Motley Fool Hidden Gems Investing - Cybersecurity Is Big Business

Episode Date: August 21, 2023

The threats are getting bigger but so are the businesses trying to prevent them. David Meier and Deidre Woollard discuss: - Metrics to watch in business-to-business tech companies. - Why Palo Alto Networks reported on a Friday night. - The growth trends for cybersecurity as a whole. Companies discussed: ZM, PANW, ZS, CRWD Host: Deidre Woollard Guest: David Meier Producer: Ricky Mulvey Engineer: Dan Boyd Learn more about your ad choices. Visit megaphone.fm/adchoices

It's a Cybersecurity Monday as we look forward to a tech-heavy week. Motley Fool Money starts now. Welcome to Motley Fool Money. I'm Deidre Willard here with Motley Fool analyst, David Meyer. David, how are you today? I'm doing fantastic. How are you? I'm doing great. You're a longtime Fool analyst, but you haven't been on the podcast for a while,

so I'm happy to rectify that. And I'm excited to have you on today because we've got a lot of business-to-business tech companies reporting later this week and one that reported last week that we're going to focus on. But looking forward this week, we've got NVIDIA, of course, the big one, but we've got Zoom, Snowflake. We've got some others reporting this week. When I think about business to business, I think I want to look at customer growth, customer spend. What else should we be looking for? So first of all, you're spot on. For every business, we want to look at those things, right? Because that's where the cash flow comes from. Especially right now, one of the things that has been very important over the last 12 to 18 months is, are these companies making

comments about the sales cycles. So, during COVID, when everyone thought that work from anywhere was going to be the new way, the new normal, if you will, they spent a lot of money. But as the macro economy has changed, some companies are pulling back their budgets in response to what's happening. So, the first thing we're going to do is we're going to figure out, what is the current commentary about the sales cycles? Are they still lengthening? Are customer deals getting pushed out? Things like that. The next thing we're going to look for are margin profiles. One of the things that since growth has slowed across the board, many companies early in this process made the switch to saying, you know what, if we're

not going to be growing, we're going to make sure our margins are expanding because that's going to lead to increased profitability and increased cash flows, which a lot of these tech companies, especially smaller ones, weren't really promising a couple of years ago, pre-COVID. They were just all-out growth. We're going to get big. We're going to grow. We're going to worry about margins and profits and cash flow later. But right now, the game has changed, and investors want to know, if you're not profitable, when are you going to be profitable? If you are profitable, how profitable are you? How much cash flow are you generating? That's where my focus is going to be as these companies report.

Yeah, companies are in their fiscal responsibility era. All of a sudden, it's not about like, oh, look how we're growing now. It's like, but look how we're cutting. Yes. The thing that they are trying to communicate to investors is scale. Because before when you're just growing, you're like, okay, that's great, invest for growth. But also at some point, investors want to know, can you turn that growth into profits? If they're doing it correctly, that's what scale will bring investors. Yeah, absolutely. Well, I want to talk about a specific company because Palo Alto Networks, they announced their reporting on a Friday night after hours and for the entire week, the whole market was like, uh-oh, everybody's

raining an eyebrow, the stock goes down, everybody's a little bit worried. They report on that Friday, and it looks like a very good quarter for them. They apologized for a little bit of all the drama on the earnings call because it was not about anything bad to report. It was good. Revenue was up 25%. It seems like they're solid. Why did they do that? Also, what does Palo Alto Networks do? Let's address the Friday afternoon thing head on. Over time in this business, if you have something bad to say and you don't want a lot of people to see it, you send it to the newswire at 5 o'clock on a Friday, because most everybody is not in the office. So, yes, the first reaction, mine too, was like, oh my goodness, they have something bad

to say. But you're right, that's not what happened. I'll tell you what they do, and then I'll tell you why they, or at least what management says they were thinking in making that decision. So, Palo Alto is a leading cybersecurity firm. What they have done over time is they started out focusing on firewalls, basically traffic moving into and out of businesses' networks. And they have transitioned themselves through product development as well as a lot of acquisitions into a one-stop shop for all security products. The CEO, Nikesh Arora, who joined in 2018, put the company on this journey. There were a number of rough patches along that five-year journey, but it looks like

