Palo Alto Networks Inc. (PANW) Q2 2018 Earnings Conference Call Transcript

Palo Alto Networks, Inc. (PANW -1.22%)
Q2 2018 Earnings Conference Call
Feb. 26, 2018, 4:30 p.m. ET

Contents:

• Prepared Remarks
• Questions and Answers
• Call Participants

Prepared Remarks:

Operator

Please stand by. We are about to begin. Good day and welcome to the Palo Alto Networks Fiscal Second Quarter 2018 Earnings Conference Call. Today's conference is being recorded. At this time, I would like to turn the conference over to Ms. Kelsey Turcotte, Vice President of Investor Relations. Please go ahead, ma'am.

Kelsey Turcotte -- Vice President of Investor Relations

Good afternoon and thank you for joining us on today's conference call to discuss Palo Alto Networks fiscal second quarter 2018 financial results. This call is being broadcast live over the web and can be accessed on the investors section of our website at investors.paloaltonetworks.com. With me on today's call are Mark McLaughlin, our Chairman and Chief Executive Officer, Kathy Bonanno, our Chief Financial Officer, and Mark Anderson, our President.

This afternoon we issued a press release announcing our results for the fiscal second quarter ended January 31, 2018. If you would like a copy of the release, you can access it online on our website.

We'd like to remind you that during the course of this conference call, management will make forward-looking statements, including statements regarding our financial guidance and modeling points for the fiscal third quarter and full fiscal year '18, our competitive position and the demand and market opportunity for our products and subscriptions, benefits in timing of new products and subscription offerings, our ability to drive outside growth rates, expectations regarding the impact of the U.S. Tax Cuts and Jobs Act, and trends in certain financial results, operating metrics, mix shift, and seasonality.

These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which can cause actual results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today and you should not rely on them as representing our views in the future and we would undertake no obligation to update these statements after this call. For a more detailed description of factors that could cause actual results to differ, please refer to our quarterly report on form 10-Q filed with the SEC on November 1, 2017 and our earnings release posted a few minutes ago on our website and filed with the SEC on Form 8-K.

Also please note that certain financial measures we use on this call are expressed on a non-GAAP basis and have been adjusted to exclude certain charges. For historical periods, we have provided reconciliations of these non-GAAP financial measures to GAAP financial measures in the supplemental financial information that can be found in the investors section of our website, located at investors.paloaltonetworks.com.

We would also like to inform you that we will be participating in the Morgan Stanley Technology, Media, and Telecom Conference in San Francisco on Thursday, March 1st, and the Raymond James 39th Annual Institutional Investors Conference in Orlando on Tuesday, March 6th. Finally, once we have completed our formal remarks, we will be posting them to our Investor Relations website under quarterly results. And with that, I'll turn the call over to Mark.

Mark McLaughlin -- Chairman and Chief Executive Officer

Thank you, Kelsey. And thank you, everyone, for joining us this afternoon for our fiscal second quarter 2018 results. I am pleased to report that we delivered a strong second quarter. On a year-over-year basis, Q2 revenue was $542 million, up 28%, billings were $675 million, up 20%, non-GAAP operating margin was 20.5%, and non-GAAP earnings per share was $0.97.

In the quarter, we continued to see health security spending and strong demand for our next-generation security platform. With the addition of close to 3,000 new customers in the quarter, we are privileged to now serve approximately 48,000 customers around the world. In addition to robust new customer acquisition, we also continue to rapidly increase our wallet share in existing customers. Our Top 25 customers, all of which made a purchase in this quarter, spent a minimum of $25.6 million in lifetime value in Q2, a 54% increase over the $16.6 million in Q2 of fiscal '17.

Specific examples of customer wins and competitive displacements in the quarter included: a Cisco replacement to secure the global network of one of Europe's largest manufacturing companies with more than 150 branch offices and factories; a legacy AV replacement and competitive win against multiple stand-alone, next-gen endpoint providers in a U.S.-based hospital system on tens of thousands of endpoints; a check point replacement to secure 2,000 gas stations with our VM-Series in a deal with a global oil company; a seven figure on premise deal with a global retailer that started with us as an Amazon Marketplace customer; and an expansion deal with one of the world's largest insurance companies to implement GlobalProtect cloud service to secure hundreds of branch offices and tens of thousands of mobile users.

We continue to see customers adopt and expand the usage of our platform at rapid rates. The world is undergoing a digital transformation that is driving massive productivity gains. However, this digital transformation is also creating significant cyber risk that requires a corresponding security transformation. At Palo Alto Networks, we have been consistently delivering on the transformation of security through increasingly rapid technical evolutions that build on each other, reinforce each other, share the attributes of automation, leverage, consistency, and ease of use, and get more powerful and valuable due to ecosystem growth. A decade ago, we introduced the first evolution in security with the creation of the next-generation firewall and cloud-delivered network security services designed to improve security outcomes through integration and automation.

And we continue to innovate on the foundational elements of the first evolution most recently with last week's announcement of PAN-OS 8.1, the PA-3200 series with three models, the PA-5280, the ruggedized PA-220R, and two new models of M-Series management appliances. Our new 8.1 software adds over 50 new features to our next-generation firewall, including more granular control of SaaS applications, expanded SSL decryption capabilities, making it easier to secure encrypted traffic, many features to simplify the adoption of security best practices, and much more. In addition, the new hardware appliances increase SSL decryption throughput, bring higher performance and capacity for securing large data centers, and provide additional stability for managing large firewall deployments. We are very excited by these recent announcements that complement the hardware and software we introduced last year and further expand our technology leadership.

Building on the first evolution, five years ago we drove the second evolution, which is extending the capabilities of our platform to consistently secure customers' data no matter where it resides, from the network to the endpoint and throughout the cloud and SaaS applications. In Q2 we continued to innovate in the second evolution. We enhanced our partnership with AWS, where we are now the only security vendor to have achieved AWS Networking Competency Status, which recognizes that we provide proven technology and deep expertise in helping customers adopt, develop, and deploy networks on AWS. This complements the AWS Security Competency we achieved in 2016.

