Ping Identity Holding Corp (PING) Q4 2019 Earnings Call Transcript

Ping Identity Holding Corp (PING)
Q4 2019 Earnings Call
Mar 04, 2020, 5:00 p.m. ET

Contents:

• Prepared Remarks
• Questions and Answers
• Call Participants

Prepared Remarks:

Operator

Ladies and gentlemen, thank you for standing by, and welcome to the Ping Identity fourth-quarter 2019 earnings conference call. [Operator instructions] Please be advised that today's conference is being recorded. I would now like to hand the conference over to your speaker today, Hugo Doetsch, vice president of finance, strategy and corporate development. Thank you.

Please go ahead.

Hugo Doetsch -- Vice President of Finance, Strategy and Corporate Development

Thanks, everyone, for joining us today, and welcome to the Ping Identity conference call where we will discuss our results for the fourth quarter of fiscal-year 2019 and provide our initial outlook for fiscal-year 2020. Before we begin, I would like to remind you that shortly after the market closed today, Ping Identity issued a press release announcing its fourth quarter and full-year 2019 financial results. Additionally, Ping Identity published a supplemental slide presentation to accompany this call. You may access the press release and presentation on the Investor Relations section of pingidentity.com.

With me today is Andre Durand, our CEO; and Raj Dani, our CFO. Today's discussion may include forward-looking statements. Please refer to our final initial public offering prospectus dated September 18, 2019, and filed with the Securities and Exchange Commission, where you will see a discussion of factors that could cause the company's actual results to differ materially from these statements. I would also like to remind you that during the call, we will discuss some non-GAAP measures related to Ping Identity's performance.

You can find the reconciliation of those measures to the nearest comparable GAAP measures in our quarterly financial statements. [Operator instructions] And with that, I'll turn the call over to Andre Durand, founder and chief executive officer of Ping Identity. Andre, please go ahead.

Andre Durand -- Chief Executive Officer

Thanks, Hugo. Good afternoon, everyone, and thank you for joining our second earnings call as a publicly traded company. Before I begin, I'd like to thank my team, our partners and our customers for their support and dedication to making the world a safer place through identity. And now on to our Q4 results.

We had a record fourth quarter highlighted by strong top line growth, profitability, continued success in the enterprise market, tremendous new customer wins and further innovation across our platform. Annual recurring revenue grew 23% year over year, culminating in a total ARR of $224.9 million. Q4 revenue was $68.2 million. Given the continued impacts of ASC 606 to our GAAP revenue when we sell our hybrid identity platform, we believe that ARR provides an important representation and measure of our top line growth and is the key metric we use to evaluate the business.

Since this is only our second earnings call, and a number of today's participants are relatively new to the Ping story, I will briefly review our offering and the prevailing market drivers. Ping's Intelligent Identity platform helps enterprises manage their customer, workforce and partner identities while enabling the seamless access of applications and resources across the most complex hybrid IT enterprise infrastructures. With the rising importance of identity, one Fortune 100 customer recently cited Ping as the heartbeat of the company. And another told me, we are now one of the most important infrastructures in the company, protecting tens of millions of users and several hundred mission-critical applications.

As a result of identity's rising importance, Ping's relationship with the C-suite is growing. And we are often called upon to meet with CIOs because our partnership is viewed as strategic to their digital transformation efforts. This rising tide of identity bodes well for the future of the Ping platform, which is comprised of six solutions for enabling mission-critical identity security functions, such as multifactor authentication, single sign-on, access security, directory, identity data governance and API security. Each solution is built upon open standards and can be deployed stand-alone or in conjunction with other Ping solutions in our cloud, the customer's cloud or in their data center.

Taken as a whole, the Ping platform provides a powerful foundation for the digital transformation of customer engagement and workforce security. Our platform is differentiated through intelligence, deployment flexibility, turnkey integrations with hundreds of hybrid cloud environments and an ability to address all primary identity use cases with one platform. As a result, enterprises are able to provide an enhanced user experience and increased security to their customers, employees and partners. A common theme among many of our enterprise customers is that identity and the Ping platform are absolutely mission-critical.