they're really starting to hit their stride right now. One of the benefits of that is, especially when you're dealing with big enterprises, if you have a full suite of products that you can present to a potential customer, that's great. That means that they don't have to go on different sales calls. They can make, hopefully, better choices more quickly, assuming that the products being offered are good. It turns out what Palo Alto wanted to do was actually go through a look-forward presentation in addition to reporting on their earnings and having the Q&A. That was the emphasis of doing it on a Friday afternoon, which to me still does not make sense. If you want people tuning in,

do not do it on a Friday afternoon. Right. I thought that too. The reason they said they did it was because I guess they've got a sales conference that was on Sunday, so they didn't want to have things out too far ahead. As you mentioned, it was not your traditional earnings call. I watched it on Saturday morning. I was expecting your regular earnings call. Instead, this is a two-and-a-half-hour video event, very well produced, a 134-page presentation. This was part earnings, but mostly it felt like an investor day to me. It felt like a pitch for a lot of the things they were doing, including their move to real-time cybersecurity. Yes, you're exactly right.

If they had planned a separate investor day, the back three-quarters of the presentation that they put together, that would have been it. We'll see if they do this again. My guess is they won't, because unfortunately, when you're giving a presentation about what you expect to do going forward, there's lots more questions. A lot of investors are going to question, hey, what are you doing here? Why are you doing this? Tell me more about what's happening in the marketplace, those types of questions which need time. Don't try to compress it onto the back half of an earnings call. Just go through your earnings call, have your conference, have your investor day. I think their PR department is going to make some changes, but we'll see.

Especially after seeing the way the stock reacted before the call because everyone was afraid of what to expect. Correct. Unfortunately, optics matter here. Again, the five o'clock on a Friday afternoon press release is not good optics. No. But I think it's interesting what they're trying to do with the real-time security. It makes perfect sense. They talked about it, how so much of the cybersecurity that they're doing now is catching threats after they happen or trying to prevent them, but not being able to do that real-time, something's happening, mobilize the troops kind of thing. It seems like that they really see that this is where AI comes in for them. Absolutely. And there are a few firms out

there in the space who have been pushing in this direction. So, one, it's completely logical that a company like Palo Alto, who, again, wants to be a one-stop shop, is also moving more strongly in this direction. Let's be clear, they have been doing this, but maybe not at the scale that they want to do going forward. But yes, attacks, no matter where they come from, where they originate. The idea is to sniff them out as quickly as possible by analyzing data, figure out what the right remedy is to neutralize them, learn from it, and then be able to do it even quicker again. I cannot think of a better application for artificial intelligence and machine learning than that right there.

Yeah, absolutely. Another thing that they talked about on the call was platformization. used it over and over. As I understand it, thinking about platformatization as a larger thing in tech, we used to just be selling single services. Now, companies are really selling a bunch of products. Zoom is doing this. We're going to talk about them after hours tonight. I'm sure we'll talk about it on the podcast tomorrow, about the platform, the things that they're trying to put together. It feels to me like everybody's saying they're platform. And when everybody's saying there's something, I tend to be like, maybe. So what do we want to look for with Palo Alto Networks and others to know if the strategy is working? Is it

customer spend? Is it recurring revenue? What do we look for? It's good that your spidey sense is working because platforming has actually been a buzzword for quite a while. But it's actually important because, again, if you can bring a suite of solutions, and it doesn't matter if it's necessarily just in cybersecurity, but it makes sense there. If you can bring a suite of solutions to a customer that basically accesses your platform and gets all of its access, whatever it decides to purchase through that one channel, that's a good thing. It's a good thing for everybody. How do we want to evaluate it? Well, I think the first thing that we want to do is make sure that the company in question is spending heavily on research and

development to make sure that its platform stays up-to-date, if you will, as well as is expanding the number of opportunities that are available. Along the recurring revenue you mentioned earlier, we want to look for billings growth as well. Essentially, once you sign contracts, you get an idea of when the revenue can be recognized, i.e., the billings. Billings are a precursor to revenue. Hopefully, those two things should be moving in tandem. And again, what Billings does, it gives investors a look forward to say, okay, is performance expected to come in strong, is it starting to weaken, what's going on? So, it's a good indicator.

