Image source: The Motley Fool.
Mimecast Limited (MIME)
Q3Â 2020 Earnings Call
Feb 10, 2020, 4:30 p.m. ET
Contents:
- Prepared Remarks
- Questions and Answers
- Call Participants
Prepared Remarks:
Operator
Ladies and gentlemen, thank you for standing by and welcome to the Mimecast Third Quarter 2020 Earnings Conference Call. At this time all participants lines are in a listen-only mode. After the speakers' presentation, there will be a question-and-answer session. [Operator Instructions] I would now like to turn the conference over to your speaker today, Mr. Robert Sanders.
Robert Sanders -- Director, Investor Relations
Good evening and welcome to Mimecast's earnings call for the fiscal third quarter of 2020 ended December 31st, 2019. I'm Robert Sanders, Director of Investor Relations. With me on the call tonight are Peter Bauer, our Co-Founder, Chairman and CEO; and Rafe Brown, our CFO. Tonight's conference call is being broadcast live. A replay of this call will be available after the live call has ended. Tonight, we will make forward-looking statements regarding future events and the future financial performance of the company. These forward-looking statements are subject to risks and uncertainties that could cause actual results to differ materially from those in the forward-looking statements. We caution you to consider the important risk factors that could cause results to differ from those in the forward-looking statements contained in today's press release and on this conference call. These risk factors are further defined in Mimecast's most recent Form 10-Q filed with the Securities and Exchange Commission.
During this call, we will present both GAAP and non-GAAP financial measures. These non-GAAP measures are not intended to be considered in isolation from, a substitute for or superior to our GAAP results. A reconciliation of GAAP to non-GAAP measures and the reasons for our representation of the non-GAAP information is included in today's press release, which can be found in the Investor Relations section of our website. The date of this call is February 10th, 2020. Any forward-looking statements we make today are based on assumptions that we believe to be reasonable as of this date. We undertake no obligation to update these statements as a result of new information or future events. Finally, I'd like to remind you that we are having a Financial Analyst and Investor Day on the 24th of this month in San Francisco, California and invite you to join us. Now, I would like to turn the call over to Peter Bauer. Peter? Good evening and thank you for joining our earnings call for the third quarter of fiscal 2020. On tonight's call, I'll begin with an overview of our achievements this quarter and next, I'll discuss our Email Security 3.0 strategy and how our recent acquisitions of DMARC Analyzer and Segasec support that framework. I'll talk about our ongoing success with Microsoft Office 365 and then I'll discuss the growth of our API integrations and how these partnerships are benefiting our customers. And finally, I'll share some examples of solutions Mimecast has delivered in our third quarter and why our integrated offerings were preferred over competitors. Turning to the third quarter, we are delighted to once again be sharing with you results that exceed our guidance. Revenue of $110.2 million, grew 26% year-over-year as reported and 27% in constant currency. This performance was the result of world-class customer retention, sales of additional services to our base of subscribers, and the addition of 800 net new customers to our platform. The larger comp segment was notable for several high profile wins against leading competitors and these wins are elevating Mimecast's brand among enterprise customers and building further confidence in our technology and organization. This success upmarket continues to be validated by leading research and advisory providers as Mimecast was named a leader in the Gartner Magic Quadrant for Enterprise Information Archiving for the fifth year in a row. Partners also recognize our improving market position and the opportunities available to them in partnership with us. For example, CDW named Mimecast their Silver Partner of the Year for 2019. During the third quarter, we introduced Mimecast's Email Security 3.0 strategy at our Cyber Resilience Summit. Email Security 3.0 outlines how attackers strategies have evolved over time. Today, the best cyber resilience moves beyond what we used to think of as the email gateway. Our solution for keeping organizations safe is both a sophisticated set of email perimeter gateway defenses that are focused on blocking the ever evolving threats that attempt to deliver malware and scams directly to an organization's users or Zone 1 as we call it as well as two additional zones of attack that customers need to consider. Now Zone 2 looks at threats inside the perimeter, when the attacker leverages the employees credentials or systems inside the company to proliferate attacks and then Zone 3 where attackers has simply rip off domains and brands in the wild, attacking an organization's customers, partners or the public using email impersonation and fake web properties to commit fraud. Now Mimecast's Email Security 3.0 services deliver an integrated solution across all three zones. Our TTP offering defends in Zone 1, IEP and Awareness Training deliver into Zone 2 and then it is in Zone 3 that we've recently made significant enhancements to our platform with the acquisitions of both DMARC Analyzer and Segasec. Now, DMARC Analyzer is a service that offers Domain-based Message Authentication Reporting and Conformance, the acronym DMARC. We offer setup, management, and analysis and when combined with Mimecast's gateway services, DMARC Analyzer provides customers an easier and more cost-effective solution for stopping domain spoofing attacks. Segasec is a service that protects organizations digital footprint by extending detection and defenses beyond the perimeter to protect brands, customers, and supply chains against attacks spoofing a company's digital assets. Here, we are proactively finding and removing malicious domains and properties impersonating or replicating your legitimate digital assets before they do damage. As part of Mimecast now, we will call the Segasec offering Mimecast Brand Exploit Protection or BEP. The availability of these new services on the Mimecast platform is already proving popular as we witnessed existing customers adopting these advanced technologies and new customers being attracted to us for our comprehensive Email Security 3.0 framework. Our deep and open API strategy, which we've discussed on prior calls, continues to see rapid adoption across our customer base and has been a key differentiator in new sales engagements. Over the course of 2019, we've more than doubled the number of customers accessing services through our APIs to over 600 organizations. Our fast expanding ecosystem of integrations with leading technology vendors grew in the third quarter to include IBM Resilient complementing Mimecast integration with IBM QRadar. Additionally, Demisto recently upgraded remediation capabilities enabling removal of email from users mailboxes directly from within Demisto. This further enhances