We frequently hear from our customers that planes won't fly, surgeries won't happen and money won't move if the Ping platform does not perform to the highest standards of security and resiliency. Even many of today's first responders rely on Ping's technology day in and day out to ensure public safety. The approximate $25 billion market we serve can be broken down into two large opportunities. The first is the replacement of legacy identity solutions that have reached their end-of-life and are inhibiting the adoption of cloud, mobile and API-first architectures.

The second opportunity is greenfield expansion driven by the adoption of new technologies such as multifactor authentication, API security and a growing demand for our customer identity solutions. We've chosen to direct our solutions at the enterprise market, with the need for control, security, performance, scale, integration and advanced capabilities, match our platform strength and our DNA as a company. We solve the most mission-critical requirements for our enterprise customers. These enterprises require solutions that can not only secure hybrid infrastructures, they require a solution that can be deployed wherever the enterprise requires: cloud, private cloud, hybrid or on-premise based upon the needs for control, security and compliance.

Increasingly, we've invested in dev ops and containerization technologies to enable the rapid deployment of the Ping platform in the customer's cloud of choice. Ping is an industry leader in offering this hybrid cloud deployment flexibility and the ability to secure the enterprise end-to-end. Many of our larger and more regulated customers choose to deploy Ping within their data center for maximum security. Customers undergoing our cloud transformation but requiring the same level of control they had within their data center choose to deploy Ping in their cloud.

Others choose to leverage our identity as a service for rapid deployment when the need for customization and control are secondary. Irrespective of where our customers choose to consume the Ping platform, they leverage our prebuilt integrations to connect on-premise applications and leverage open standards to connect to cloud applications. Taken as a whole, Ping's flexibility and advanced hybrid solutions are unmatched, as is our ability to deploy whatever the enterprise chooses. As a result, Ping has become the identity industry standard for large enterprises globally, with our solutions deployed at 1,361 companies.

These include over 50% of the Fortune 100; all 12 of the 12 largest U.S. banks; eight of the 10 largest biopharmaceuticals; seven of the 10 largest healthcare plans; and five of the seven largest U.S. retailers. They've chosen Ping for our advanced hybrid cloud solutions, ease of integration, deployment flexibility and proven ability to scale without compromising a fundamental emphasis on security.

During the fiscal-year 2019, we delivered the broadest array of enhancements to our platform in our history. These enhancements include: a new self-service capability, which speeds migration from legacy systems by allowing application teams to integrate their applications with the Ping platform without assistance from IT; a new cloud offering for developers of customer-facing applications who want to simply consume identity as a service; a new cloud offering for enterprises with advanced hybrid requirements and need for additional security and control; enhancements which streamline deployment of the Ping platform in our customers' cloud of choice, such as Azure, AWS and Google Cloud; and new integrations for our API security solution, visibility and protection of APIs, leveraging AI and machine learning; and lastly, we released a new offering for enabling privacy and compliance of identity data sharing, which is a growing importance in the age of privacy legislation and regulation. Taken as a whole, these enhancements strengthen Ping's position as a strategic partner of identity security serving the enterprise market. To underscore our competitive advantage, I wanted to take a moment and share some Q4 wins.

We added a new Fortune 500 customer and satellite television provider who is looking to eliminate their homegrown identity solution for their customer authentication and single sign-on. The Ping platform was selected to provide a single central authentication service to drive revenue and increase security for over five million users. The customer chose Ping because of our proven scalability and is being deployed in their Amazon Cloud, further testament to the cloud your way flexibility that only Ping can deliver. In another example, one of our longtime Fortune 500 customers in the insurance industry expanded upon Ping's existing workforce solution to modernize their customer identity, replacing a homegrown solution that lacked the flexibility and features of the Ping platform.

Building upon our existing success, they expanded their use of Ping to include single sign-on, access security and multifactor authentication for the customer use case and at the same time, expand their workforce use case by adding Ping's access security solution. Ping was selected because of our maturity and comprehensiveness of our offering, successful track record and overall projected cost savings to the company. We are now the cornerstone of their digital modernization and customer experience initiatives. As a testament to our remarkable scalability, the PingDirectory was selected by a top three SaaS titan to service the repository for all customer identities, replacing a legacy vendor and scaling into the hundreds of millions of users.