One other thing you want to do from a platform standpoint is look at retention. So, most companies are not giving you the churn number, that churn being people who have left the platform to try to find a different solution. But what you have seen, what you will continue to see is called dollar-based net retention. What that is, is it combines not only our people coming and going, so adding new customers, losing customers, but also it's a measure of our customers that you currently have spending more with you. If you see a number that's greater than 100%. What that means is, even though some percentage of customers left, the current customers are buying more from you. It's another measure of health, if you will,

of the platform. The last thing, if a company provides it, each one doesn't provide it, but some do, is a cohort analysis. Companies bring in a certain number of customers each year. You have the 2019 cohort, the 2020 cohort, etc. What you want to see is, what are the spending patterns of those groups of customers? If they're going up into the right, that's another sign that the platform is healthy. Interesting. I hadn't thought about the cohort analysis. I don't see that one reported too much. I see the customers grouped in terms of how much they spend. Everybody wants to talk about that and how their large customers are doing. Not that many of them want to talk about the specific cohorts. Once in a while, you'll get it. And as an analyst, I absolutely

appreciate it. Yeah, because it does. It gives you a specialized window. Sure. Yeah. Well, so the cybersecurity business in general, it's had this massive run-up in recent years. I mean, Obviously, the headlines keep growing. We see these attacks and everybody gets scared. We know that the big companies, they really have to have this. Of course, like we just said, they talk about the big spend with the larger. But what about the smaller companies? Is this something that we're just going to have? With a company like Palo Alto, are they just selling more things to the bigger customers or are they also looking at smaller and smaller customers as well? A great question. One of the paradoxes is as a company becomes a leader and gets bigger,

it has to allocate its dollars to its sales force as effectively as it can. The best way to do that, unfortunately, is to try to move up in terms of the size of the deal. It's not that they're it's not that they're going to be ignoring smaller customers or customers who aren't going to come in with a $10 million or $20 million deal upfront. Going back to what we were talking about the platform, a company like Palo Alto should have a set of offerings that are tailored towards smaller companies. Maybe they don't necessarily have a sales Salesforce that helps with them. Maybe there's a self-serve sales channel that can help bring that customer in, and then hopefully, as their spending grows, then they can get an account

manager dedicated to it, then Salesforce to figure out how to best serve their needs as they grow. You're never going to completely ignore potential sales dollars, but the reality is for companies like Palo Alto. This is almost a $75 billion company. They're going to focus on more of their investment dollars on larger deals and figuring out how to get those existing customers to spend more of their budgets with Palo Alto. Yeah, absolutely. You talked earlier about that longer sales cycle that we definitely saw other companies talking about. It seems like that is going to continue maybe for a little while because there still is that lingering question with B2B companies. They know they need to spend,

but they're also trying to figure out what's happening. The economic numbers are wishy-washy. They're a little bit uncertain. Some companies are not quite sure how much they should be spending. I think you're exactly right. Again, as someone who follows this space, this has been something that every management team has commented on. If we look at the billings in the fourth quarter for Palo Alto, they actually grew a little bit slower than their revenue did. It is an indication that it looks like at least Palo Alto is still in a, hey, I haven't gone through the call completely yet, but it looks like they're still in the mode of, hey, some customers may need a little more time to sign a deal.

The other thing is, again, Palo Alto was very quick to point out that the number of $10 million and $20 million deals grew significantly more quickly than smaller deals. If you're a CEO in this environment, and basically, you probably need your signature in order to sign off on a $10 or $20 billion deal, if it takes another month, they're going to do that. I won't read too much into the billings number because of the environment, but it's good to understand. This is why it's important to understand the context. Get into the numbers, figure out what's going on in the environment, figure out if it makes sense what the company is reporting, and then you can look forward as an analyst and figure out if it's a good deal or not.