the value customers can realize by adding Mimecast to their cyber resilience strategy. Now our success with Microsoft Office 365 continues to be strong. More than half of our new customers in the third quarter came to us to help them to be more confident and secure with Microsoft Office 365. Today, over 19,000 organizations use Mimecast to enhance their cyber resilience with Office 365 meaning that for the first time, over half of our total customer base is now on Office 365. There are over 200 million business users active on Office 365 today and we can easily imagine a world of near total Office 365 deployment and dependency. Now, this of course, represents a huge concentration of risk on this critical business infrastructure. This tremendous scale can advantage the attacker as security homogeneity across a wide range of organizations means a single successful scam can be used to exploit multiple targets. Now Mimecast can help customers mitigate the risks they face in this new digital reality characterized by new dependencies and interdependencies that pose different risks and require new plans and mitigations. Our Email Security 3.0 strategy emphasizes a more pervasive view of email and security generally expanding beyond the perimeter as well as inside the organization systems and linking to other vendors products that are used by our customers through APIs as part of a broader and more connected security ecosystem. When combined with our suite of cyber security and resilience extensions such as Archiving, Continuity, and Web Security, we see a continued and significant opportunity to grow our subscribers in an Office 365 ubiquitous world. Now I'd like to share with you some of the reasons customers are choosing Mimecast and the types of solutions we're delivering to the market. So firstly, a US-based healthcare technology company with a staff of about 600 moved to Office 365 and recognized the need for enhanced cyber resilience in addition to what Microsoft offered to protect users, customers, and their brand. An RFP was commenced with Mimecast and another leading vendor and after running live traffic for 30 days and evaluating the breadth of capabilities of both vendors, Mimecast was selected for our superior efficacy and ability to protect this organization at their perimeter or Zone 1, but in addition to Zone 1, our Zone 2 solutions were deployed to scan for insider threats and to empower employee defenses. In Zone 3, they purchased both our DMARC and Brand Exploit Protect offerings. They understood the value of our integrated platform during their evaluation and they ultimately included Continuity and Archiving and Web Security in their subscription too. Minecast's unique ability to cover multiple customer needs across what used to be sort of as separate product categories differentiated our service and delighted this customer. Secondly, a U.S. engineering firm with 25,000 employees was using several legacy technologies in an attempt to block dangerous emails. It was not proving to be as successful as they had intended and so they looked for a solution with better efficacy. They did a side-by-side proof of concept between Mimecast and another leading vendor and Mimecast was selected for our efficacy and our ability to integrate through our open APIs with other vendors in the network, including Splunk and Palo Alto Networks Demisto. Additional consideration was given to Mimecast integrated suite of services that provided a road map for future workload consolidation. And then a U.S. healthcare organization with 30,000 employees experienced lower efficacy and rising costs from their existing email security provider and they sought a better solution and after completing a comprehensive proof of concept involving a side-by-side comparison versus the incumbent, Mimecast was selected. The customer also valued our recently acquired DMARC Analyzer service to bolster their Zone 3 defenses. Then a children's healthcare organization with 6,000 employees was using legacy technology from multiple vendors for email security and archiving. They simultaneously had projects looking for an email security solution with better efficacy and a more streamlined archive and eDiscovery offering. After a thorough POC involving other leading vendors, Mimecast was selected for our integrated platform delivering to both of their needs in a cost effective and easy to deploy platform and some of the added platform benefits this customer chose to take advantage of include Internal Email Protect and Mimecast's Sync & Recover. A global sustainable transportation company with 50,000 employees and a modern IT infrastructure looked to improve efficacy and integrate communication and data security with other vendors in their network. While the incumbent vendor offered threat sharing across vendors, their API platform was not as robust as Mimecast's and not able to align with this customer's vision of integration. After a live bake-off versus other leading vendors, Mimecast was selected for our improved efficacy, administrative flexibility, and our customer support services. A higher education institution in Australia with over 80,000 faculty and students was using Mimecast to protect their staff of approximately 10,000 while relying on Microsoft Office 365 ATP stand-alone for student email accounts. Over the course of 2019, this organization experienced repeated compromises of student accounts. In one incident, over 1,000 student accounts were compromised and while this institution was able to contain the further spread of this attack, the sheer number of hours to remediate was unmanageable and costly and they sought to implement a more effective solution. Mimecast's S2 bundle that combines TTP and IEP to guard both the perimeter or Zone 1 and hunt for threats inside the network, Zone 2, was selected for all 80,000 faculty and staff reducing both cost and complexity for IT, improving end user experience, and safeguarding the organization with enhanced cyber resilience. A beverage company with over 150,000 employees operating in an Office 365 deployment that covered nine geographic zones required a vendor that could support complex multi-zone policy configuration on a global scale. Additionally, this organization sought better protection from impersonation attacks that had eluded their incumbent vendor and looked to add Zone 2 defenses to guard against careless and malicious insiders. After an evaluation alongside their incumbent vendor, Mimecast was found to have stronger efficacy and the ability to fulfill their complex global compliance requirements. So in summary, we continue to develop our technologies, partnerships, and people to enhance Mimecast services and provide our customers with the best available solutions. In doing so, we remain mindful of our balanced operating model, driving top line growth while simultaneously delivering profits. Constant innovation ensures that we are defending against today's threats and staying abreast of new threats and risks as adversaries alter the tactics. This perpetual innovation and our focus on customer service underpins our growth as we look to 2021 and beyond. Now I'd like to turn the call over to Rafe Brown, our CFO to cover the financial detail further. Rafe?