This seven-figure ARR deal was cemented after an exhaustive review of the competitive landscape and Ping's unmatched ability to prove our scalability, performance and security. I'll just highlight our strong position in the customer use case. This quarter, a leading healthcare provider went all in with Ping to provide a comprehensive customer solution. This customer was already successfully using Ping to secure over 300,000 workforce identities.

But their new purchase expanded on that success by licensing our single sign-on, multifactor authentication, access security, user directory, data governance and API security to better secure over 10 million customer identities. Ping was chosen because our platform enables extraordinary end-to-end experiences, is proven in its security and scalability and is extremely flexible. With Ping, this customer will be able to better meet its compliance, security and customer experience objectives. While we're still in the early innings and our production implementations are relatively new, we're beginning to hear examples of where our investments in AI and machine learning are helping customers protect their APIs and provides much-needed visibility into API traffic across the entire enterprise.

As a result of this feedback and a growing amount of press on the importance of securing APIs, we remain bullish on the long-term growth prospects of our new API security offering. Switching gears to talk about our partners. We completed several important integrations with Amazon, CyberArk and iovation, and we continue to invest in our Microsoft partnership. For example, Ping and CyberArk jointly developed multiple integrations between CyberArk's Central Policy Manager and Ping's single sign-on and directory solutions.

We also enhanced our support for new AWS identity features so that customers can simplify fine-grained access to AWS resources. This integration was demonstrated at the AWS re:Invent conference this past December. As part of our partner enablement efforts, we launched a formal certification program to better train channel partners on Ping's solutions. While the program is relatively new, we certified over 200 security professionals in the second half of 2019.

In closing, we're extremely proud of our 2019 fourth quarter and full-year results, the enhancements delivered across our platform and our ability to contribute to the continued success of our enterprise customers. We remain bullish on our market opportunity and the continued tailwinds in identity and security broadly. We gain comfort in knowing that our business is diversified along several important dimensions including markets served, solutions and use cases offered. I would now like to turn the call over to Raj Dani, CFO of Ping Identity, to walk through the quarter and full-year results in more detail as well as provide our financial outlook for 2020.

Raj?

Raj Dani -- Chief Financial Officer

Thanks, Andre and everyone, for joining today's call. As Andre highlighted earlier, we are extremely pleased with our Q4 and full-year results. Before going to our financial results in detail, we would like to reiterate that Ping's Intelligent Identity platform is offered on a subscription basis, primarily under multiyear contracts with an average contract term of two years. Regardless of the subscription contract term, almost all of our customers are billed annually in advance.

Our subscription pricing model is based on the number of identities licensed by solution and by use case, customer, workforce, partner and IoT. As a reminder, under ASC 606, subscription term-based license revenue is recognized upfront, with the associated maintenance and support recognized ratably over the subscription term. SaaS-based revenue continues to be recognized ratably over the subscription term. This is an important dynamic given the nature of our revenues, which can be impacted by our hybrid cloud deployment model and contract duration.

As a result, under ASC 606, our quarterly revenue may exhibit a high degree of variability from period-to-period based upon the deployment decisions of our customers. To normalize for this, we believe that focusing on ARR or the annualized value of our subscription contracts and unlevered free cash flow, which are both unaffected by ASC 606, are important in assessing Ping's growth and operational performance. Now I'll turn to our fourth-quarter results. We ended the year with ARR of $224.9 million, which represents strong year-over-year ARR growth of 23%.

Growth was driven by a healthy distribution of base expansion and new logos across solutions and use cases and the continued drive by customers to leverage Ping's deployment flexibility wall-to-wall across the enterprise. Fourth-quarter total revenue was $68.2 million, representing 15% year-over-year growth. Subscription revenue accounted for 94% of total revenue or $64 million. In the fourth quarter, our dollar-based net retention rate was 115%, calculated on a trailing 12-month basis.

While this rate can vary from period-to-period, we have consistently achieved very strong dollar-based net retention rates of at least 115%. Unless otherwise stated, for the remainder of the P&L, I will refer to non-GAAP metrics. You can find a reconciliation of non-GAAP to GAAP numbers in the accompanying press release. Gross margin for the fourth quarter was 83%, and our GAAP subscription gross margin was 89%.

