okta in the tech industry. When I speak to companies about products, Okta is well received and spoken of very highly.  

Regarding Salesforce, Microsoft, IBM and Oracle, many of these companies require vendor lock-in and are not able to innovate as quickly. Okta’s FastPass is a good example of how Okta is innovating.  

On the topic of catalysts, Okta is a Coronavirus shopping list stock. Millions of employees will work from home this year and this will present operational challenges. Products like Okta will ensure only authorized users access their cloud applications. The CEO, Todd McKinnon, stated in a recent interview that the company is seeing an 80% increase in the amount of strong authentications. 

We are covering Okta as a buy-and-hold due to hybrid cloud migrations, the popularity of multi-cloud (which prevents vendor lock-in) and the company’s future potential in blockchain. These are the more important catalysts, in my opinion, as valuing companies based on the Coronavirus is beyond my scope. 

I feel fairly confident that blockchain will take off in the financial markets within a reasonable time span of 1-3 years and that Okta will be very well positioned when this occurs. Gartner and a few others place 2023 as the year when blockchain will be mainstream. The market will reach $3 trillion by 2030 (not all of this will be IAM, of course). Basically, I like Okta now for hybrid and multi-cloud and the $50 billion TAM …. but I really like Okta for the much bigger TAM that includes blockchain down the line.

Technical Analysis by Knox Ridley to follow this week.

c95f5842-95ad-4186-ba97-be2e10dcc7ab_Elastic-Premium-Analysis.pdf

Elastic Premium Analysis

SECTION 1: Product Overview    

The Elastic stack includes Elasticsearch, Logstash, Beats and Kibana.

Elastic has partnered with cloud infrastructure companies, such as Microsoft Azure, Amazon AWS, Google Cloud and Alibaba Cloud. The Elastic Stack works well with Kubernetes, which is the machine learning powerhouse for containerized applications. 

Elasticsearch:        

Elasticsearch is the core product and search engine that allows for storing, searching and analyzing data. 

Google search is built for users to query hundreds of thousands of terabytes of HTML data (or about 20 petabytes per day). In contrast, Elasticsearch is built for developers who need to design more complex application searches. For instance, Elasticsearch can forecast data center storage capacity with queries or can search customer sentiment that is determined by natural language processing.

To further illustrate, here are some examples of how Elasticsearch is used today:

Business-to-consumer:

•       Pairing a passenger with an Uber driver with search

•       Recommending grocery items on Instacart

•       Matching online dating profiles for Tinder dates

•       Processing billions of log events for Sprint to monitor outages

•       Processing billions of log events for Fitbit, which has a rate of 250,000 logs per second, to enhance data discovery and validate failures

Business-to-business:

•       E-trade uses Elasticsearch to identify trading anomalies across 115 terabytes of data

•       Adobe uses Elasticsearch to search across both textual and non-textual formats, such as images, videos, 3D templates. This helps assist computer vision, which trains computers with ML to have a high-level understanding of non-textual items. This is done at a rate of 600 queries per second and an ingestion rate of 25,000 per second. 

•       Blizzard uses Elasticsearch to make sure their games are running at peak performance

•       Cox Communications and TV2 use Elasticsearch to analyze billions of content delivery logs

•       John Deere uses Elasticsearch to handle 18 billion documents and 11 terabytes of data storage, running 20,000 events every second. This helps to support remote management, variable rate application and field and water management.

Products such as Elastic Cloud Enterprise allows companies to run the entire stack in the cloud with a SaaS offering. The Elastic Stack is also available on-premise, or a hybrid of both. Elastic Cloud Kubernetes extends the Elastic Stack for use on cloud native technologies and containerized architectures. 

Logstash and Beats:           

Logstash and Beats are ingestion tools that can be put on thousands of applications to query external systems. From the examples above, John Deere is ingesting data from thousands of external sensors in the field, for instance. This helps complete the stack for the optimal use of Elasticsearch. 

Ingestion can become quite technical. For instance, eBay uses Beats to break down the silos from containerized machine learning platforms, such as Docker and Kubernetes. This helps to automate application deployment and keep up with fast-evolving application lifecycles. The Beat product also has an auto-discovery feature to ingest newly discovered workloads, to collect and enrich data, and to send to the internal monitoring system. 

In eBay’s case, the company built a way to tag the metadata from Beats auto-discovery so that users could access the information with familiar labels. A real-life example of this might be analyzing data from website logs, call centers and competitor website scans with the end result being a system that can the difference between skis named SALOMON QST 92 17/18, Salomon QST 92 2017-18 and Salomon QST 92 Skis 2018 – and also measure rising popularity perhaps with social media.

Kibana:        

Kibana is a free, open source tool that integrates tightly with Elasticsearch.

The visualization and exploration tools include interactive charts, mapping support, pre-built aggregations and filters, plus easily accessible dashboards. Elastic allows enterprises to pull more data in for visualization purposes with products such as Elastic Cloud Enterprise or Elastic Cloud on Kubernetes.                   