Rafe Brown -- Chief Financial Officer
Thank you, Peter. As Peter mentioned, we had a very productive third quarter. I am pleased to report that for the third quarter of fiscal 2020, we exceeded the high end of our guidance for both revenue and adjusted EBITDA, continuing to deliver a balanced scorecard of both growth and expanding leverage in the business. We closed the acquisition of DMARC Analyzer in the third quarter and as you are aware, shortly into the fourth quarter announced the acquisition of Segasec. These two acquisitions further expand our product offerings in Zone 3 of our Email Security 3.0 strategy, which is particularly appealing to larger organizations.
In the third quarter, we generated revenue of $110.2 million, which represents growth of 26% over the prior year in absolute dollar terms and adjusting for the $700,000 of currency headwind we faced, our constant currency growth rate over the prior year stood at 27% for the quarter. Note that since providing guidance last quarter, foreign currency fluctuations positively impacted our third quarter results by $300,000. Adjusted EBITDA for the third quarter totaled $20.6 million representing an adjusted EBITDA margin of 18.7% compared to $16 million or 18.2% in the same quarter the prior year. On a net customer basis, we added 800 customers in the quarter. Mimecast now services 36,900 customers worldwide, but please note, this figure excludes acquired DMARC Analyzer customers at this time as we work to integrate the DMARC business. Our average order values continued to show improvement over the prior year. Currently average order value for all customers stands at $12,100, up approximately 13% over the prior year in constant currency terms. Average services per customers across our customer base rose to 3.3 services per customer in the quarter, up from 3.1 services last year at this time.
New products such as the two acquisitions mentioned earlier, continue to afford us the opportunity to expand our footprint within existing customer deployments and increase Mimecast's appeal with larger organizations. The proportion of customers using Mimecast in conjunction with Office 365 rose past 50% in the quarter for the first time. We see Office 365 expansion as helpful to our business as Office 365 customers continue to demonstrate an appetite for a greater number of our service offerings. As of the third quarter, Office 365 customers purchased on average 3.5 services per customer compared to three services for those customers not using Office 365. Our trailing 12-month revenue retention rate stood at 109% compared to 110% in Q3 of the prior year. Our gross revenue retention numbers continue to be underpinned by solid upsell results as our existing customers continued to renew their subscriptions and purchase additional services. From a geographic perspective, North American growth in the quarter remained strong with North American revenue up 28% over last year. Our business outside North America continued to grow in the third quarter, but performance outside North America remained below our expectations.
Turning to gross margin for the third quarter, we recognized the 75.6% non-GAAP gross margin, up 100 basis points from Q3 of the prior year. Our non-GAAP operating profit for the third quarter was $12.7 million or 11.5% of revenue, an improvement of 50 basis points from the prior year driven by efficiencies of scale within our grid. In bottom line terms, our third quarter GAAP net income was $200,000 or breakeven on a per diluted share basis based on 64 million fully diluted weighted average shares outstanding. Our GAAP tax charges totaled approximately $1 million in the quarter. Fourth quarter tax expense is expected to be approximately $1 million, in line with our prior communication regarding full year tax expense. Our non-GAAP net income for the quarter was $8.8 million or $0.14 per diluted share based again on 64 million fully diluted weighted average shares outstanding. Our non-GAAP tax rate was 28.4% for the quarter and we continue to project a full year non-GAAP tax rate of approximately 31%.
Turning to cash flows, our third quarter operating cash flows totaled $19.3 million or 17.5% of revenue. As noted on our prior earnings call, we made a payment in the third quarter pursuant to a patent litigation settlement for a total of $5.9 million, the impact of which was split between operating cash flow and capex. Free cash flow totaled $1.9 million for the quarter. With our new offices in both the U.K. and South Africa now complete, we expect full year capital expenditures to be approximately $53 million. I am pleased to say that even with the approximately $20 million of one-off cash expenditures expected to be incurred, we continue to anticipate that free cash flow for the full year will be in line with our FY '19 performance or approximately $37 million for the year. After paying approximately $21 million for DMARC Analyzer, as of December 31st, Mimecast had $190 million of cash on the balance sheet. You should note that the Segasec acquisition that we announced last month and is thus a Q4 item will reduce our cash balance by approximately $27 million.