Our strong gross margins enable us to continue to invest in innovation and growth of the business without sacrificing profitability and cash flow. Total operating expenses in Q4 '19 were $45.9 million driven primarily by year-over-year growth in both research and development as well as sales and marketing as we made incremental investments focused on innovation, especially in our growing hybrid cloud offerings and in our go-to-market activities. Adjusted EBITDA in the fourth quarter was $12 million, representing a margin of 18%. Unlevered free cash flow was a use of $9.3 million during the fourth quarter, better than expected primarily due to strong cash collections.

Quickly touching on full-year 2019 highlights. Fiscal-year 2019 total revenue was $242.9 million, representing a 21% year-over-year growth. Full-year subscription revenue as a percentage of total revenue was 93%. Gross margin for the full year was 84%, and our GAAP subscription gross margin was 89%.

Total operating expenses in the fiscal year were $156.8 million. Adjusted EBITDA was $50 million, representing a margin of 21%, and our unlevered free cash flow was a use of $1.2 million. Note that our annual unlevered free cash flow is burdened by contingent deal consideration in the amount of $4.9 million. We ended the year with 38 customers spending over $1 million in ARR, representing 52% growth in this cohort year over year.

A core driver to this growth is our land-and-expand strategy and ability to deploy our solutions across the enterprise. For example, one of our long-standing Fortune 100 customers sought to move to a vendor-first model to manage identity, subsequently reducing ongoing maintenance costs associated with managing homegrown solutions. Additionally, the customer found that many business units were being held back from quickly releasing new digital products through to their supply chain due to inflexible identity systems. To remedy the situation, the customer expanded with Ping's SSO, access, directory, MFA and intelligence solutions for the workforce and partner use cases.

Ping was selected over competitors for the completeness of its platform, market leadership, enhanced self-service and ability to migrate over 1,500 mission-critical applications. As a result, the customer will be able to significantly consolidate vendors and internal systems, speed go-to-market efforts and improve employee and partner productivity. We are also seeing a growing phenomenon of customers buying multiple solutions and use cases at initial purchase. In Q4, a European services company went all in with Ping to secure customer, workforce and partner identities.

They are leveraging Ping's SSO, MFA, access, directory and intelligence solutions to create an improved mobile customer experience, streamline the collection, delegation and management consent processes and to remove the cost and technical burden of homegrown applications. Ping was selected over both the incumbent and modern vendors and will now serve as the critical component of enabling customer engagement and workforce productivity. Some of our newer solutions are beginning to see traction, such as API intelligence, which leverages AI to bring complete visibility and security to APIs. In addition to the win we highlighted in Q3, in the fourth quarter, an existing Fortune 100 financial services customer purchased PingIntelligence to secure all of their APIs across their API gateways.

Our balance sheet remains strong with $67.6 million of cash on hand at the end of the fourth quarter. In December, we refinanced our term loan with a $150 million line of credit. And as a result, we anticipate an approximately 250 basis point annualized interest rate improvement. Our revolving credit facility balance at December 31, 2019, was $52.2 million with a maturity date of December 2024.

We are confident that our existing capitalization structure will allow us to be a successful growth software company, and we are taking this opportunity to reinvest profits in the business. In Q1 of this year, we signed an agreement to acquire ShoCard. For the full year, we are forecasting no meaningful revenue contribution and an approximately $3 million impact to total operating expenses. We are excited to partner with the ShoCard team and leverage their technology to augment our adaptive MFA offering to include enhanced ID proofing.

Coupled with our MFA and other cloud offerings, we will continue to push the boundaries of innovation and provide our customers with the most comprehensive identity platform. Turning to guidance. It is important to reiterate that our quarterly revenue and adjusted EBITDA may exhibit a high degree of variability from period-to-period due to the overall impact of ASC 606 on our hybrid cloud deployment model. Additionally, given the nature of enterprise purchasing cycles, we do experience seasonality with the fourth quarter contributing the largest proportion of annual revenue.

For this reason, Ping relies primarily on ARR as the KPI for assessing top line performance over time. For the quarter end March 31, 2020, we project ARR to be between $228.5 million and $230.5 million. We further anticipate Q1 revenue to be between $60.5 million and $62.5 million with unlevered free cash flow to be between $6 million and $8 million. For the full-year 2020, we anticipate ARR to be between $263.5 million and $267.5 million; revenue between $263 million and $273 million; and unlevered free cash flow between $5 million and $9 million.