Yeah, absolutely. Well, cybersecurity, there's a bunch of players, including CrowdStrike, Zscaler. They all went up a little bit on the Palo Alto news. So, thinking about the space as a whole, it seems to me as an outsider, it seems like they're competing for the same business. Maybe they have slightly different angles. I know Zscaler is all in on zero trust, Palo Alto has some zero trust too. If you're an investor, are you trying to figure out who's going to be the big winner? Is there going to be a big winner? How do you think about cybersecurity as an investment sector as a whole? That is an excellent question. I'll take you Real quick, backwards, when Palo Alto started, it focused on the firewall, which was the most

important thing at the time. Gradually, it shifted with the market as new needs for cybersecurity presented themselves. Back in the early days, you couldn't necessarily predict where Palo Alto was going to be 10 years down the road because no one knew what the threat environment was going to be like. Picking winners versus going with leaders, it really depends, I think, on what an individual portfolio needs. For example, if there's no cybersecurity in someone's portfolio and they're just looking for it, Palo Alto is a great company to consider. Again, they're focused on a platform approach. They have a wide variety of products that you can benefit from because their addressable market by having products that go after those markets is enormous. If they can continue to do

what they're doing, maybe it's not the 10 baggers or in a compressed timeframe, but you can get good you can get good exposure to the industry and hopefully generate a good return as Palo Alto performs. But you're exactly right. If you're looking for a winner or an individual name, first of all, you need to understand what it is that company does. If it's CrowdStrike, you're looking at the endpoint market. If it's Zscaler, you're looking at the cloud market. and then you have to ask yourself, okay, are those two companies leaders? Who are companies that are trying to disrupt them? That's when you might be able to say, hey, SentinelOne is actually trying to change the way that endpoint protection is done. Depending on what your portfolio needs,

again, you can go for a leader, you can go for a disruptor. But the good thing, if this is a good thing, there will always be demand for these companies' products. We know there's always threats. Somebody is always trying to hack somebody because there's money to be had, and when there's money to be had, people do things. Is this a game that goes on forever? You've got the bad guys constantly trying to get in, you've got the hired guns constantly trying to protect. Hired guns keep having to hire you know, more hired guns as the, as the attackers try different things? Is this just a game that goes on forever? I think so. Uh, the, the, the reason is, is there's a huge incentive on both

sides, unfortunately, whether you're, you know, whether you're the attacker or the attackee, is that the right, is that the right word to use? Um, or you're being attacked. Um, yes, The behavior in this particular instance is absolutely being driven by the incentives. And the incentives are, you know, if I get smarter and figure out how to create new attack vectors, then I can perhaps penetrate into systems and, you know, cause some havoc and try to extract slash extort money from the system. Instead of taking a step back, let's move higher and look down on the industry. This is a global phenomenon. We are becoming more and more dependent on data every day.

we're not going backwards, we're not going to become less dependent on data. So, the more network connections there are, the more data that's moving around the system, there's actually more opportunities being created for these attackers to go after. Just because of the innovation on one side to try to make better business decisions or try to do business faster is actually perversely creating more of an incentive for the attack vectors to come in. The answer, I think, if we play that out, is it's just going to be back and forth. On the attacker side, if you innovate and figure out a new vector that gets you a short-term win, you're going to get your payoff and then the industry will figure out how to deal with it. That's what all those

companies are trying to do. The next ingenious attacker will try to figure out the next one, and so on and so on. It just keeps going on. Well, thank you for breaking that down with me today, David. My pleasure. This was a lot of fun. As always, people on the program may have interest in the stocks they talk about, and The Motley Fool may have formal recommendations for or against, so don't buy or sell stocks based solely on what you hear. I'm Deidre Willard. Thanks for listening. We'll see you tomorrow.