SECTION 2: Elastic Fundamentals        

A major fundamental risk for Elastic is that revenue growth may not be rewarded in 2020 as we’ve seen plenty of evidence that investors’ appetites are turning more towards profitability, which Elastic is far from reaching. 

The market was not kind to Elastic in 2019. Tech growth companies with negative earnings that did not have a perfect earnings report were penalized last year. Elastic was no exception. 

Analysts are projecting EPS estimate of negative -$1.35 in fiscal year 2021 compared to negative -$1.22 in fiscal year 2020 ending in April. Revenue in fiscal year 2020 ending in April is estimated at $416 million and fiscal year 2021 at $567 million. The company has $307 million in cash and $42 million in debt. 

The stock has a 52-week high of $104 in July and hit a new 52-week low of $61 a month ago on December 5th. The most recent earnings report revealed a slowdown in annual billings from 53% in the year-ago quarter to 45% in the most recent quarter. The company beat on all other estimates, including revenue, EPS and net expansion rate – which is phenomenal at 130. Despite this, the billing slowdown was enough to cause a 20% drawdown on stock price following the earnings report, from $78 to $61. 

The recent drawdown has resulted in Elastic trading at one of its lowest valuations yet as a public company. The stock is currently trading at 12 Forward EV/Revenue with an enterprise value of $5.03 billion. When considering revenue growth, this is an attractive valuation as Elastic is reporting 59% YoY revenue growth. Notably, revenue has decelerated from 79% YoY in early 2018 — yet has remained stable at 59% for the past three quarters. 

So, the question that remains, will Elastic have an earnings surprise, which is the purpose of this report. There is an important catalyst to consider, which I’ve outlined below. I believe it’s highly probable that Elastic’s fundamentals improve in the coming year due to its entry into endpoint security.    

Market Size & Competitors  

Determining the market size for Elastic is challenging for a few reasons. The first is that the company does not neatly fit into a specific category. In fact, the company is absent from Gartner’s magic quadrant for Insight Engines, although Elastic is mentioned as the brains behind two products on the quadrant: Intrafind and Lucidworks. Here is what Gartner says about Elastic:

“Of the vendors most often shortlisted by the reference customers we surveyed, Elastic (Elasticsearch) appears in the top five, and Apache (Solr) in the top 10. Neither Elasticsearch nor Solr are considered insight engines — extensive development is required for them to meet the market definition. However, they do provide highly effective search engines for those seeking only search capability or wishing to undertake development. Consequently, they form a foundational layer in the stacks of a number of commercial insight engines, including two in this Magic Quadrant: Lucidworks and IntraFind.” Of the vendors most often shortlisted by the reference customers we surveyed, Elastic (Elasticsearch) appears in the top five, and Apache (Solr) in the top 10. Neither Elasticsearch nor Solr are considered insight engines — extensive development is required for them to meet the market definition. However, they do provide highly effective search engines for those seeking only search capability or wishing to undertake development. Consequently, they form a foundational layer in the stacks of a number of commercial insight engines, including two in this Magic Quadrant: Lucidworks and IntraFind.”

According to Jefferies’ analyst John DiFucci, Elastic’s addressable market is around $40 billion and could double to $71 billion by 2022. He cites the technology is only limited by the “creativity of the customers.”        I agree that the limitations for Elastic’s growth will eventually lift as we are in the early stages of machine learning (ML), computer vision and natural language processing (NLP). 

ML and NLP are two markets that will grow rapidly over the next decade, with Elastic a recipient. NLP will grow from $3 billion in 2017 to $43 billion in 2025 (source: Statista). Research on Global Markets estimates ML will reach $19.4 billion by 2023, at a CAGR of 48.3%. Big data analytics is quite large at $168 billion in 2018 and forecast to grow at a CAGR of 13.2% to $274 billion by 2022. Elastic sits somewhere between these three markets.

The companies listed on the Insight Engines magic quadrant are not direct competitors. Rather, I would consider Splunk the biggest competitor as their customer value proposition of providing log analytics most closely overlaps. Elastic Stack and Splunk frequently compete for customers. According to developers who work with the products, Splunk is more mature while Elastic is more flexible due to its roots in open source. Other competitors include Sumo Logic on the enterprise side and Greylog on the open source side. The Elasticsearch open source tools are also available through Amazon without the need for enterprises to upgrade through Elastic (although the more optimal experience is with Elastic Stack).  

SECTION 3: Endpoint Security         

The log management and analytics dashboard offered by both Splunk and Elastic has evolved into an important secondary offering for Security Information and Events Management (SIEM).  In other words, because these companies monitor so many endpoints for data ingestion, the platforms are also useful for security monitoring. 

By using Search Processing Language (SPL), log management systems are able to perform high-order security analysis and assessments regarding the collective state of these systems from a single interface. For instance, Elastic has been used for threat protection by organizations such as the University of Indiana to monitor hundreds of thousands of devices across students, faculty, and staff. 