And just a few weeks ago, we hosted a global cloud security event for over 15,000 attendees where we announced additional second evolution advancements, including Traps for Linux, provided insights into how customers can accelerate their move to the cloud, featured our cloud partnerships, and announced new cloud capabilities. These include enhanced features for Azure and AWS environments, simplified and centralized management for all major cloud platforms, automated integrations for frictionless workflows in multi-cloud environments, and extending protection to the Google Cloud Platform. The announcements were very well-received by our customers and further establish our leadership position in endpoint and cloud security.

These first two evolutions are the building blocks required to make the third evolution in security, the Application Framework, a reality. Customer reaction has been very enthusiastic as they see the superior security and agility that can be achieved by using innovative security applications that leverage the data from their existing Palo Alto Networks platform deployments and provide increasing value from their investments with Palo Alto Networks. We will develop some of these applications ourselves, while others will be built by third parties.

Earlier this month, we introduced our newest application, Magnifier, in the Application Framework. Tightly integrated with our Next-General Security Platform and our Logging Service, this cloud-based behavioral analytics application which we acquired in LightCyber, enables highly accurate attack detection powered by scalable, cloud-based machine learnings. We're very excited about the Application Framework and look forward to the availability of the Framework's third-party applications in the coming months.

These evolutions have resulted in a large and quickly growing global ecosystem of customers leveraging the automation, orchestration, consistency, and ease of use achieved through our platform. Of our approximately 48,000 customers globally, approximately 42,000 are using Threat Prevention, approximately 35,000 are using URL Filtering, approximately 23,000 are using Wildfire, and approximately 7,000 are using GlobalProtect.

And our endpoint and cloud offerings are also experiencing significant growth and adoption. More than 2,200 customers are using Traps, with over 3 million endpoints under protection, while approximately 5,000 customers are using our cloud offerings, including over a dozen who have already adopted our new GlobalProtect cloud service, which delivers our next-generation security capabilities from the cloud. Endpoint and cloud, together with our Application Framework offerings of AutoFocus, Magnifier, and Logging Service, are growing very quickly with a Q2 billings exit run rate of approximately $240 million, growing over 85% year-over-year, and we're very excited about the future of these offerings.

With digital transformation, the threat landscape will constantly evolve, which is why security transformation is critical. We will continue to focus on delivering technology evolutions that push the boundaries of today's capabilities and lead the way to the security paradigm of the future. I want to thank our employees for their relentless dedication to our customers, our partners for their continued support, and our customers for placing their trust in Palo Alto Networks. And with that, I'll turn the call over to Kathy.

Kathy Bonanno -- Chief Financial Officer

Thanks, Mark. Before I start, I'd like to note that except for revenue and billings figures, all financial figures are non-GAAP and growth rates are compared to the prior year period unless stated otherwise.

I'm very pleased with our second quarter execution as we continue to add new customers at a rapid pace while also driving robust expansion business. We are seeing a high degree of interest across our platform which further extends our leadership position with the consistent result of us growing faster than our competitors at scale. In addition to market-leading growth, in Q2 we again extended non-GAAP operating margins, delivered record non-GAAP EPS, and generated strong cash flow. In Q2, total revenue grew 28% to a record $542.4 million dollars.

Looking at the geographic growth of Q2 revenue, the Americas grew 26%, EMEA grew 35%, and APAC grew 33%. Q2 product revenue of $202.2 million dollars grew 20% compared to the prior year. Sales of the new hardware, which we launched in fiscal Q3 '17, continued to perform well with both new and existing customers. Q2 SaaS-based subscription revenue of $183.3 million increased 36%. Support revenue of $156.9 million increased 31%. In total, subscription and support revenue of $340.2 million increased 34% and accounted for a 64% share of total revenue.

Turning to billings, Q2 total billings of $674.6 million increased 20%. The dollar weighted contract duration for new subscription and support billings for the quarter was approximately three years, essentially flat compared to the prior year period. For the first half of fiscal 2018, billings of $1.3 billion increased 18% year-over-year. Product billings were $387.2 million, up 16%, and accounted for 30% of total billings. Subscription billings were $492.6 million, up 24%. Support billings were $391.3 million, up 12%. Renewal rates for our SaaS subscription business are strong, at more than 90%, while renewal rates for support are approximately 100%. Total deferred revenue at the end of Q2 was $2 billion and increased 33%.

Q2 gross margin was 75.9%, which was down 270 basis points compared to last year. The decline was primarily attributable to the very strong traction we continue to see with the new products introduced in the third quarter of last fiscal year.

Q2 operating expenses were $300.1 million, or 55.4% of revenue, which is a 350 basis point improvement year-over-year, driven primarily by ongoing, increasing leverage in sales and marketing. Operating margin was 20.5%, an increase of 80 basis points. We ended the second quarter with 4,833 employees.

Non-GAAP net income for the second quarter grew 54% to $91.5 million or $0.97 per diluted share. Excluding the impact of the Tax Cuts and Jobs Act, second quarter non-GAAP net income and non-GAAP earnings per diluted share were $80.9 million and $0.86, respectively. The Act lowered our Q2 non-GAAP effective tax rate to 22% from the previously guided rate of 31%. On a GAAP basis for the second quarter, net loss decreased 42% to $34.9 million, or $0.38 per basic and dilute share.

Turning to cash flows and balance sheet items, we finished January with cash, cash equivalents, and investments of $2.4 billion. During the second quarter, we repurchased approximately 863,000 shares of common stock at an average price of approximately $145.00 per share, leaving a balance of approximately $300 million available for ongoing repurchases through December 2018.

Turning to cash flow, Q2 cash flow from operations of $243.7 million increased 14%. Capital expenditures in the quarter were $25.6 million. Free cash flow was $218.1 million, up 29% at a margin of 40.2%. DSO was 59 days, a decline of 19 days from the prior year period.

Turning now to guidance and modeling points. Please remember this guidance takes into account the type of forward-looking information that Kelsey referred to earlier. Our fiscal third quarter and fiscal year 2018 guidance includes the company's updated non-GAAP effective tax rate under the Tax Cuts and Jobs Act. The updated non-GAAP effective tax rate of 22% is a reduction from our previously guided non-GAAP effective tax rate of 31%. For fiscal Q3 '18, we expect revenue to be in the range of $538 million to $548 million, an increase of 25% to 27% year-over-year, products revenue to be in the range of $193 million to $196 million, an increase of 18% to 19% year-over-year, billings to be in the range of $665 million to $680 million, an increase of 22% to 25% year-over-year.