As further help in thinking about the expected seasonality of our revenue, we expect Q1, Q2 and Q3 to contribute relatively similar percentages of total fiscal-year revenue, with Q4 continuing to deliver the largest quarterly amount of revenue. We would also like to call out that our annual unlevered free cash flow guidance is burdened by certain onetime items such as the one mentioned in footnote 5 of the 10-K, the contingency payment of $4.2 million associated with our 2018 acquisition of Elastic Beam. Speaking to our unlevered free cash flow expectations specifically and as previously communicated, in 2020, we will continue to strategically invest for growth to take advantage of our large market opportunity. These investments will be primarily focused on sales and marketing, which include quota-carrying reps, training and enablement, channel partnerships and customer success.

These continued investments will bring total non-GAAP operating expenses as a percentage of ARR to slightly higher levels than in 2019, with a similar distribution across quarters in 2020 that we saw in 2019. We are encouraged by the early proof points we are seeing from these investments. Finally, for the full year, we expect stock-based compensation of approximately $18 million. In closing, we're pleased with our fourth quarter and full-year 2019 results, our customers' innovative and bold initiatives and our strong partnerships in the industry.

Ping remains positioned to be the premier security choice for large and global enterprises as they embark on their digital transformation journeys, and we look forward to sharing our progress throughout 2020. With that, I'll turn it over to the operator for your questions.

Questions & Answers:

Operator

[Operator instructions] The first question comes from Heather Bellini of Goldman Sachs. Your line is open.

Heather Bellini -- Goldman Sachs -- Analyst

Great. Thank you so much for taking the time. I had one question and then one follow-up. I guess I just wanted to follow up a little bit on the comment you made in your prepared remarks about the sale of multiple products into your installed base.

I was wondering if you could give us a sense of what is the product breadth of new customers that you're signing look like today. How does it compare to maybe what it was a year ago? And if you could share with us what's driving that. And then the follow-up question would just be related to anything you're seeing in your business or kind of conservatism in the outlook related to the COVID virus.

Andre Durand -- Chief Executive Officer

Thank you. Heather. This is Andre speaking. Let me make sure I got your first question right.

Were you asking about the trends related to customers, existing customers' uptake of multiple products?

Heather Bellini -- Goldman Sachs -- Analyst

Well, I was more wondering if you're seeing that with new customers where they're just starting at bigger size, like adding, that they're starting with more products today than maybe your new customers were a few years ago.

Andre Durand -- Chief Executive Officer

Yes. That is absolutely happening. So we are landing bigger on average. We are landing with a combination of products that make up solutions.

We see a lot of companies combine our single sign-on with our multifactor authentication to provide a centralized or global authentication authority for either their workforce or for their customers. And we are also seeing now customers, we mentioned one here in Q4, that are going all in. Literally all in on day one. All identity use cases and several of our solutions on day one.

So that is a trend. Secondly, you were asking about any impacts related to the coronavirus. I think first and foremost, our thoughts are going to be with the families that are impacted by coronavirus. And do know that we are following kind of all state department guidelines relative to kind of sensible travel policy.

That said, we are not today seeing an impact from the coronavirus in our business. And yes, so we have not had any conversations that have been impacted by that today.

Heather Bellini -- Goldman Sachs -- Analyst

Thank you very much.

Operator

Your next question is from Saket Kalia of Barclays. Your line is open.

Saket Kalia -- Barclays -- Analyst

Hey. Thanks. Andre, maybe just to start with you. Just broadly, can you just talk about the velocity of competitive displacements especially in the area of single sign-on versus larger legacy vendors like a CA Siteminder, for example? Can you just talk about that sort of competitive landscape?

Andre Durand -- Chief Executive Officer

Yes. Thanks, Saket. I'm just back from the RSA Conference where I had probably over a dozen conversations with existing customers as well as prospects. And I will say that the atmosphere has changed noticeably, probably since the Broadcom acquisition of CA, the acquisition of Symantec and kind of the known movement that Oracle has had away from their identity management stack.

I am kind of sensing a passion and energy and urgency to get off of those legacy systems that I frankly haven't seen in the past couple of years. So I think that bodes well for what we've been describing as the displacement or modernization of those legacy systems. And we've been in that space for years. We have the most proven solution relative to web access management replacement.