In October of 2019, Elastic closed the acquisition for Endgame, a leader in endpoint security for $234 million. This followed Elastic launching a Security Information and Events Management (SIEM) product in June. Endgame has enough credibility to be used by the U.S. Navy and the U.S. Air Force.

To raise the stakes, Elastic will be the first to charge for endpoint security by the amount of the data stored rather than by machine. This will allow companies to scale endpoint security more efficiently and will help Elastic compete with Splunk.

Splunk was ranked number one in SIEM by market share in 2018. The SEIM market was worth $5.3 billion in 2018 and is expected to grow at a 19.7% annual rate to reach $12.9 billion by 2023.  Elastic should be able to compete very closely with Splunk due to Elastic Stack having similar capabilities of ingesting data from endpoints. Even claiming a small portion of this market should help boost Elastic’s $500 million in annual revenue. 

We believe Elastic’s market entry into endpoint security along with competitive pricing will be an important catalyst for the company in the near future. 

SECTION 4: Basic Technical Analysis and Closing the Gap    

By Knox Ridley

Elastic (ESTC) is in a clear downtrend. After testing the all-time lows at $60.10, Elastic is bouncing back towards an important resistance price region at $67.50, highlighted with a red dotted line in the chart. If Elastic can close above this price, we will likely see a closing of the gap around $77.50, which is highlighted in yellow. This move would be about a 14% move from current prices (and about 24% from its recent bottom). 

Furthermore, it’s worth noting that Elastic has taken back its 10-day Exponential Moving Average (EMA) and closed just below the 21-day EMA. The volume of this bounce is on very light volume, which is descending as the price is ascending. This means that the market is not buying this beyond just a bear market bounce, and should be factored into any buying plan.

Internals (MACD, RSI, MFI)    

Looking at the internal strength of Elastic (ESTC), the MACD, Relative Strength Index (RSI), and Money Flow Index (MFI) are all telling an interesting story. First off, they are all in well-defined downtrends, which is highlighted by the dashed red lines. 

The RSI and MACD are also bouncing against support while trending down, and doing so at lower levels, which looks to be coiling for a move up. We will want to see these indicators break this downtrend in unison with the price of ESTC breaking out as well to indicate a possible change in trend.

The MFI, which is basically the RSI with volume factored in, is showing a positive divergence. In other words, as the price is making lower lows, the MFI is making higher lows. This is always a great indication of fading selling, and usually indicates a shift in sentiment. 

Closing above the start of this gap with high volume, and internals that are breaking out would be a key pivot that would further identify that Elastic is in a new uptrend, and not just a bear market correction.        

Price Symmetry       

Symmetry is a very powerful force in technical analysis. When a move in a certain direction reaches the length of prior moves, we usually see this resistance zone terminate the short-term, corrective move, and signal the continuation of the bigger trend. On the other hand, if the price can break through, it’s a strong indication that the larger trend has possibly changed. 

The above chart shows the length of the last correction in the current downtrend. The price increased by about 24% before continuing the larger trend to new lows. After bottoming recently, a 24% move up from the low would coincide with closing the gap just discussed. There is a lot of overhead resistance above Elastic, and until we see ESTC break above this region with heavy volume, we can only assume that this move is a correction in a larger downtrend trend.

Elliott Wave Count 

Elastic’s price structure, since its IPO, has been a series of overlapping structures. An overlapping structure, where the price retreats most of the previous move, indicates the uncertainty in the market. 

The above count shows Elastic is completing a corrective, 3-wave move up, which is highlighted by the red (A), (B), (C), and then began a new, corrective 3-wave move back down. In both 3-wave trends, the C wave unfolded in a 5-wave move, which is highlighted in blue and also common in 3-wave corrections. My best count has us in the final 4th wave of the C wave, which would suggest newer lows ahead. 

The alternative count has us as completing the 5th wave down, which would suggest we are in the very early stages of a renewed uptrend. I have a problem with this count due to Elliott Wave rules; however, if Elastic  can close the above gap on heavy volume and close above the 100% extension, I will take that as evidence that this alternative count is in play.           

How to Trade 

Elastic is a high conviction idea, that may take some time to play out. The market obviously hasn’t seen the value in Elastic over the past month, hence the current trend. We do not think this will last, but how early we are is the real question. Depending on your investment style, we have 3 suggestions:

Buy now and Forget: If you want to buy your position today and hold it, a good stop would be just under $53. Below here and we are entering uncharted territory with all-time lows.

Layering in: If you prefer to layer in, the same stop above would hold. Then, if Elastic hits lower, you can layer in more in the green target region on the chart, between $58.50-$53.50. if ESTC decides to continue higher from current prices, if it closes above $74.50 on heavy volume, with the internals breaking the current downtrend, then you can put the remainder of your position in with a 25% trailing stop.

We plan to trade with the layering in approach. 

Wait and See: If you prefer to wait and see, I’d target the green box in the chart between $58.50-$53.50