Cybersecurity was a wild ride this earnings season with stocks such as Fortinet down (25%) after its report, yet stocks like Palo Alto Networks up 15% following its report. This is important to dissect as Palo Alto is the leader YTD in gains while Fortinet is the laggard (see chart below).
Source: YCharts
We think the market is more forward-looking than ever when it comes to the cybersecurity space as the key metrics is what separates these names. Below, we look into the key metrics to help predict where the market will go next.
Revenue and EPS
Before we go into key metrics, let's first review top line and bottom-line numbers. Here is how the leading cybersecurity stocks stack up on revenue. Zscaler and CrowdStrike are leading in revenue growth in the recent quarter with YoY growth of 43.1% and 36.7%, respectively.
Zscaler’s revenue grew by 43.1% YoY to $455 million and CrowdStrike’s revenue grew by 36.7% YoY to $731.6 million in the recent quarter.
Forward looking, CrowdStrike leads highest revenue growth rates in the next two quarters and yet Cloudflare edges out CrowdStrike in the early part of next year – per analyst consensus.
- CrowdStrike’s revenue is expected to grow 33.8% YoY in Q3 2023 and 31.3% YoY in Q4 2023.
- Cloudflare’s revenue is expected to grow 29.6% YoY in Q1 2024 and 30.2% YoY in Q2 2024.
Source: Seeking Alpha
CrowdStrike’s adjusted EPS is expected to grow the fastest in the next three quarters with 85.6%, 66.3%, and 36.6% YoY growth. Zscaler beats CrowdStrike in Q2 2024 with 21.1% YoY growth while CrowdStrike’s EPS is expected to grow 15.1% YoY in that particular quarter.
Source: Seeking Alpha
Margins
We'd also like to discuss margins as a group before we break the stocks down individually. For brevity’s sake, we are placing the most importance on GAAP operating margin. This highlights why Palo Alto Network has led cybersecurity stocks this year, as the company’s growth profile is balanced with operational efficiency.
Source: YCharts and Company IR
Palo Alto’s operating margin improved to 13% from 1% in the same period last year. CrowdStrike and Zscaler are also improving as can be seen in the below chart.
- CrowdStrike improved to (2%) from (9%) in the same period last year.
- Zscaler improved to (10%) from (26%) in the same period last year.
Source: YCharts
Key Metrics
Below, we look at key metrics among cybersecurity stocks to help determine which companies may be stronger than they seem, or the opposite, weaker than they first appear.
CrowdStrike
For CrowdStrike ending ARR and net new ARR are two important key metrics. Per CrowdStrike’s management: “And as you know, the business is focused on ARR, as opposed to billings, which can be — which can have whipsaw effects and the focus on ARR, just gives you an idea about the overall health of the business.”
Ending ARR grew by 37% YoY in the recent quarter to $2.93 billion. This was partly helped by the rapid growth in cloud security, identity protection, and LogScale Next-gen SIEM, which together surpassed $550 million in ARR with very high growth rates:
- LogScale SIEM ending ARR grew by over 200% YoY in the recent quarter and is approaching $100 million and the management expects to achieve in Q3.
- Falcon modules deployed in public cloud grew by 70% YoY to $296 million.
- Identity Protection ending ARR grew by 194% YoY to over $200 million.
Source: Company IR
Net new ARR declined by (10%) YoY to $196.2 million yet was better than management’s guidance of a decline of (11%). In the earnings call, management pointed toward net new ARR returning to growth in the second half of the year: “With the business momentum we see and competitive market dynamics, we believe our second half performance will yield double-digit net new ARR growth.”
Source: Company IR
Palo Alto
For Palo Alto, billings and RPO are the two key indicators. Palo Alto’s billings grew by 18% YoY to $3.2 billion. Despite billings growth showing a deceleration, it’s actually quite strong due to the tough comps as billings grew by 44% YoY in the same period last year.
The management guided billings to grow in the range of 17% to 19% for the next quarter. They also expect billings to grow in the range of 17% to 19% for the next three years. Dipak Golechha, CFO of the company said in the earnings call, “We have the product portfolio that makes us an attractive partner to these players, along with the scale to make the investments to support the success of these partners. Bringing this together on the top line, as Nikesh noted, we're targeting growth of 17% to 19% in revenue and billings over the next three years, which is ahead of the cybersecurity market growth rates.”we're targeting growth of 17% to 19% in revenue and billings over the next three years, which is ahead of the cybersecurity market growth rates.”