We have hundreds of success stories. We've migrated tens of thousands of applications. We have the best partner network. We've been investing in the migration tools that lower the cost and risk of IT with a lot of our self-service offerings.

And so I'm encouraged by what we're seeing there in the sentiment of these large enterprises.

Saket Kalia -- Barclays -- Analyst

Got it. That makes sense, and it's helpful. Maybe for my follow-up for you, Raj. You touched on this a little bit in your prepared remarks, but can you just talk about how you think about sort of cloud adoption or maybe even better, cloud contribution in 2020 to the business.

And just maybe review for us whether that has any impact on the ARR calculation if that mix increases.

Raj Dani -- Chief Financial Officer

Yes. Thanks, Saket. So we're continuing to see really strong adoption and momentum of all our cloud offerings. As we mentioned in the past, cloud continues to grow faster than the overall rate of our ARR as a business.

But we're really focused on cloud your way, right? We're focused on enabling our customers to essentially either deploy in our cloud or in their cloud. So that's essentially what we see in the enterprise in terms of cloud deployment. In terms of your question around the impact on ARR, that is the beauty actually of using ARR as our key go-to growth metric. Regardless of whether we sell software or cloud, which we're agnostic to for our customers, it does not impact ARR, right? So there would be no impact on whether a customer chooses cloud or software to our ARR metrics.

Saket Kalia -- Barclays -- Analyst

Got it. Very helpful guys. Thank you very much.

Operator

Your next question comes from Matt Hedberg of RBC Capital Markets. Your line is open.

Matt Hedberg -- RBC Capital Markets -- Analyst

Well, thanks for taking my questions. Well done on the quarter. Andre and, both, Raj, you both highlighted a few nice API intelligence wins this quarter, which is great to hear. I guess I'm sort of curious, when you approach customers with that product, is it considered an adjacency in their mind? Or is it sort of a different sales motion than sort of your core SSO or MFA products?

Andre Durand -- Chief Executive Officer

Thanks, Matt. A lot of times, we're talking to the CISO who cares about all things security for the enterprise. And when we typically ask the question of what either the visibility is or the understanding of the protection and the detection of hacks into their APIs, not uncommon for us to get a lot of blank stares. Most companies have done a decent job in recent years in leveraging the identity standard OWASP to protect kind of the front door of the API.

But these same companies have no visibility into the API traffic and/or anomalies or hackers who have somehow gotten behind the front door. These are our buyers, for certain. Now the reality is API security is, as we provide protection and visibility into these APIs, is new. And so many times, our existing buyers need to understand the threat and go back to their teams and understand what their teams are currently doing with regards to API security.

We kind of set the stage last year at the RSA Conference, and I did receive a fair number of kind of blank stares, if you will, when I asked the question what they were doing to protect APIs. I would say that the sentiment one year later at the RSA Conference is noticeably different. These same CISOs are saying APIs are mission-critical to the company. All of our most sensitive data, apps and services are connected to them.

We understand that we have to protect them. We want to start with visibility, and they are now interested in kind of moving to PoC. So I would say that there is a different selling proposition, value proposition with it. We're beginning to understand that as we bring this product to market.

But we are talking to the right center of interest in the product.

Matt Hedberg -- RBC Capital Markets -- Analyst

That's great. And then maybe as a follow-up to the coronavirus. Obviously, thoughts go out to everybody impacted on that. But I'm curious — and one of the byproducts could be more employees working remotely or from home.

I'm curious, outside of this event, how does remote workers or that trend benefits you guys when you think about application access?

Andre Durand -- Chief Executive Officer

Well, one of the benefits of identity-based security is that the entire notion of being on the network or, said another way, being in the building or being on the VPN becomes somewhat irrelevant to the security model. So when you hear about Zero Trust in its association with leveraging identity to allow anytime, anywhere access to any resources by people that are essentially anywhere, what you're really hearing is that a strong identity foundation, strong identity security and single sign-on to all application resources does allow a workforce to work from anywhere. So while I don't think the drivers are maybe as direct as everyone's going to go on video conferencing, companies that have good foundations in their identity and access management solutions, especially ones that have adopted strong authentication and single sign-on and are kind of adhering to the road map of Zero Trust, are in a really good position to allow their workforce to work from home.

Matt Hedberg -- RBC Capital Markets -- Analyst

Great. Well done, guys.

Operator

Your next question comes from Phil Winslow of Wells Fargo. Your line is open.

Phil Winslow -- Wells Fargo Securities -- Analyst

Thanks, guys. Congrats on a great quarter and great fiscal year. I just want to focus in on customer versus employee, the workforce side of your business because obviously, Ping is unique in the fact that you have those two businesses. I guess first question to Raj.

I wonder if you could remind us of just what the mix of ARR looks like there and just the growth rate trends you've been seeing. And then, Andre, when you think about just sort of the business and technology trends and what you're hearing from customers in those two segments, what's maybe changed versus a year ago or two years ago? And just what you're hearing, what you're thinking.

Raj Dani -- Chief Financial Officer

Thanks, Phil. So I'll tackle your first question. We're not breaking out necessarily ARR between the workforce and customer, but I will tell you that we have been relatively balanced for a long time. We actually grew up serving, with our one platform, serving all identity types.

So we have the scale and performance and capability within the Ping platform to be able to deliver regardless of the use case up to hundreds of millions of users of scale. So that being said, when you look at more recent trends, we are seeing that the newer ARR is leaning more toward customer, right? So the customer use case ARR is growing faster than the overall growth rate of the business. But overall, I'd say it has been balanced and will continue to be fairly balanced between the two.

Andre Durand -- Chief Executive Officer

I'll take the second piece of that. So in the customer market opportunity, we actually see two different opportunities, frankly. We are seeing companies that have digital transformation and especially user experience transformation initiatives that have grown through M&A over the course of the last 10 to 15 years, and the customer experience has become very fragmented across various service offerings that they might have acquired and/or built at a moment in time where all of the services were considered separate. In the new world, customers want to engage with the company through one log-in, one identity and see all products and services.

And this is what people experience when they have one Apple ID or a Microsoft ID or a Google ID or an Amazon ID. They have one identity to access all services. So we are seeing a modernization of legacy systems that is consolidating all of these disparate identity systems into a single large customer identity and access management system. These are typically large deals.

They're fairly complicated because we're dealing with environments that have been around for a long time. They're led by IT. As I said, the one customer log-in is the goal. Here Ping is uniquely qualified.

Our security, scale, performance, our advanced capabilities, all of our integrations make it possible for these large projects to happen. That's the first audience. There's a new audience of developers in line of business who are not thinking about the entire enterprise. They are thinking about how they're thinking about time to market and time to delivery of a new application.

And for them, they want a simple IDaaS, API-first solution to just code up identity inside of their app. Again, they're not thinking about the entire enterprise. And we have a new solution for them in our PingOne for customer that does target that developer in that line of business. So I want to make a distinction between those two.

In some senses, these lines of business are — create — or they're doing today what line of business had been doing for the last 20 years that is now getting consolidated by IT.

Operator

Your next question comes from Brad Zelnick of Credit Suisse. Please go ahead. Your line is open.

Brad Zelnick -- Credit Suisse -- Analyst

Fantastic. Thanks so much. I just wanted to get an update on some of the sales and marketing investments that you've been making. How far along are you in your plans? And what are your productivity assumptions in your full-year guidance for this year?

Andre Durand -- Chief Executive Officer

Raj, do you want to take that?

Raj Dani -- Chief Financial Officer

Sure. So Brad, we're in the midst of our sales and marketing investment, as we've talked about. It really started back in the planning process for 2019. So throughout 2019 and through 2020, we expect to see that hiring, training and enablement and productivity ramp increase.

We're really pointing to have in the past and continue to point to 2021 as the year when those investments mature and gestate. And that, coupled with the investments that we're making in all these new products and have made in all these new products, we're really also pointing to 2021 where the confluence of all those events occur.

Brad Zelnick -- Credit Suisse -- Analyst

And maybe if I could follow-up with Andre. Andre, I just wanted to quickly touch on the two new solutions you recently released, Customer360 and Workforce360. Could you maybe give us an idea of how that builds on the existing product portfolio and what new use cases you're addressing? Thanks.