Using the updated non-GAAP effective tax rate of 22%, we expect non-GAAP EPS to be in the range of $0.94 to $0.96 using approximately 94.5 to 96.5 million shares. This EPS range includes a benefit of approximately $0.11 due to the new non-GAAP tax rate. And we expect capital expenditures for fiscal Q3 '18 to be approximately $25 million.

For the full-year fiscal 2018, we are raising our guidance across all metrics and now expect revenue to be in the range of $2.190 billion to $2.220 billion, representing growth of 24% to 26% year-over-year, product revenues to be in the range of $810 million to $820 million, representing growth of 14% to 16% year-over-year, billings to be in the range of $2.715 billion to $2.770 billion, representing growth of 18% to 21% year-over-year. We also expect a full-year, weighted average non-GAAP effective tax rate of approximately 24%, which includes fiscal Q1 at the prior tax rate of 31% and the remainder of the year at the revised lower tax rate of 22%.

Using this updated tax rate, we expect non-GAAP EPS to be in the range of $3.84 to $3.91 using 94 to 96 million shares. This EPS guidance includes a benefit of approximately $0.36 from our new full-year non-GAAP tax rate. And we continue to expect capital expenditures to be approximately $100 million.

Before I conclude, I'd like to provide some additional modeling points for the fiscal year. We continue to expect fiscal Q2 and fiscal Q4 to have the strongest sequential total revenue growth. As reflected in consensus heading into this call, our non-GAAP EPS guidance continues to include approximately 150 basis points of organic operating margin expansion, excluding first half investments associated with the LightCyber acquisition. Our fiscal Q4 non-GAAP effective tax rate will be 22%. And we expect fiscal year free cash flow margin to be in the range of 39% to 40%.

Before we turn the call over to the operator for questions, I'm happy to announce that Jean Compeau, formerly Senior Vice President, Accounting and Corporate Controller, has been appointed Chief Accounting Officer with ongoing responsibility for accounting and tax functions. Jean, who joined us in 2012, has 20 years' business experience, having held senior accounting or corporate controller positions at various technology companies. Congratulations, Jean.

Operator, please poll for questions.

Questions and Answers:

Operator

Thank you. If you would like to ask a question, please signal by pressing "*1" on your telephone keypad. If you're using a speakerphone, please make sure your mute function is turned off to allow your signal to reach out equipment. Again, press "*1" to ask a question. In the interest of time, please allow yourself one question and one follow-up per turn, then reenter the queue, and we will take as many questions as time permits. Pause for one moment to allow everyone an opportunity to signal. That's "*1". And we'll take our first question from Andrew Nowinski with Piper Jaffray.

Andrew Nowinski -- Piper Jaffray -- Analyst

Alright. Great. Thanks for a nice quarter and thanks for taking the question. I guess I want to ask about PAN-OS 8.1. You talked about some of the new SSL encryption capabilities in that platform. Are your customers seeing an increase in encrypted traffic coming into the data centers and are the new features that address this problem a free upgrade for customers or could that essentially drive a refresh cycle?

Mark McLaughlin -- Chairman and Chief Executive Officer

Andy, it's Mark. Good question. Yeah, we're seeing across the board an increase in encrypted traffic. That's been the case for quite some time actually. It's not uncommon for us to see in a customer environment north of 35%, 40% of all traffic being encrypted these days, simply because the bad guys know that the legacy technology is not going to be able to decrypt it or, if it can, it can't do it fast enough to have traffic continue to be, in essence, the real-time aspect it has to be. So we've been continuously trying to improve the capabilities there. Every release we've done has improved SSL decryption throughput. The release of the new hardware has about 20 times the performance, which is fantastic, and the 8.1 software also has capabilities in it as well to help with throughput and performance.

As you know, I think for our operating system, we don't charge extra for that. So those are features and functionality that go into the software to just make us better and better and better over time so we hopefully continually be sticky. And then the last point of the question, as far as upgrades and refresh capabilities, yeah, anything that has an opportunity for us to speak with customers about new use cases is a great opportunity as well for refresh and upgrade and expansion.

Andrew Nowinski -- Piper Jaffray -- Analyst

Okay, thanks. And then maybe just as a quick follow-up. I see you launched another service as part of the Application Framework. Can you just give us an update on the progress the third-parties have made regarding the development of applications that could start to contribute revenue to your Framework?

Mark McLaughlin -- Chairman and Chief Executive Officer

Yeah, sure. And just briefly, the one we launched is called Magnifier. That came to us through the LightCyber acquisition last year so we're super happy to see that go live. Basically LightCyber has a fantastic behavior analytics capability. It formerly would be something that you would have to plug in as another piece of hardware somewhere in your environment. So we've taken the algorithm out and made it be an application so it's a SaaS application in the Application Framework. And that's the theory behind the Application Framework in a lot of cases. Third-party-wise, we're working with about 30 companies right now to get their applications live and we expect that to happen in the coming months here. We're excited about that and stay tuned as we progress through the spring and you'll hear more about that.

Operator

Our next question will go to Michael Turits with Raymond James.

Michael Turits -- Raymond James -- Analyst

Hey, guys. Really strong quarter and again a really strong quarter on products. Last quarter you talked about some of the things that really drove hardware and product. Can you drill down a little bit on that this quarter and especially the extent to which some of that may be coming from a product refresh cycle?

Mark McLaughlin -- Chairman and Chief Executive Officer

Yeah, Michael. We had a good quarter across the board on the entire platform so we're really pleased to see the market coming to the platform for all three of the evolutions that we had driven and obviously product is performing very well indeed. So we're super happy to see that. As we said coming into the year, on the refresh side, that's a net positive for the company. We expect that to continue to be the case but it wouldn't be the primary driver for hardware in the year and that is still the case. So we're seeing the over performance being driven from new customer acquisition you can see is really high and expansion business as well. Refresh is going very well, by the way, but it's still not the major driver for the business. So we think that that's something that is in front of us which would be great.

Michael Turits -- Raymond James -- Analyst

Let's follow up and maybe just more drill down. I think that service provider was really strong. High-end chasses were strong last quarter. Did that continue and was that a material part of the upside this time?

Mark McLaughlin -- Chairman and Chief Executive Officer

Yeah, our service provider business is doing very well for us. Last quarter, we had said that on the hardware side, we had seen some over performance on hardware dollars associated specifically with what's called NPC cards. So those are slot cards you put into the chasse and we saw more than usual. This quarter was nothing unique in that regard so back to kind of normal run rates we see on that. So that's what we had talked about last quarter for some of the hardware performance. But the service provider business in general is doing well for us and continuing to grow. We expect that to keep going. As we said, every time we do a release, whether it's hardware or software, we've been adding more features and functionality to make this continually more attractive for service providers.

Operator

We'll take our next question from Matt Hedberg with RBC Capital Markets.

Matt Hedberg -- RBC Capital Markets -- Analyst

Hey, guys, thanks for taking my questions and congrats from me as well. Maybe for Mark, the product refresh seems to be moving along nicely and clearly you called out growth in SaaS and some of the emerging products was strong there. I'm curious if you could drill down a little bit on pricing, both within kind of core firewall but also some of the newer products that are seeing quite a bit of growth.

Mark McLaughlin -- Chairman and Chief Executive Officer

Yeah, that's a great question, Matt. We are absolutely selling the value proposition of the entire platform which has all the three evolutions put into it: automation, orchestration, and consistency. And now an entirely new consumption model with the Application Framework. And I mention that because that allows us, from a pricing perspective, to be on the one hand very competitive but also on the other hand to be able to not have to sell to price as many, many of our competitors continue to do. So this example in this quarter that we saw discounting improve again sequentially in year-over-year. We've seen that for a number of quarters now which is fantastic. Our team, I think, has done a great job of selling to the value and selling to the strategic nature of the platform.

Mark McLaughlin -- Chairman and Chief Executive Officer

Great. And then I'm not sure if Mark Anderson is on the call but EMEA looked like it was particularly strong this quarter. A lot of us have been talking about GDPR as a potential driver this year. I'm curious, is that showing up as just dialogue at this point or is this actually driving e real deals, as far as you can tell?

Mark Anderson -- President

Yeah. Hi, Matt. GDPR, I think, or any other phenomena that drives awareness for companies to deliver better security defenses is a good thing for us because it allows us to get in front of people that have budget and show how differentiated we are from our competitors. So I think we've got a good talk track around GDPR and more importantly it's backed up with the supremely better security. In terms of attaching it to deals, I think we've been, I think, considered in Europe the thought leader for security for a couple of years now. And I think more than anything else, just the awareness that customers have about what we can do for them has ramped as we've built out a very nice team and great partner coverage there.

Operator

We'll go now to Greg Moskowitz with Cowen and Company.

Greg Moskowitz -- Cowen and Company -- Analyst

Thank you very much and I'll add my congratulations as well. Mark, more recently we've seen you effectively widen the gap on long-term subscriptions and I'm wondering if you're seeing any changes in the competitive landscape or, in your view, is this just a function of having?

Mark McLaughlin -- Chairman and Chief Executive Officer

Yeah, Greg, you're kind of broken up there. I think the question was competitive differentiation. Is that a summary? It was tough to hear you.

Greg Moskowitz -- Cowen and Company -- Analyst

That's exactly right, Mark. Just a function of the widening gap that we've seen on growth versus your peers. Thanks.

Mark McLaughlin -- Chairman and Chief Executive Officer

Great, OK. Thanks. Yeah. Well, thanks for noticing. Yeah. We continue to perform very well in the market, we think, and we are going at outsized rates relative to the competition. And it's scaled a couple billion dollars in size right now so that's not insignificant. And I think that's due to the fact that the platform approach we've taken is really resonating with customers. A lot of security vendors all sound the same when they talk about automation and integration and vendor reduction, things along those lines.

But what we found, and we found it to be a competitive advantage for us, is the architecture really matters. So we can sit with customers and say this is how we've done it over time. We have a very high degree of confidence because we primarily built most of it ourselves and it actually works together. It does drive that automation, it does drive that orchestration, and increasingly at scale, you can see the consistency from network to cloud and endpoints as well. It's really resonating with the customers and I think that's showing through with the results.

Mark Anderson -- President

If I could just add, I think comparing the vast amount of innovation that our engineering team has cranked out in the last year. If you just think about the new products, new services, new capabilities, the new features in the two new versions of operating systems that have come out, it really does separate us from anybody else.

Greg Moskowitz -- Cowen and Company -- Analyst

Okay, terrific. And then for my follow-up, I'm curious, since older appliances like the PA-2000 and PA-4000 can't run on PAN-OS 8.1, is that driving some incremental refresh at this point or do you think that it will going forward?

Mark McLaughlin -- Chairman and Chief Executive Officer

Doesn't appear to be the case now. And I think any time we have more or definitely newer operating systems or new hardware, that gives a great reason to talk to customers and hopefully get them to upgrade things. So along the lines but those two things particularly I wouldn't call that yet.

Operator

We'll go next to Sterling Auty with JP Morgan.

Sterling Auty -- JP Morgan -- Analyst

Yeah, thanks. Hi, guys. Looking at I think it's the billings for subscription and support that grew 24%. I'm just curious, any FX or duration type of impact that would have prevented that from growing even faster when you look at the first half over first half?

Mark McLaughlin -- Chairman and Chief Executive Officer

Sterling, no. There's very minimal FX inside of here and we price in U.S. dollars. And then on the duration side, duration has been very steady, at about three years, for quite some time now.

Sterling Auty -- JP Morgan -- Analyst

Okay. And then the one follow-up, I think you called out the endpoint plus cloud bookings run rate at around $240 million. I think at the Analyst Day, you talked about a $140 million run rate. Can you kind of compare and contrast? What was the time frame for the $140 million and is this just seeing a lot more customers moving into production and just buying a lot more expansion that's driving that growth?

Mark McLaughlin -- Chairman and Chief Executive Officer

Yeah, sure. So at the Analyst Day, we had talked about a $140 million run rate. That was the Q4 billings run rate. And today we gave you the Q2 billings run rate. So you're trying to the apples along that. You can see it's growing very nicely and starting to contribute pretty well. It's close to getting to be like 9% through 10% of total billings contribution overall which is great. And also considering, if you stripped it out, that other portion's growing close to 20% in size of billings as well at 9 times bigger. So, yeah, I think the whole platform is selling very well.

And as far as what's driving the non-attached, one, the capabilities are very good in and of themselves and I think customers are increasingly realizing the value of the consistency aspect of being able to have the same security outcomes in network, cloud, endpoint. And then just to make that even better, we put the Application Framework on top of it and said, for all those things that you're deploying from Palo Alto Networks so you can get consistency, we're going to drive even more value over the top for every dollar you spend with us down there.

Kathy Bonanno -- Chief Financial Officer

And just a point of clarification, the $140 million was for our cloud and endpoint, which we broke out separately in our Analyst Day presentation. And the number that we provided today included AutoFocus, which was a separate category at Analyst Day.

Mark McLaughlin -- Chairman and Chief Executive Officer

Which was what? Do you have it?

Kathy Bonanno -- Chief Financial Officer

Yeah, 50. Sorry. I'm sorry. $15 million.

Mark McLaughlin -- Chairman and Chief Executive Officer

Yeah, $15 million growing at 90%. Right? So if you add those together, Sterling, so we had $140 million plus $15 million at AutoFocus, $155 million a blended mix of somewhere between 85% and 90% and now we've put those together into $240 million growing at over 85%.

Kathy Bonanno -- Chief Financial Officer

There you go.

Sterling Auty -- JP Morgan -- Analyst

Alright. Perfect. Thank you.

Operator

We'll take our next question from Catharine Trebnick with Dougherty.

Catharine Trebnick -- Dougherty & Company -- Analyst

Thanks for taking my question. Excellent quarter. Could you dig a little bit more into the cloud and how differentiated you are from your competitors? It seems to me that's an area that you continue to widen the gap on. And particularly what are the cylinders or products or services that are driving and widening that gap? Thank you.

Mark McLaughlin -- Chairman and Chief Executive Officer

Sure. Thanks, Catharine. We've been at cloud security now for over five years in the second evolution, which I talked a little bit about in the script, which is making sure we have that consistency. So when we're talking about cloud security, there's a number of aspects inside of there about delivering security from the cloud, using cloud as a third-party infrastructure as well and making sure that we can secure that for folks, and also making sure that we can provide this same seamless security in third-party SaaS applications as well. If you kind of think about the approach we've taken, we've been very native with the third-party providers, like AWS and Azure. Now you may have noticed we just announced support for the Google Cloud Platform, which I had talked about in the script as well. So we have all the major platforms covered.

And inside all those platforms, we've taken a very native approach to not only protect, I'll call it the "networking aspects" of that, with the VM-Series but also protecting the host. We just announced Traps for Linux which is very important in cloud environments and then also on an API basis with aperture for both SaaS and public run as well. So increasing things like visibility, compliance, and storage security. So we're making a lot of progress with that. You may have also heard me talk about, in addition, having security competency with AWS. We're the only security vendor to get networking competency as well. Which is kind of interesting because when some security vendors try to go to the cloud, they want to just virtualize something and take it into the cloud as opposed to working very natively with the cloud providers and really using their tools and capabilities as well so that we can do lots of creative things along with them, like auto scaling and load balancing that really take advantage of their network capabilities as well.

So lots and lots going on there. We think the cloud is super important. Customers are talking about the cloud for sure. Some of them are moving rapidly in that direction. And we're absolutely in front of all that, we believe, with the customer base and increasingly thought of as thought leaders there and also the technology leaders as well.

Mark Anderson -- President

And I just had one thing there, Catharine. It's Mark A. here. The go-to-market relationships that we have with all three of these large public cloud vendors is really strong. They're becoming very important distribution partners for us.

Catharine Trebnick -- Dougherty & Company -- Analyst

Alright. Thanks, guys.

Operator

We'll take our next question from Ken Talanian with Evercore ISI.

Ken Talanian -- Evercore ISI -- Analyst

Hey, guys, thanks for taking the question. I wanted to go back on product. I was wondering if you could actually rank order these drivers of product growth in the quarter and how, if at all, you expect that to change in the back half of the year?

Mark McLaughlin -- Chairman and Chief Executive Officer

Sure. I don't think it's gonna change much in the back half of the year, Ken. This is Mark, by the way. There's really three drivers in there and I'd order them this direction. The first is expansion opportunities in the customer base. That's simply a magnitude statement when you have as large a customer base as we have and they continue to buy from us along the way for their needs and use cases. That's gonna drive a lot of business. Then we have new customer acquisition as well. You can see we just put up close to another 3,000 net customers so that's very helpful as well. And then the third is the refresh opportunity which continues to grow over time. And, of course, adding more customers helps that in the long term. I don't see that changing the rest of the fiscal year there.

Ken Talanian -- Evercore ISI -- Analyst

Okay, great. And as a follow-up, you have another hardware release out there. I was wondering if you could tell us when gross margin might normalize.

Mark McLaughlin -- Chairman and Chief Executive Officer

Yeah, that's a great question. So on product gross margin side, there's really two dynamics at play here. So we have the product gross margins on the new hardware itself and then we have the mix of the new hardware in the total hardware mix. So the product gross margin declines we've seen for the last few quarters is due to the mix increase of the new hardware. So let me break that down for just a second for you. So when we launch the new products last year, we're gonna naturally start off with lower margins on them and then they're gonna improve over time. We've seen along the way higher memory and component costs, but even with that dynamic in play, we've continued to have modest improvements each quarter since we released the hardware. And we expect that's gonna continue.

But at the same time, that's kind of being offset with the mix of all the hardware that we're selling having more and more new hardware in it as well. So the mix will drag down the product gross margins along the way. So we're sitting here at the mid-year with an increased product guide, another great set of new hardware we just put out in the market last week, and some headwinds on component pricing, so we're expecting that we're gonna see the same, this mix dynamic, to continue throughout the end of the year. But we expect the total gross margin to be basically in the zip code where we are today. And then, of course, as you can see, we're continuing to manage the business so we can get continued operating leverage.

Ken Talanian -- Evercore ISI -- Analyst

Okay, great. Thanks very much.

Mark McLaughlin -- Chairman and Chief Executive Officer

Thanks, Ken.

Operator

We'll go next to John DiFucci with Jefferies.

John DiFucci -- Jefferies -- Analyst

Thank you. You can add a lot people too. No problem. Kathy, I wanted to ask you a question on the numbers but the numbers are really clean and they look really good. So maybe over to Mark. Mark, these new products that you just came out with over the last, I guess, week or two, do you see these -- I just want to make sure because we try to model this. Do you see these more as evolutions or upgrades to existing products or are these brand new offerings that sort of fill some holes in your current portfolio along the range of firewalls?

Mark McLaughlin -- Chairman and Chief Executive Officer

Yeah, I think of it kind of both ways, John. So as we've said in the past, the way we think about customers is customers are gonna have various use cases that you're trying to solve for over time. And then these use cases have different price performance requirements if you want to be competitive in the market. Right? So if I laid out all the hardware capabilities and counter VM-Series, I should throw in there as well, if I laid them out on the table here, you'd kind of get left-to-right smaller form factors and throughput all the way up to the really big ones. And then what we've been doing is filling it in every year along the way of putting more and more capabilities in there or form factors in there at the right price performance or the use cases. And that, of course, then makes us more competitive so that competitors can't come in over top or underneath us from a pricing perspective for throughput.

So that's what we would expect to continue to do into the future, just make sure that we're always solving for that. Just don't stand still. The SSL decryption needs, for example, as those go up over time, that's gonna drive up throughputs. We want to make sure that we've got the right throughput capabilities there.

John DiFucci -- Jefferies -- Analyst

Okay. Thanks. And if I could, I know you gave some billings metrics but when we take a look at this and we kind of try to back in to new product, excluding refresh, and new subscriptions, excluding renewals, the new product numbers look stronger than the new subscriptions. First of all, I guess, is that right directionally? If you're seeing some benefit from product refresh, that would be one cause of that, but just is that what's happening here?

Mark McLaughlin -- Chairman and Chief Executive Officer

Well, I'm not sure exactly what the question is. Let me try to answer what I think it is though. But when customers are purchasing from us or starting out with us on purchases, if you look at the lifetime value creation over time, it takes time to get maximum lifetime value creation, which by the way, is not standing still. Right? So when you go into the mix of what our customers are buying from us over time, with hardware, services that would attach, non-attached services, and then they're gonna lap over, they're gonna renew their support, they renew subscriptions, there's a good chance of selling more stuff, the lifetime value, I think, naturally rose over time with that customer.

Operator

We'll take our next question from Rob Owens with KeyBanc Capital Markets.

Rob Owens -- KeyBanc Capital Markets -- Analyst

Great. Good afternoon, everyone. I was curious on Traps and some of the big wins that you saw. Are you exclusive to the endpoint at that point? Are you complementary to someone else? And in those bake offs, who are you seeing typically?

Mark McLaughlin -- Chairman and Chief Executive Officer

Hey, Rob, it's Mark. I'll take those in reverse. As far as who we see, we see everybody. Primarily we're gonna see the legacy incumbent folks in there who are providing AV protection and we're doing our best and doing a good job of taking them out. And then we see a lot of next-gen folks in there as well, next-gen import providers who are also trying to do the same thing.

And your first question, it's a mix. Sometimes we get to be the only provider when we're done. Other times we may be run as a complement. Or sometimes you have to think of endpoints as suites as well. So there's also capabilities in endpoints that we don't have full-on PLP capabilities, for example, so that we continue to run different endpoint providers but not specifically for the security functions we provide.

Rob Owens -- KeyBanc Capital Markets -- Analyst

And second, you mentioned that when you get your subscription support upfront, it's typically three years. What does it look like on a renewal?

Mark McLaughlin -- Chairman and Chief Executive Officer

Renewal's been very consistent for quite some time. A steady range. It's not really changed. So it's been pretty consistent. The overall renewals, as you heard us say, are about three years.

Rob Owens -- KeyBanc Capital Markets -- Analyst

That's three years as well. Okay. Thank you.

Mark McLaughlin -- Chairman and Chief Executive Officer

I'm sorry, Rob, just to be clear. The overall duration is about three years and inside of that, for renewal durations, those have been in a steady range for quite some time inside of that number.

Rob Owens -- KeyBanc Capital Markets -- Analyst

Okay.

Mark McLaughlin -- Chairman and Chief Executive Officer

Just want to clarify.

Operator

We'll take our next question from Fatima Boolani with UBS.

Fatima Boolani -- UBS -- Analyst

Good afternoon. Thank you for taking my question. Mark, a question for you. You spoke about the first ruggedized appliance in your portfolio that was out last week and I'm wondering how you think about this broader opportunity around protection of critical and industrial control systems. And maybe your perspective on why this particular area has kind of been habitually underinvested in. And a follow-up for Kathy.

Mark McLaughlin -- Chairman and Chief Executive Officer

Sure, great. Yeah. So the questions really on the PA-220R, which is the ruggedized version of our PA-220, which is a great opportunity for us. A lot of our customers which are in environments where you would consider these not just IT capabilities but OT capabilities, ICS skate environments, harsh environments where the line is blurring between IT and OT, they want to have the same capabilities that Palo Alto Networks provides but they want them in those harsh environments. We've had a number of folks ask us, "Would you ruggedize the 220?" Because it's a form factor for oil rigs, for example, in different places. It might be utility substations and things along those lines.

So they actually have been doing that kind of themselves with different contract manufacturers to ruggedize our equipment for us. So we said, "Well, we can do that." So that was the impetus to launch the PA-220R. Now what that does for us is, with customers who already like our capabilities, it gives us a whole new outlook of where to install this hardware because it can now go in to those environments that require those ruggedized capabilities.

Kathy, I'll let you take whatever the next part is.

Fatima Boolani -- UBS -- Analyst

Thank you. That's very helpful. Kathy, as the portfolio expands and begins supporting more cloud-delivered services, like GlobalProtect, what are the implications for your CAPEX profile and how are you thinking about that this year and at a qualitative level for next year and the years out?

Kathy Bonanno -- Chief Financial Officer

Yeah. Thanks. We are definitely investing in our Application Framework as we look to deliver more cloud-delivered services. Obviously that requires a bit of infrastructure investment. And so the $100 million CAPEX number that we've provided is full-year guidance and fiscal '18 definitely includes some investments in that infrastructure. And I think we would expect that to be ongoing and continue as we build out the Application Framework.

Mark McLaughlin -- Chairman and Chief Executive Officer

Yeah. And Logging Services as well. So some of the new services that we brought to market require a good amount of infrastructure to back them. Like Logging, for example. That's not inexpensive to do that.

Operator

For our next question, we'll go to Jonathan Ho with William Blair.

Jonathan Ho -- William Blair -- Analyst

Good afternoon and congratulations on the strong results. Just wanted to start out with the sales force. And in terms of the sales execution challenges that you guys saw last year, how should we be thinking about sort of the room for productivity enhancements and maybe where we are in terms of correcting those challenges?

Mark Anderson -- President

Hey, Jonathan, Mark Anderson here. Thanks for the question. So I think on the sales force reorg that we started working about a year ago, I've got to really compliment Dave Franish for doing a terrific job of restructuring and getting the right butts in seats to focus on the right customers and clearly driving the right outcomes. From a productivity standpoint, we're very happy with the productivity improvements that we've seen. We talked about that at Analyst Day and we still see continued improvements there. I think with all the new services and the new products that we have, we've got more arrows in the quiver for the sales reps and SEs out there and I think we're optimistic in being able to see improvements there.

Mark McLaughlin -- Chairman and Chief Executive Officer

Yeah, we are expecting in our guide we gave for the second half of the year as well that there would be continued productivity improvements.

Jonathan Ho -- William Blair -- Analyst

Got it. And then as we look at sort of the tax rate reduction as well as the strong balance sheet that you have, how should we think about use of capital going forward?

Mark McLaughlin -- Chairman and Chief Executive Officer

Yeah. We take a very traditional approach to that, Jonathan, and really looking at three possible uses of capital. The first and most important in our opinion would be invest back in the business, assuming we can get the right rate of returns on that. And we invest very nicely in the business as you can see and while it's continuing to drive leverage and capturing market share along the way to do that. So we feel like that's working out for us.

The second priority would be if we see technology capabilities in the market that we like that we think could help accelerate the evolutions that we've been driving for some time. We've demonstrated the ability to go to market and do some M&A to do that and that could be the case in the future for us.

And then the third is, if we are not doing the first two, we've also demonstrated the ability to return value to the shareholders, primarily through stock repurchases, while maintaining a good, healthy balance sheet for any opportunities.

Operator

We'll go next to Anne Meisner with Susquehanna.

Anne Meisner -- Susquehanna International Group -- Analyst

Hi. Thanks for taking my question. At Analyst Day, you talked about leveraging AI tools along with your customer data to better implement some customer targeting programs. Can you give us an update on that and what sort of strategies have resulted from that initiative? And then in particular, as it relates to the refresh cycle, whether you think it's helping you optimize that opportunity?

Mark McLaughlin -- Chairman and Chief Executive Officer

Yeah, that's a great question. And really appreciate the fact that you took note of that at Analyst Day because we're really a data-driven company here. So lots of mathematicians running around, including in the marketing department as well as our CIO organization, who are using and harnessing this same kind of AI and machine learning capabilities you're seeing coming through in our products. So a number of the things that we've talked about at Analyst Day that are tools for our sales team to use, like things called Quota Crusher, for example, and the Deal Doctor, those are using AI capabilities to tell us our sales reps what is the next thing you should do with this customer or recommend, for example. Or if you want to maximize your earnings, this is how to do that.

And those are being very heavily used by our team as well as our partners to better and better effect. So as we continue to train those tools, they get better. So going back to the last question that just came up in productivity, we definitely put some of the productivity growth that we're seeing from the sales team in this bucket, which is giving them fantastic tools to use in order to grow their productivity.

Anne Meisner -- Susquehanna International Group -- Analyst

Perfect. Thank you. Nice quarter.

Mark McLaughlin -- Chairman and Chief Executive Officer

Thanks, Anne.

Operator

We'll go next to Saket Kalia with Barclays.

Saket Kalia -- Barclays -- Analyst

Hey, guys, thanks for taking my questions here. First, maybe for you, Kathy, just a quick accounting question on product. Could you just talk about how the accounting for VM-Series works? Meaning could we see any carve out of VM-Series in the product line as that business gets bigger or perhaps as accounting rules change? Just any color on how VM-Series could or could not impact the product line down the road.

Kathy Bonanno -- Chief Financial Officer

Well, the VM-Series really should not change the categorization of where we put revenue one way or the other.

Mark McLaughlin -- Chairman and Chief Executive Officer

Yeah, you may have heard us in the past, we talked about VM-Series historically a long time ahead, like the two flavors are perpetual. Right? And a non-perpetual. And the perpetual piece would go into product. That's pretty much gone. It's just almost nothing there. So every time you hear us talk about VM-Series, it's gonna go into a ratable line for us.

Saket Kalia -- Barclays -- Analyst

Got it. That's super helpful. Maybe a follow-up for you, Mark. Kind of a follow-up from last quarter actually but can you just talk about how the Application Framework is changing conversations with customers. And maybe tying it to this quarter, whether the Application Framework is actually helping the core network security business at all.

Mark McLaughlin -- Chairman and Chief Executive Officer

Yeah. I think it's definitely helping the overall business across the board. And as far as the conversation with customers, 100% of the time, and I'm not exaggerating on that, I've briefed hundreds and hundreds of customers, as Mark has as well, we hear the same thing, which is them saying, "We had this seemingly insurmountable challenge, which is how do we harness new innovation which we know has to come, we know no one company can do it, but we can't operationalize it because we can't run one more thing. So this Application Framework sounds like you figured out how to solve this problem substantially for us so we hope that you get this right." And that's very consistent.

Now, this afternoon, we're trying to sell something this afternoon, and it really goes back to the second evolution on consistency, which we're doing a great job at for each of the capabilities. The consistency of security. And now we've just given the customer a really powerful reason, if they're gonna think about us versus that endpoint provider or that firewall provider or that cloud provider, why you go with Palo Alto Networks in order to future-proof your investment. Now they're gonna put the application on top of it. So if I buy their firewall today, their endpoint today, their VM today, their cache capability today, they're gonna continue to bring more innovation to that purchase and make that purchase more valuable for me for every dollar I spend with them when I deploy them that way. So it's been very, very positive. I think that's really helping us in the markets.

Saket Kalia -- Barclays -- Analyst

That's great. Thanks, guys.

Mark McLaughlin -- Chairman and Chief Executive Officer

Thanks, Saket.

Operator

We'll take our next question from Keith Weiss with Morgan Stanley.

Melissa Franchi -- Morgan Stanley -- Analyst

Thank you, this is Melissa Franchi calling in for Keith. Thanks for taking my question. Mark, I'm just wondering if you're seeing any change in customer behavior around refresh and I'm mostly interested if you're seeing any customers that are opting to instead deploy a VM-Series instance versus a physical deployment and what would be the use cases around that?

Mark McLaughlin -- Chairman and Chief Executive Officer

We've seen everything go in many directions, Melissa. We kind of see the cloud side of the business growing, VM-Series, our hardware side is growing as well. But back to this consistency thing, if we get a chance to do something for a customer, they more often than not are gonna use us in the environment everywhere.

So we gave an example on the call I thought was kind of interesting about a customer who was a large company, new to us as a customer, never bought anything. First thing they bought was in the AWS marketplace for VM-Series. And then over time, after we saw them there, we contacted them and said, "How are you doing?" It's a lead gen for us. And we just closed a seven figure deal with them on-prem. Right? Because people are living in these hybrid worlds and hybrid environments. You can kind of see it going in VM to physical, physical to VM, people are gonna operate in these hybrid environments for quite some time we think and it's beneficial for us.

Melissa Franchi -- Morgan Stanley -- Analyst

Okay. Thanks. And just one quick follow-up for Kathy. It was helpful to see the tax guidance for the fiscal '18. I'm just wondering if you could put some color around what we should think the impact to cash taxes, because as far as I understand, you still have some NOLs.

Kathy Bonanno -- Chief Financial Officer

Yeah, that's right. We do have NOLs and we don't expect to be a cash taxpayer or a significant cash taxpayer for the next four years or so. We mentioned at Analyst Day that we expect to pay about $10 million to $25 million per year over the next four-ish years and that doesn't change with the new tax law because of the NOLs essentially.

Melissa Franchi -- Morgan Stanley -- Analyst

Got it. Alright. Thank you.

Mark McLaughlin -- Chairman and Chief Executive Officer

Thanks, Melissa.

Operator

We'll go next to Philip Winslow with Wells Fargo.

Philip Winslow -- Wells Fargo -- Analyst

Hi. Thanks, guys, for taking my questions and congrats again on just an awesome quarter. I have a question on gross margins and most of my other questions have been asked already. But, Mark, you laid out sort of the impact of the newer appliances versus some of the older appliances and the effect on gross margins. But as you sort of look up and down that way, the appliance set, the service provider, large enterprise, branch office, etc., how should I think about the differential in gross margins there? And as you think about what's sort of impacting in your gross margins over the past year as you kind of think about that guidance going forward, how do you think about that mix, call it, between up and down the appliance range?

Mark McLaughlin -- Chairman and Chief Executive Officer

Yeah. I think a better way to think about it, Phil, is not so much the size of things. It's really about what goes into them from a componentry perspective. And there's a mix of components in all these things. Right? They're not all the same across all the devices either. So it's not just about a small thing versus a big thing. Usually, and we definitely see it in this case, newer things will have lower product gross margins than things that are much more mature over time because we continue to drive economies of scale and componentry pricing improves over time, things along those lines. So I think about it that way.

And the mix comment I was making was, as the mix of our hardware goes more to the newer things that we've developed, and you can see we're over performing very nicely on the hardware side, it's a positive for the business, of course. It's got some short-term impacts on the product gross margins because that mix is larger inside there, even though we are continuing to improve the gross margins on those products every single quarter as well.

Philip Winslow -- Wells Fargo -- Analyst

Got it. Thanks, guys. Congrats again.

Mark McLaughlin -- Chairman and Chief Executive Officer

Thanks, Phil.

Operator

That concludes today's question-and-answer session. At this time, I'll turn the conference back to Mr. Mark McLaughlin for any closing remarks.

Mark McLaughlin -- Chairman and Chief Executive Officer

Thanks, operator, appreciate that. I want to thank everybody for your time this afternoon and I know we're gonna see many of you over the coming weeks. We look forward to that. Hope everybody has a great evening and thanks so much for joining us on the call today.

Operator

This does conclude today's conference. Thank you for your participation. You may now disconnect.

Duration: 57 minutes

Call participants:

Kelsey Turcotte -- Vice President of Investor Relations 

Mark McLaughlin -- Chairman and Chief Executive Officer

Kathy Bonanno -- Chief Financial Officer

Mark Anderson -- President

Andrew Nowinski -- Piper Jaffray -- Analyst

Michael Turits -- Raymond James -- Analyst

Matt Hedberg -- RBC Capital Markets -- Analyst

Greg Moskowitz -- Cowen and Company -- Analyst

Sterling Auty -- JP Morgan -- Analyst

Catharine Trebnick -- Dougherty & Company -- Analyst

Ken Talanian -- Evercore ISI -- Analyst

John DiFucci -- Jefferies -- Analyst

Rob Owens -- KeyBanc Capital Markets -- Analyst

Fatima Boolani -- UBS -- Analyst

Jonathan Ho -- William Blair -- Analyst

Anne Meisner -- Susquehanna International Group -- Analyst

Saket Kalia -- Barclays -- Analyst

Melissa Franchi -- Morgan Stanley -- Analyst

Philip Winslow -- Wells Fargo -- Analyst

More PANW analysis

This article is a transcript of this conference call produced for The Motley Fool. While we strive for our Foolish Best, there may be errors, omissions, or inaccuracies in this transcript. As with all our articles, The Motley Fool does not assume any responsibility for your use of this content, and we strongly encourage you to do your own research, including listening to the call yourself and reading the company's SEC filings. Please see our Terms and Conditions for additional details, including our Obligatory Capitalized Disclaimers of Liability.