Source: Company IR
Remaining Performance Obligation (RPO) grew by 30% YoY in the recent quarter to $10.6 billion. The management believes RPO is a better metric than billings since it is not impacted by billing terms that impacted billings due to customers preferring deferred payments in the current environment. Per the earnings call: “The percent of bookings that included deferred payments increased approximately 45% year-over-year […] and also: “RPO is becoming a more important leading indicator for our business as it's not impacted by billing terms [..] As a reminder, RPO represents the booked business we expect to recognize as revenue in future periods. Also, all customers' purchases, including in RPO, are noncancelable.”
Source: Investor Presentation
Fortinet
Billings grew by 18% YoY to $1.54 billion in the recent quarter, which was a disappointment to the market. Ken Xie, CEO and Founder of the company, said in the earnings call, “Billings growth of 18%, led to more normalized product revenue growth of 18%. We believe our billing performance reflects large enterprises’ concerns with the macro environment, in addition to some inventory digestion after two years of elevated 30%+ of product billing growth during the supply chain shortage.”product revenue growth of 18%. We believe our billing performance reflects large enterprises’ concerns with the macro environment, in addition to some inventory digestion after two years of elevated 30%+ of product billing growth during the supply chain shortage.”
The management cited macro uncertainty led to shorter contract duration and enterprise deals getting pushed out to future quarters for the slower billing’s growth of 18%. Keith Jensen, CFO of the company, said, “We saw shorter contract duration with the average term decreasing 1.5 months to 28 months, creating a 4 to 5-point billings headwind year over year. Normalizing billings growth for the change in contract duration, yields billings growth in the low 20% range. Having some level of enterprise deals push to future quarters is not unusual. In Q2’23, however, an unusually large volume of deals that we expected to close in June, instead pushed to future periods.”
The above explanation from the management was not convincing as it lowered the company’s revenue guidance to $5.35 billion to $5.45 billion, representing a YoY growth of 22.3% at the mid-point from an earlier estimate of $5.425 billion to $5.485 billion.
- Revenue for Q3 is expected to be $1.315 billion to $1.375 billion, representing a YoY growth of 17% at the midpoint.
- Billings in the range of $1.56 billion to $1.62 billion, representing a YoY growth of 12.8% at the mid-point.
Source: Company IR
Cloudflare
The company’s paying customers grew by 15% YoY yet large customers (> $100,000 annualized revenue) grew by 34% YoY to 2,352.
Thomas Seifert, CFO of the company said in the earnings call, “Turning to our customer metrics. In the second quarter, we had 174,129 paying customers, representing an increase of 15% year-over-year. We ended the quarter with 2,352 large customers, representing an increase of 34% year-over-year and an addition of 196 large customers in the quarter. In fact, we added a record number of customers spending more than $500,000 on an annualized basis with Cloudflare. And the second quarter was also one of our highest quarterly additions of customers, spending more than $1 million annually, including our largest Zero Trust contract to date.”
The dollar-based net retention rate was 115% compared to 117% in Q1 23 and 126% in the same period last year. He further said,
“Importantly, renewal rates in the second quarter were consistent with the quarterly average in 2022, which was an all-time high for the company. Instead, similar to the last two quarters, the decline in DNR was again primarily driven by slower expansion in our larger customer cohort. We calculate DNR by comparing the analyzed revenue from paying customers four quarters prior to the annualized revenue from the same set of customers in the most recent quarter. As a result, this will be a lagging indicator of Cloudflare’s underlying business trends. Based on our visibility, we believe the deceleration in DNR is nearing a bottom.”Based on our visibility, we believe the deceleration in DNR is nearing a bottom.”
Source: Company IR
Zscaler
- Customers with over $100,000 in ARR grew by 25% YoY to 2,609.
- Calculated billings grew by 38% YoY and up 49% QoQ to $719 million. The total billings benefitted from $20 million upfront billing on a multiyear deal. The calculated billings grew 40% YoY in Q1 and 57% YoY in the same period last year.
Source: Company IR
Conclusion
We are currently looking to add cybersecurity exposure to our portfolio, ideally on a pullback, to position into 2024. There are many strong candidates highlighted here that are performing better than other cloud cohorts. In particular, there are many mentions throughout of the key metrics listed above bottoming. Should these key metrics bottom on any particular stock, the market will likely reward that stock. Our plan is to front-run this bottom with a small allocation and then layer-once the bottom has been confirmed.
Recommended Readings: