Check Point Software Technologies Ltd. (CHKP) Earnings Call Transcript

All right. Do we have everybody in the room here? We do. All right. Good morning, and in this case, good afternoon to my guests on here. I'm Walter Pritchard, software analyst here at Citi, and happy to have everybody join what is the first software session we have here at our 2020 Virtual Tech Conference. So pleased to introduce, we have Gil Shwed, who's Chairman and CEO and Founder of Check Point Software Technologies; and then Tal Payne, who's the CFO and COO; and Kip Meintzer, who is the Global Head of Investor Relations. I'm going to turn it over to Kip for a quick safe harbor, and then we'll get going.

Thank you, Walter. During the course of this presentation, Check Point's representatives may make certain forward-looking statements covered by the safe harbor provided by the Securities Act of the early 1900s. Because these statements pertain to future events, they're subject to risks and uncertainties. Actual results could differ materially from Check Point's current expectations and beliefs. Factors that could cause or contribute to such differences are contained in our latest earnings press release and other factors and risks, including those discussed in Check Point's latest annual report on Form 20. Check Point assumes no obligation to update information concerning its expectations and beliefs, except as required by law. Now I'll throw it back to Walter, and we can proceed.

Great. Thanks, Kip. So again, Gil and Tal, thanks for joining. I wanted to start out. We're in unprecedented times, I would say, with the global pandemic. And it seems to be that the security environment sort of -- it takes the lead from the global macro and other events going on. Gil, could you talk about what you're seeing from a global threat landscape perspective, and especially how COVID has changed that?

I think there's 2 perspectives to that. One is -- and first, I think, good morning, good afternoon, everyone. Forgot to say that, and thank you, Walter, for hosting us here. But let's switch back to your question and try to talk about the cyber landscape. There's 2 aspects to that. What is the evolution of the attacks that continues to evolve. I mean we're seeing now more attack that follow the pandemic. By the way, we've seen with the evolvement of the pandemic, such as the attacks evolved, initially they were malicious applications that intend to provide health information because everybody was about health information and so on. So it started to be application, mobile application, website that give health information that turned to be malicious later on versus being a switch to attacks that tried to steal money based on government aid and government support to businesses and citizens. And I think we've seen really, really targeted attack based on each country and the evolution of the pandemic. But -- so that's one aspect, so that's the evolution of attack. Second aspect of the cyber landscape is the fact that our threat landscape has really, really evolved. Let's look at a typical company. In the past, the company was only -- I mean, things were locked down, the company wasn't accessible from outside. And again, it's true to office environments, like most of us do. Many of things were closed and guarded, and now, we are open for everyone to work from home. And it's true to the industrial and critical infrastructure when, again, things were even not connected to the Internet, and suddenly, all the maintenance, all the monitoring of machinery of critical infrastructure and IoT has to be done remotely. So I think what we have today is a threat envelope or threat surface, which is 100x bigger than it used to be before. And it's our job, the security professionals -- I mean the industry, the CISOs in every company and so on to move on and protect our environment from the expanded threat landscape.

And how would you compare the environment? I mean, we've had similar sort of geopolitical events, where one country goes after another country, or we've had things like high-profile breaches that maybe with a new type of malware that kick off a new series of attacks? How would you compare what we're seeing now to what you've seen over the last, say, 5 or 7 years?

I think, the environment continues to evolve. We are now in the fifth generation of cyber attacks. These attacks are more sophisticated. They are multivector attacks, which means that it's not one entity attacks one object. Like one web server or one mobile phone or one -- these attacks that are pretty sophisticated. You may download an application on your mobile phone, they end up the malware proliferating from that device to a cloud environment. And in the further, fourth stop, the attack actually downloading the malicious pool that's going to cause damage, ask for ransomware or do these kind of stuff that we're seeing more and more of these attacks. So that is continuing. I think we are now more and more understanding what will be a cyber pandemic. I think what we are getting ready, we're getting ready for the cyber pandemic that will follow the unfortunate biological pandemic that we see right now. More and more industry experts are talking about that. And we have to realize that -- I mean, we can draw the similarities and the differences between a cyber pandemic to biological pandemic. And I think what we need to make sure is that we are ready for that cyber pandemic because it will come in one form or the other.

Got it. And so clearly, the environment is, from a security professional's perspective, challenging out there and probably driving them to continue to spend on security products. On the other hand, you have this macro impact where you've had certain industries hit pretty hard by downturn. How do you -- how has that balanced out so far, and how do you see that playing out over the next 6 to 12 months, Gil?

So I think, first, we see the effect. And so far, it's balanced off quite well. We actually had the last 2 quarters. Q1 was slightly affected by COVID-19. Q2 was a 100% corona quarter. We were all locked down. Business was positive. Business was positive for us. And we've seen that the budget weren't affected. And it's true, by the way, for the cyber industry, and I think at large, it was true to many other companies in the IT industry. Right now, when I'm speaking to CISOs, most of them are telling me that their budgets weren't effective. Even in companies who were saying our company is changing some course, drafting. They're saying, our cyber budget wasn't changed. However, I don't think that any of us is immune from the global economy. And I don't think that a single company is immune from that, so I'm being on alert to understand whether things will change eventually. I don't know the answer. I mean, but I think that we should all be on alert to understand that we are not immune from the global. I think what we also see is a little bit of a change in what people are spending their cybersecurity budget on. For example, in the second quarter, people were somewhat reluctant to buy physical gateways because they're trying to stay away from the data center. So they only bought when it was necessary. This thing might change. They might stay the same because the world is opening up a little bit. Everybody is speaking about moving workloads to the cloud, so I think we will see more and more cloud security needs that are happening. We've seen real attacks on critical infrastructure. So I think we, for example, launched a new appliance that's targeted in protecting critical infrastructure. I think this is a bigger market today than used to be 6 months ago. So there will be a few changes in the consumption or what security budget will look like. I must tell you that from speaking to CISOs, they all understand that they need to do more. They all understand that the environment is changing. I don't think that they all ever planed right. Right now, we are seeing -- like many of us, we're trying to keep as much as we can in this crazy environment business as usual. We're trying to keep the critical functions on. We haven't formed the long-term plan for the pandemic and for after the pandemic. And I must say that -- I mean, it's a lot understandable because we're in an environment with a constant change, where it's really hard to define what will be the midterm and long-term plan in our world with days.

Got it. And how would you -- just specifically from the competitive dynamic that's out there within COVID, do you find it easier to get your product into new customers and even displace existing technologies? Or do customers sort of step back and say, I'm going to work with the vendors I have. Obviously, you have a big install base. But how has that impacted the displacement and competitive backdrop in the security market?

I think, overall, we had good success. I think slight improvement in our sales execution overall. We had good success with new customers. We have good success with displacement of competitors. But overall, the message I'm hearing from the field is it's a little bit harder to form new relationships. I mean at this time, people kind of default to the relationships that they already have. Customers saying, okay, I know these people, I know this vendor. I know the kind of software technology, so I'll stick to what I already know. So I think the -- what I'm getting from the field is that it's a little bit harder to find new customers in this environment.

Got it. And then maybe switching a little bit more on the product side. So I think one of the major happenings in your product organization, you've introduced a number of products around securing the cloud under the CloudGuard brand. Can you talk about where the company is in terms of evolving the product line towards the cloud? And also, I think, probably more importantly, being able to develop a relationship with a new type of buyer that's not the network person that's plugging in boxes, but the developer or the person in charge of building software.

Sure. So I think that the cloud has been a big focus for us for a long time, and this year is no exception. In June, we launched the new CloudGuard family of products. I mean, it's like the second wave of -- again, it's evolving all the time, but the second wave of the CloudGuard family now focusing a lot about cloud-native application, about workload protection. And I think one of the challenges in cloud, which is a very broad area in general, and specifically for security, is to secure the newer type of workloads. For example, we've now introduced technology for serverless function. And I think we're, by far, the best in the world in that, and the most evolved technology. Usually, when you secure an environment, you secure the platform, you secure the network around it, and that's how you secure an application environment. With serverless function, which is a new entity in the cloud, you don't have an environment. There's no network around it. There's no server -- I mean, no known server. But it's a complete virtual environment with start and stops on a single function in vocation. That's really, really hard to secure. And by the way, the way people build serverless function, they usually build them as a lot of microservices that connect to each other, which means that in many cases -- or not in many cases. What we found it was -- to say it in a delicate word, understatement, a pretty challenging environment for security or a pretty big disaster from a security standpoint. So we've built and acquired key technologies to secure serverless environment, and that's part of the new CloudGuard. We are -- we know how to secure network environment in the cloud. We know how to secure cloud servers. We have one of the most important capabilities, which I think we have a huge lead over the competition, is what we call cloud posture management. It's taking all your assets in the cloud, tens of thousands and even hundreds of thousands of assets that the customer may have on the cloud, and real time analyzing their status all the time and blocking and closing gaps when they are open. Because one of the key issues with cloud is simple configuration errors. You create a new entity, you create a new environment. Again, this environment, in many cases, is not behind the company gateways, the company firewalls, is behind the company security. It's in the wide open. And you need to make sure that if such an environment is being created or opened up and is now available to the public, you immediately shut down that connectivity. So our CloudGuard posture management is one of the key elements in our cloud strategy and CloudGuard family.

Got it. And how do you look at -- on the go-to-market side, you mentioned earlier that you've seen sales execution improve to some degree. How -- what are you doing from a sales organization perspective to position yourselves to be able to sell these products, which again aren't sort of sold to the network person and so forth?

So I think one of the things we are working is we're expanding the people we're working on. One of the things is going to the CISOs, the Chief Information Security Officer. And also all the way, by the way, to the CIOs, the Chief Information Officers, for companies that are key elements in the strategy element in analyzing and opening up the doors to new buyers and to new needs in the organization. I think, for example -- I'll give you a simple example. We've created in the second quarter. We've done -- I'm not sure what's the numbers, but I think it's in the -- getting to the 100s of CISO forums, small forums, 10, 20 people in each region when we create a forum when we can chat, when we can work, when they can chat with us, when they can chat with each other and talk about the situation, talk about the security challenges. And that opens up the room, both to getting closer to the CISOs we already know, but it also brings to the table a lot of new CISOs that we didn't have a relationship before. So this is one example of approaching new customers. By the way, corona, in general, which is, again, a terrible thing, and I mean, it's hard to stress how it can be bad for our world. But in terms of communication, we all became closer to our customers. Now creating a customer meeting is much easier. I don't need to fly to New York. If we need to bring 5 experts to speak to a customer, it's one Zoom click, and we are all on the call, and we are all there. So in that respect, actually, again, it's harder to form personal relationship in the virtual world, but it's easier to create more meetings and to speak to more people. And I think the main fact is how to leverage that. So I think we got I mean over 1,200 marketing events that are all virtual. We got an amazing number of customers and prospects attending our events. And in many cases, people that won't attend in the physical world because in the physical world, the cost of now spending a day traveling, getting somewhere was too high, and now, connecting to a virtual event and seeing that it's actually quite interesting -- and we have good, by the way, data on the level of how long people stay on our conferences and how much they are interested in what's there. So it becomes much easier to join and learn more in this period of time.

Got it. So Tal, turning it over to you on the cloud side. I think one of the questions I get most often from investors is, how do we know how big this business is? How is it contributing to your growth? How will it contribute to your growth, more importantly, in the future is it as it gets bigger? And what would you tell us about the numbers impact, and more importantly, how we should think about the future numbers impact of the investments that you're making in the cloud products?

I think Gil can take that one because we aggregated the numbers. And if you take all the activities that we have in the cloud, it's probably around 10% now. And it's growing quite fast. The new technologies in it growing, of course, faster than older ones although all of them are pretty new. Terms of percentage, the new technology can grow over 100%. The older maybe 20%, but in general, growing very fast and nice. We invest quite a lot in the cloud, both when you talk about the infrastructure of the cloud as part of serving our customers, R&D that relates to the cloud. We have many people in the R&D groups that are dealing with cloud. With operational group, we have people that are dealing just with the cloud. So it's quite a large investment. Most of the M&As from the last 2.5 years, I think, 3 or 4 of them were direct relations to the cloud. So we believe it's an area that is very interesting, fast growing and what's the investment that we're putting in it.

And how should we think about -- you have your product business, you have your subscription business, some of which attaches to the product, some of which is these products we're talking about here, which are not attached. How should we think about the growth dynamic? Do -- does the product line, as cloud gains momentum, continue to slow and go back to negative as we see subscription grow? Just trying to get maybe a higher-level view of how we should see cloud flow through the numbers over time.

So remember, majority of the product -- not only the cloud, but since I think 2009 when we started -- '08, when we started with the software blades or subscription for, majority of the new products that have been launched are with pricing model of subscription. Cloud, all of them, are subscription. Many of the added services are subscription. So I would say as a high-level comment -- except for the appliances that are in the product, which is the majority of that line. So it's software license and appliances that are in the products, all the add-on services, including the cloud, the threat prevention, the threat extraction, the sandblast, all of them are in the subscription line. Also remember that Infinity, although it includes also product, majority of the Infinity -- the Infinity is a model of subscription, all of it. And majority of the revenue recognition that relates to Infinity is allocated to the subscription and the support line. So everything is going towards the subscription line. And by definition, it slows significantly the product line and even slightly the support line. Because Infinity, for example, also is including support, but more dollars have been attracted into the subscription because we provide in Infinity all of our product portfolio. Hence, majority of the dollars have been pulled into the subscription line.

Yes. Got it. And Tal, when do you envision -- or under what conditions do you envision breaking out the cloud revenue? Does it have to get to a certain percentage? Or would you like to see it sort of stabilize and become more predictable? Could you help us understand how you're thinking about possibly breaking that revenue out?

To be honest, I'm not sure you really even need to break it because, remember, that then it creates like a confusion when you break, one line is going up, the other one is going down. Even when you look now how many explanations are around why this product is being negative -- now it's positive, but why is product B negative, and a lot of the explanation is relating, of course, to the fact that subscription portion, which is bundled in it, is pulling dollar from the product line into the subscription. So I think the more you split, the more, I would say, not necessarily valuable explanations are attached to it. So we will give color as much as we can in our calls. And maybe we will break in the future, but I'm not sure it's the right thing to do in terms of the value.

Okay. And Gil...

And by the way, I looked at also other players, and I think nobody is breaking the cloud numbers as of yet, right?

I think you've got Palo Alto doing next-gen product, which is a different definition.

Yes.

Gil, on the technology side, I think another thing I hear from investors is you talked about, for example, securing serverless, where it's sort of almost application permissions or access control within applications because of these microservices. And you have players in the identity management space who are sort of attaching user privileges to application privileges. How do you look at those technologies coming together over time? Do you start to offer an element of what the identity management players do? And do what they do start to look more like network security?

I think we're still pretty far from the identity management vendor, and they're addressing different things. For example, we address application and the abilities. They access -- they address specific user access rights. I think one of the challenging elements in the microservices is we're talking a lot about machine-to-machine communication. So the actual user behind the transaction is completely lost. One of the theories many years ago about web application firewalls and others was let's understand what was the user, what we are doing. But unfortunately, that's true only to the first layer of access. When you go to the second layer of access, the user is lost. I mean, it's like one web service creating other queries or other transaction into the application server and then to the database server. And now, to 2 dozen microservices that are done with the same identity. So the issue is not the identity management, but identifying the breaches, identifying the transaction that might try to fool the event. By the way, this is many of the weaknesses within application. Weakness in application was that one microservice trusts the other microservice in transferring the right data. The first microservice doesn't understand the data because they transfer it to the second one. It turns out that this data is actually malicious and causes the application to break down. And this is the kind of thing we are checking, not just at the network level, but actually, in the microservice itself to see that it behaves properly and correctly. So there's many, many different elements to that. It's a really, really complicated space. And that's, by the way, why we've got both homegrown and acquired technologies that I must say are some of the most sophisticated and the most interesting technologies that I've seen in the marketplace. And that's why, by the way, I believe that we have a strong lead on this specific segment of the market.

Got it. Another area on the product side, although maybe more here and now, you launched a new series of appliances, Gil, over the last 6 months or so. And I think over -- I mean, I've covered Check Point now for 21 years, and you've had different dynamics with launches of appliances. Can you talk about what you've seen so far? And then maybe Tal can follow up on what impact, if any, we've seen on what's been reported over the last couple of quarters in terms of numbers.

Sure. So first, I want to say in a very overall statement, Q2 was a very interesting quarter. We completely changed the way we work. From working physically to working virtually. The world has completely changed, and we pretty much renewed almost our entire product line. We already talked about CloudGuard for the cloud. We launched a new IoT products family. We launched a new what we call Infinity software security management. And the biggest one is exactly what you're referring to now is the quantum new network security appliances. And the quantum pretty much covers all of our gateway, which is the vast majority of our -- which is a big part of our business. The new quantum gateways are both offering much higher performance in terms of the hardware. They offer the highest level of security that provides the sandblast and the threat cloud technologies included in the price and included with every appliance that's being shipped. So there is a strong message to the customer saying you need the highest level of security. It's included just using. It's up to you now. You've got the technology, use it, because we think it's important. It's including the -- what -- the new what we call hyperscale technology or the Maestro family, which lets you basically get to almost unlimited performance by changing many, many appliances and getting cloud-like both scalability and redundancy. And I think it's quite big for one quarter sort of turning out the entire family. We've been struggling with what's the right business model with how to package, how to build it. And I think we finally got to try in the second quarter, and so far, it's trending well. We've seen a quick shift from the old product lines to the new product line, which, by the way, in many cases, you expect. But in our industry, it's not always the same. People kind of like the old products that they already know. Large customers in the financial sector, for example, it takes very long time to certify each appliance. And I must say that the good indication for Quantum is already in the first quarter, the majority of sales are coming from the new Quantum product family. So I think quantum and the hyperscaling and the advanced security so far proving to be an initial success, let's put it that way.

Got it. And Tal, anything to add in terms of financial impact to highlight?