Let me now turn to guidance for the remainder of fiscal '20. For the fourth quarter of 2020, revenues are expected to be in the range of $112.9 million to $114 million or 23% to 24% growth in constant currency terms. Our guidance is based on exchange rates as of January 31st, 2020 and includes an estimated negative impact of $800,000 resulting from the strengthening of the U.S. dollar compared to the prior year. Adjusted EBITDA for the fourth quarter is expected to be in the range of $20.2 million to $21.2 million. Full year 2020 revenue is expected to be in the range of $425.6 million to $426.7 million or 27% to 28% growth in constant currency terms. Foreign exchange rate fluctuations are negatively impacting this guidance by an estimated $8.4 million compared to the rates in effect in the prior year. Prior guidance for fiscal 2020 provided in November was $423.1 million at the midpoint. Our over-achievement in Q3 coupled with the strength we are seeing in our business is leading us to raise the midpoint of our full year guidance by $2.3 million in constant currency terms. In addition, this raise of $2.3 million is being positively impacted by $800,000 of foreign exchange tailwind that has arisen since the rates used in our November call resulting in the midpoint of our full year guidance moving up by $3.1 million in absolute dollar terms from $423.1 million to $426.2 million. Please note that total acquired revenue from our two acquisitions, DMARC Analyzer announced in November and Segasec announced in January is expected to be approximately $200,000 for the year. Full year 2020 adjusted EBITDA expectations are being raised to a range of $74.3 million to $75.3 million. We are increasing our adjusted EBITDA guidance by $1.1 million at the midpoint, which at the midpoint would deliver 160 basis point improvement over the prior year. It is worth pointing out that we are absorbing the operating cost impact of the two acquisitions while increasing our full year adjusted EBITDA guidance.
While we are still finalizing our planning, I would also like to take this time to set initial expectations for the year ending March 31st, 2021. As we close fiscal '20 and conclude our planning process, we will refine these expectations, but believe this is a good starting point and please note again that this guidance is based on foreign exchange rates as of January 31st, 2020. Full year fiscal '21 revenue is expected to be in the range of $505 million to $515 million or 18% to 20% growth in constant currency terms when measured against the midpoint of our current fiscal '20 guidance. Full year fiscal '21 adjusted EBITDA is expected to be approximately $100 million, which at the midpoint of our revenue guide would be approximately a 200 basis point margin improvement over fiscal '20. Free cash flow for the full year fiscal '21 is expected to be approximately $84 million after capex charges that we are now modeling at 7% of revenue. On an as reported basis, that is a 780 basis point free cash flow margin improvement over our expected fiscal '20 free cash flow. Setting aside the one-time fiscal '20 capex items mentioned earlier, this is still an approximate 300 basis point margin improvement year-over-year based on the midpoint of our current guide. As a final comment, I would like to highlight that the guidance for fiscal '21 reflects our commitment to delivering both disciplined growth while expanding free cash flow margins and with that, I'd like to thank you for your time and open the line to your questions. Operator, can you please poll for our first question.
Questions and Answers:
Operator
[Operator Instructions] Our first question or comment comes from the line of Saket Kalia from Barclays Capital. Your line is open.
Saket Kalia -- Barclays Capital -- Analyst
Hey, Peter, hey Rafe, how you doing? Thanks for taking my questions here. Hey, maybe. Hey, Peter, maybe just to start with you. You know, just zooming out a little bit on the competitive environment a little bit, can you just talk a little bit about what you're hearing from Symantec MessageLabs customers. I guess specifically, how do you think those customers are viewing the future of their email security now that MessageLabs is part of Broadcom and how do you think Mimecast is maybe going to go after that opportunity understanding that it's probably more of a long-term item?
Peter Bauer -- Chief Executive Officer
Yeah, I think that's right and maybe just to start off, we've been servicing or migrating Symantec MessageLabs customers very successfully for many years now even prior to the Symantec acquisition of MessageLabs and now obviously with Broadcom coming in, it introduces a level of uncertainty and ambiguity for that customer base. So we're really focused on helping those customers understand that if they are feeling jumpy or uncertain about Broadcom's commitment to either them as a segment in the case of the mid-market customers or Email Security as a category, which Broadcom has not shown that it's something that they are particularly interested in, it's one of the product lines that hasn't been spoken about as a future growth area in their plans that there really is a good home for them with Mimecast and that they would be following a pretty well trodden path of several thousand other companies that are very successfully migrated to Mimecast. I think the opportunity is not just with the end-user community, but also with partners who perhaps under the previous Symantec ownership structure, you had a level of loyalty to Symantec that was largely reciprocate. I think Broadcom's focus does not appear to be building long-term relationships certainly with your typical mid-market reseller type organization and so what may have previously been loyalty between that channel and Symantec, I think is certainly open and those partners are showing a greater interest and willingness to introduce those those accounts over to Mimecast that previously they may not have. So we're doing things from an educational point of view and from a promotional point of view to help make it easier commercially for both customers and partners to migrate over to Mimecast.
Saket Kalia -- Barclays Capital -- Analyst
Got it. That's really helpful and makes a lot of sense, Peter. Maybe for you Rafe, can you just talk a little bit about the net revenue retention metric a little bit. I guess the question is, how does that sort of maybe ebb and flow quarter-to-quarter. I think it came in at 109% this quarter and maybe how do you think about that metric, sort of, qualitatively going forward with some of the changes that are happening in the base. It sounds like there are more enterprise customers. It sounds like there are more products attach per customer. How do you think about that net revenue retention sort of trending in the future as a result of some of those changes?
Rafe Brown -- Chief Financial Officer
Yeah, thank you. Where there is some variance in the number over time, really stepping back from it, our net revenue retention numbers are really quite good. One of the things we've just consistently been able to demonstrate is ability to sell additional products into our base as well as keep customers for quite a long time. When you dig into the the math of how we calculate it, it is a trailing four-quarter metric. So it's looking back over time and so if you went back a year in time, TTP was really coming on strong and driving a lot of uptake and that was a very attractive thing for us, of course, but now that it's penetrated over 70% of our base, it's natural to think, well, that's going to come off and now we've got some new products coming up along the way to take its place and I think that's what we're really excited about is making sure we have those new offerings and Peter went through it kind of at some length really talking about the Email Security 3.0 strategy and just the two acquisitions that we announced in Zone 3, which is brand new to us, great opportunity, but then on top of that, we're thinking about Archiving into our base further, our web solution into our base further, Awareness Training. Just across the board, we're really working to make sure that as one product seems to penetrate the base, we've got other things coming up behind it.
Saket Kalia -- Barclays Capital -- Analyst
Got it. Makes a lot of sense. I'll get back in queue, guys. Thank you.
Rafe Brown -- Chief Financial Officer
Thank you.
Peter Bauer -- Chief Executive Officer
Thanks, Saket.
Operator
Thank you. Our next question or comment comes from the line of Matt Hedberg from RBC Capital Markets. Your line is open.
Dan Bergstrom -- RBC Capital Markets -- Analyst
Hey, it's Dan Bergstrom for Matt Hedberg. Thanks for taking our questions. So you pointed to some softening in EMEA last quarter, sounds like it underperformed this quarter as well. Any change or is that just a continuation and then probably too early, few weeks old at this point, but any early signs of stability or more certainty following the Brexit vote here in January?
Rafe Brown -- Chief Financial Officer
So yeah, that has been something that we've called out a couple of quarters in a row right on our calls. The first thing not to get lost in the discussion, our EMEA business is still growing. It's just not able to keep up with the North American growth that we've seen over the last couple of quarters and one of the things, when you step back and look at Mimecast, it's always important to remember that we are an international company in fact started outside the U.S. and I think right now our North American revenue is just 51% of the total. So we have a very broad footprint across the world and certainly when you see issues like Brexit come up, which has had some very obvious impacts on the local GDP numbers or some of the challenges in South Africa, on their economy, we are touched by those because we do -- our customer base reflects the local economy in that we have a lot of mid customers, but also enterprise and some small customers as well. We're really looking at it as what can we do to make sure that we're in the best position for the market at hand and that's something we take into account when we've done our planning, where we're deploying resources. We've moved some people around to make sure we have the right people in the right roles. We're doing our best to make sure that we're firing on all cylinders, even if there is a bit of headwind out there from the economy.
Dan Bergstrom -- RBC Capital Markets -- Analyst
Great, thanks. And then with the three zone approach to Email Security, just curious you know after a quarter or so with that, how is it resonating with customers, particularly I guess the inside and beyond the perimeter, sounds like it's been branded now. You talked a little bit about the S2 bundle in the customer examples on the call here. Should we expect any additional changes to go to market here or bundling new SKUs, any thoughts there?
Peter Bauer -- Chief Executive Officer
Yeah, so Email Security 3.0 I think intuitively is making a lot of sense to prospects that we talk to, to customers as well as our channel partners and it is certainly providing that context that we looked for, to help them understand the offerings, contextualize the problems that they face and understand the offerings fitting into that framework. So we've seen strong adoption of both IEP and Awareness Training, the Zone 2 plays during this last quarter. Obviously, the DMARC and Brand Exploit Protect are brand new offerings. So we have some good anecdotal evidence to suggest that that's going to be popular with customers too.
Dan Bergstrom -- RBC Capital Markets -- Analyst
Thank you.
Operator
Thank you. Our next question or comment comes from the line of Shaul Eyal from Oppenheimer. Your line is open.
Shaul Eyal -- Oppenheimer -- Analyst
Thank you. Good afternoon, guys. Quick question, on your Germany operation that you had invested in well the prior year. Peter, can you talk to us about the update and how that has been progressing over the course of the past call it, few quarters now.
Peter Bauer -- Chief Executive Officer
Sure, thanks, Shaul. So obviously we implemented our local data centers in the German market about 18 months ago and we built out a local team with local in-country language support to service, not just Germany, but that sort of broader Central European market opportunity. Thanks to the sort of ratable nature of our business and the tremendous growth of our North American and the size and scale of our others, it will take a while before that shows up meaningfully in any revenue distribution pie chart, but we continue to sign on new customers and partners into that region, and we think, among other things, that the Symantec opportunity extends over into Europe as well and that our Email Security 3.0 framework will continue to help us drive growth into that market opportunity as well.
Shaul Eyal -- Oppenheimer -- Analyst
Got it, got it. And if I may, Peter, as we think about the Office 365 opportunity and without a doubt, it has played out extremely well over the course of the past few [Phonetic] years, as we think about, probably the next two years, three years or so and can we anyway try to break it out in between EMEA and America, where do you see probably the main upside as it relates to Office 365, I'm not asking about the entire business, but Office 365, will it be more Europe or will it be more North America?
Peter Bauer -- Chief Executive Officer
Yeah, I think that's an interesting one because I mean we classically are sourcing businesses out of three categories of prospect. The one is pertaining to the corporate email arrangements. There is still a contingent that has on-premise and they are looking merely to offload security and archiving and some of those things to a cloud provider, but they have no immediate plans to ditch the on-premise technology. Then you've got a cohort that are either busy or planning their migration and they're talking to us, so that we can help underwrite the success of that migration and they can disband some of the on-premise equipment that they had to avoid backhauling data onto their own networks and then the third bucket is those that are already on Office 365 either with a competitive solution or with nothing in place and they are now looking to add better security or layering and they talk to us about that. I think what we're seeing across those different markets is that in the U.S. and in the UK we have quite advanced penetration of Office 365 and so most of the business that we are deriving is actually coming out of that third bucket. What's interesting is if you go to markets like Central Europe and Germany, in particular, you have many more in that sort of first and second bucket and so that represents an interesting opportunity for us as well and we are excited to be there sort of early in that cycle of migration as well.
Shaul Eyal -- Oppenheimer -- Analyst
Got it, thank you for that. Very helpful. Good luck.
Peter Bauer -- Chief Executive Officer
Thank you.
Operator
Thank you. Our next question or comment comes from the line of Brent feel from Jefferies. Your line is open.
Joe -- Jefferies -- Analyst
Hey guys, this is Joe [Phonetic] on for Brent. Thanks for the question. Appreciate the color on revenue from acquisitions and assuming that $200,000 is mostly in the fiscal fourth quarter. So if I annualize it, it's about $1 million. When should we expect Email Security 3.0 to more meaningfully contribute to revenue?
Rafe Brown -- Chief Financial Officer
Well, I think that -- keep in mind that Email Security 3.0 is a very big contribution to revenue in that the two acquisitions are just Zone 3. So, just to make sure, like our primary product is a Zone 1 product and some very good products for us are in Zone 2. So just to make sure we're on the same page, Zone 3, is that really where your question is around the acquisition. Is that what you are thinking?
Joe -- Jefferies -- Analyst
Yes, Zone 3. I'm sorry.
Rafe Brown -- Chief Financial Officer
Yeah and so those products, they are obviously -- small companies with great products. great technologists and we're integrating them into our solution. The nice thing, though, I think with them that we don't want to lose sight of is that we already have partnerships in place with both DMARC and Segasec. So it's a great opportunity for us to really, we had a running start, if you will, at our working together and I think that's going to be quite helpful. That said, they are working off a small base, just into this much bigger organization. So it's going to take a bit of time for that to really ramp up. In the kind of mid-term, what you would look to in terms of the strategy are some products like the Awareness Training product, which we are seeing very nice growth in it. That began with an acquisition last fiscal year. We've now fully integrated it into our platform. We're seeing good customer adoption. Those are the products that we'll start to see things coming along much more quickly and driving more of a revenue impact.
Joe -- Jefferies -- Analyst
Okay, thanks. And then just in regards to your fiscal '21 guidance, you guys have sustained high growth in the high '20s constant currency for a while now. It implies a steep-ish decel [Phonetic] I'm assuming there is some prudent conservatism in there, but then also on the adjusted EBITDA, it's above the Street and it's a 200 basis point improvement, but it's a little bit below what you guys have laid out in the long-term model in your investor presentation. So just how should we think about growth versus profitability going forward? Thanks.
Rafe Brown -- Chief Financial Officer
Yeah, you know, this will be a significant topic at our Analyst Day that's coming up in just a couple of weeks here, so we'll dive into that a lot more. Our focus is to make sure we're balancing both growth and building profitability and I think one of the things we're seeing at least in our guidance and as we execute on it is that exercise of both levers where we're focused on growth, but we are consistently focused on how can we deliver bottom line value as well. You know, hitting $100 million adjusted EBITDA in terms of guidance, we of course we still have to execute on that, but that's a big milestone for us and shows a nice improvement and likewise one of the things that you probably noticed in the call is an emphasis around free cash flow, which again that's just as a metric for us something we feel is very important to demonstrate in unambiguous fashion the bottom line value we're delivering.
Joe -- Jefferies -- Analyst
Makes sense. Thanks guys.
Operator
Thank you. Our next question or comment comes from the line of Terry Tillman from SunTrust. Your line is open.
Nick -- SunTrust -- Analyst
Hey, how are you guys? This is actually Nick [Phonetic] on for Terry. Thanks for taking our questions. So the first one I had was I guess what benefits are you guys seeing so far from your sales teams as a result of the Segasec and DMARC Analyzer acquisitions? I guess anything in particular that's resonating with mid-market enterprise in terms of how customers are receiving both these acquisitions? Thanks.
Peter Bauer -- Chief Executive Officer
Yeah, great question. So it's early days. Obviously these are fairly new acquisitions and the Email Security 3.0 framework is -- while we've been talking through our megaphone about it, it's a process to get that story out into the market. The early evidence is that it's extremely well received, it makes a lot of sense to customers and there is a lot of interest. I think particularly up market around the two problem sets that the both DMARC and the Brand Exploit Protect offerings cater for. These are pretty tricky complex issues that customers have to deal with and they really like the fact that they can rely on their secure email gateway provider to be able to take care of these issues as well. So they're really responding well to us casting a kind of a broader frame around the email security issues holistically and having native offerings that we can bring to the table and certainly with some of the wins that we've seen, it's been influential in and us winning the Zone 1 in the Zone 2 plays specifically because we have Zone 3 as well.
Nick -- SunTrust -- Analyst
Got it. Okay, that's helpful. And I guess you guys mentioned in the prepared remarks, but you said the larger companies typically benefit the most from your Zone 3 products. So I guess should we expect continued focus on Zone 3 moving forward and if so, is that more, I guess, how should we think about that in terms of buy versus build? Thanks.
Peter Bauer -- Chief Executive Officer
Yeah, that's a great question. So we will continue to innovate, obviously Segasec and DMARC Analyzer, both fairly young companies with great technology, but with road maps too. So there are organic opportunities to continue to extend their capabilities, both within the context of their products, but also some of the intersections between what they offer and what is in the rest of the Mimecast platform. So there'll be solid organic innovation that continues there. It is an interesting area beyond the perimeter, there are a lot of challenges and threats that present themselves. So we're certainly going to keep our eyes open for opportunities -- inorganic opportunities that could help us innovate further there, but I think it's important just to recognize our style of inorganic and it's largely focused on technology and talent that we can bring into the company that can help capitalize and accelerate our ability to add additional monetizable use cases on the same platform and so a very disciplined and steady approach to to M&A that will continue to play out, but certainly nothing imminent in the pipeline. We've got enough work to do to digest and on board and enable across across these new Zone 3 plays.
Nick -- SunTrust -- Analyst
Got it. Thanks guys.
Operator
Thank you. Our next question or comment comes from the line of Keith Bachman from BMO. Your line is open.
Keith Bachman -- BMO Capital Markets -- Analyst
Hey, good afternoon or good evening gentlemen. Two things, one, if you could just clarify, what is the organic growth guidance for '21. In other words, how much is the M&A contributing and then secondarily, could you just talk about your win rates and what I mean by that in two dimensions is number one, is there any change in your win rates in aggregate, but then more specifically are you -- and more specifically, I should say, are you also seeing a broader field and what I mean by that is, is Microsoft getting more at-bats [Phonetic] here for their security story and it sounds like you're probably seeing Palo Alto and Splunk more than you had previously. So just A), clarification on organic and then B) win rates, both in terms of the numerical, but also what's the field look like? Thanks.
Peter Bauer -- Chief Executive Officer
Yeah, so I'll let Rafe jump in with the growth rate thing in a second, but I think our win rates continue to be strong and consistently good. We are being pulled into more of these larger opportunities, which is very exciting for us and we are having good success in those. You can probably tell from some of the examples that I called out in the prepared remarks. We're delighted with those logos and we think it's very good validation of of both our sales process that's improved over time as well as our technology and our brand as well. Your question about Microsoft getting more at-bats. I mean I think by default Microsoft gets to that no matter who's playing as the incumbent sort of Office 365 provider. So I think it's always been a game of you know why not them and then you know who else if we're going to layer on additional technology, let's assume they'll be Microsoft in the frame it at some point. So I wouldn't say that's changed. Palo Alto and Splunk those are not sort of competitive solutions, those would be other things that the customer is using that we would integrate with. So I think the example we used there is Palo Alto Demisto which is their SOAR 2 or Splunk which is the SIM [Phonetic] product, you know, our integrations with those. So it's really about helping particularly larger organizations to build an integrated and coherent overall security system where Mimecast is the email component in that system as a very well integrated and highly contributing service component. So that's where we see players like that fitting in.
Keith Bachman -- BMO Capital Markets -- Analyst
Okay, if you're going up market, just to be clear, are you seeing Proofpoint more in these larger deals?
Peter Bauer -- Chief Executive Officer
Yeah, absolutely. So I think what most larger organizations particularly in North America, they would consider is Microsoft going to be good enough stand-alone for them, do they need to be talking to Proofpoint and then increasingly, which is very exciting for us is Mimecast is that the sort of second contender in that race and I think that's exciting for us because that's a fairly new, fairly recent phenomenon and I think that between ourselves and Proofpoint and Microsoft. That's really where I think the lion's share of consideration is going for how these problems should be solved.
Keith Bachman -- BMO Capital Markets -- Analyst
Okay. Peter, thanks very much.
Rafe Brown -- Chief Financial Officer
Just to close off on your question about the impact. You know, the impact of DMARC and Segasec on our revenue guidance for FY '21 is really quite small. We are in the part where we're still doing the accounting for the acquisition and as you aware with the deferred revenue, it's a bit involved, but I think a great benchmark here is in the FY '20 guidance, I noted that we'll have about less than $200,000 from both acquisitions and that's a quarter and a half roughly speaking of DMARC and a full quarter of Segasec. So it's relatively small impact on the total and certainly we'll be working to finish up the accounting impact and integration of those customers in the coming period, but it's not going to move the needle very much from the acquirer. We're just hoping that we can go out and share with a lot of new customers.
Keith Bachman -- BMO Capital Markets -- Analyst
Great, thank you.
Operator
Thank you. Our next question or comment comes from the line of Sterling Auty from JP Morgan. Your line is open.
Matt -- JP Morgan -- Analyst
Hi guys, this is Matt [Phonetic] on for Sterling. Thanks for taking my question. Just was wondering what areas in the international market are still lagging and what are some of the main reasons at this point that you guys can point to? Thanks.
Peter Bauer -- Chief Executive Officer
Sorry, Matt, what do you mean by areas of the international market that are lagging?
Matt -- JP Morgan -- Analyst
So in terms of the product adoption as well as any specific geographies.
Peter Bauer -- Chief Executive Officer
Okay, yeah, great question. So I think we -- as Rafe mentioned earlier, we were born as an international company and the U.S. has been an expansion market for us, but obviously our biggest basin today, but we are deployed in many international markets. We have favored English speaking just because as a company, we are doing many hard things and doing many hard things in many different languages is potentially unnecessary for us in terms of our current growth, but also would de-focus us from certain of the things that we've really sought to do in the English-speaking markets. Having said that, the European expansion was our first non-English speaking expansion and so we feel good that we have access to that market, but beyond that, we have very good access across South Africa and the African market, Australia, New Zealand, U.K., North America and Canada. So we feel we have good market access. Obviously, what's not on that list is some of the other parts of Asia Pacific, which we're certainly not ruling out as market opportunities, but they are not in our very immediate plans.
Matt -- JP Morgan -- Analyst
Great, that's very helpful and then just one quick follow-up, you guys talked about growth from new customers and existing. What portion of the growth is coming from from existing customers and is that coming more from customers buying more products or covering more users? Thanks.
Peter Bauer -- Chief Executive Officer
Yeah, our upsell numbers have remained really quite steady in the mid-teens and that's upsell off our base measured in dollars and that's been trending for quite some time. When you take that apart, it is a blend. We have obviously benefited our customers grow and they need more seats, they buy more seats from us, but there is a strong mix in there of new products and that's really a big focus for us, making sure we're able to take new products and sell them to our base as well as attract new customers and that kind of bears out, you see that both in the AOV, which was up quite nicely, 13% in constant currency terms and in that metric that we give out about average services per customers which that also has had a nice rise on a year-over-year basis. So when you take that part, you do see that gross revenue retention number that I quoted at 109%, that's a big contribution to our growth on a year-over-year basis.
Matt -- JP Morgan -- Analyst
Great, that's very helpful, guys. Thanks for taking my questions.
Peter Bauer -- Chief Executive Officer
You're welcome.
Operator
Thank you. Our next question or comment comes from the line of Steve Koenig from Wedbush Securities. Your line is open.
Steve Koenig -- Wedbush Securities -- Analyst
Hi, there. Hey, thanks for taking my questions, gentlemen. Hey your answer on the Microsoft competition was very helpful. Maybe just digging into that for a second since you're seeing more and more -- you're based out of Office 365, that scenario where they already have Office 365 becomes more important. Can you kind of help us understand how many of those competitions are say a customer has E3 without any Email Protect or might have E5 and then I gather from your answer that if they do have Microsoft protection either EOP or ATP etc, Mime is usually an incremental add to that, maybe you can just help understand the nature of how you play with those Microsoft deployments?
Peter Bauer -- Chief Executive Officer
Yeah, great, so we don't have a reliable way at scale to tell what our customers licensing arrangements are with Microsoft. So I'm pretty sure within our base we have with 19,000 organizations using us with Office 365, I'm sure that we have a pretty good mix of all types of Microsoft licensing. The one thing we do say to our customers is whatever level you are licensed at and whatever your reasons for being licensed at that level, you know, absolutely use as much of the Microsoft Security technology as you can. Turn it on to the max, but be very sure to add the Mimecast layers and the Mimecast layers are both layers of security to provide better efficacy to radically reduce the likelihood of the wrong thing landing up in people's mailboxes, but also the broader suite of risk mitigation technologies and offerings that deal with some of the new issues that we face as the world becomes massively dependent on Office 365. So things like our Continuity offering, which provides a Plan B in the event of downtime, our Sync & Recover capability, which provides an external backup of the data inside your exchange online tenant and allows you to reconstitute data, the Awareness Training offering and all of the other strategies that come with it. So there are many flavors and solutions that go way beyond the scope of what an E3 or an E5 may offer although where there may be some conceptual overlap in terms of the classic Zone 1 blocking bad things from getting into mailboxes, we certainly add considerable value and continue to be a very popular offering just in that regard with Microsoft's customers.
Steve Koenig -- Wedbush Securities -- Analyst
Great. Thanks, Peter. That's my only question. I'll stop there.
Operator
[Operator Closing Remarks]
Duration: 61 minutes
Call participants:
Robert Sanders -- Director, Investor Relations
Rafe Brown -- Chief Financial Officer
Peter Bauer -- Chief Executive Officer
Saket Kalia -- Barclays Capital -- Analyst
Dan Bergstrom -- RBC Capital Markets -- Analyst
Shaul Eyal -- Oppenheimer -- Analyst
Joe -- Jefferies -- Analyst
Nick -- SunTrust -- Analyst
Keith Bachman -- BMO Capital Markets -- Analyst
Matt -- JP Morgan -- Analyst
Steve Koenig -- Wedbush Securities -- Analyst