Andre Durand -- Chief Executive Officer

Yes. Happy to. So we observed that many of our large and successful companies were following the same evolution, if you will, in essentially leveraging, starting with single sign-on, then adding multifactor authentication, and at times, unifying the profiles of either their workforce or their customers in our user directory. And so the Customer360 and Workforce360, if you look at those capabilities, what they actually are or what they actually enable is a global authentication authority or a centralized authentication service for the entire enterprise.

The idea being users strongly authenticate to a single source of truth. And then from there, they leverage standards and single sign-on to gain access to all the applications and resources they need access to. The Customer360 and Workforce360 combine our best solutions into a single solution package with one price with professional services bundled, with all of the best use cases preconfigured to get to better and faster time to value.

Operator

Your next question comes from Walter Pritchard of Citigroup. Please go ahead. Your line is open.

Drew Foster -- Citi -- Analyst

Hey, guys. This is Drew Foster on for Walter. Thanks for taking our questions. All right.

We did some recent survey work that suggests that CISOs are actually looking to consolidate their identity and access management platforms with their identity and governance administration platforms. I'm just wondering if that's something that you can corroborate hearing more of in the field. And how are you planning on adapting to sort of those changing preferences?

Andre Durand -- Chief Executive Officer

Yes. Thanks for the question. We are not seeing customers ask for a consolidation, say, between us and our partners, CyberArk, SailPoint and others. So maybe that is an ask that is downstream from the enterprise market that we serve.

Enterprises expect best-in-class solutions. It's why we have strong partnerships with the companies that I mentioned and others. And we're pleased with our partnerships and frankly, doubling down on those. We do want to make it easy for customers who happen to be deploying either governance or privileged access management along with Ping's authentication services and access management.

Certainly want to make it easy around the integration of various use cases, and that is the reason why we're investing in the integration of our products with those companies. Many of the partners that we partner with also have practices with our partners, so they know all the technologies involved. But we are not seeing pressure or commentary along those lines.

Drew Foster -- Citi -- Analyst

That's really helpful. Thanks. And then I was just wondering if you could put some color around any change here in the combination of factors that have helped you sustain your dollar-based net retention rate above or near 115% here for the last six quarters just in terms of seat expansion versus other things. Thanks.

Raj Dani -- Chief Financial Officer

Well, it's really a combination of things, Drew, in terms of how we grow within our existing base. They can buy additional solutions for a use case that they already have like workforce, or they may expand with similar products into a different use case. Or they could expand just the number of identities, which is essentially covered also, just buying more solutions, use cases. What we're seeing is we deliver great value to our customers where we take pride in the time to value and value for money.

And customers see that, and we land quick with them, and then we expand with them. And what we're seeing is that the expansion is coming more from our ability to sell through additional solutions to them as well as additional use cases. It's less so on just seat count because these enterprises typically buy in fairly large bands of identities. So it's really from the first two.

Andre Durand -- Chief Executive Officer

And I would add to that. Maybe the only headwind to the net retention rate, it goes to the first question I think Heather had, which is we are seeing larger lands. And so right up front, they're buying multiple products, and on day one, maybe they've consumed some of what might have been the natural expansion that we would have seen in that year.

Operator

Your next question comes from Gur Talpaz of Stifel. Please go ahead. Your line is open.

Gur Talpaz -- Stifel Financial Corp. -- Analyst

OK. Great. Thanks for taking my question. Andre, you mentioned in your prepared remarks regulation briefly.

I want to drill into that. Have you seen initiatives like GDPR and CCPA, drive a shift in awareness or interest in CIM?

Andre Durand -- Chief Executive Officer

We absolutely have. So this privacy regulation is kind of creating a demand for a new capability, which the identity management systems did not offer out of the box. In particular, I'm pointing to consent management. Companies are now required to gather the consent of their users and then propagate that consent to all the systems that might be sharing information about that user with third parties.

And so we have actually built out-of-box capabilities in our directory and other services that actually capture and manage consent on the behalf of consumers. The second part to that question is a little bit deeper, which is enterprises are now challenged as a result of this regulation and the associated fines with ensuring that only the right partners have access to your personal information. So it's not enough to simply say, "Has the user consented?" They actually also have to map that to the requesters that are requesting that information. That is driving demand for a new solution that we introduced last year called identity data governance, the PingDataGovernance product.

Think of this as a product that sits over the top of all of the APIs that are connected to your identity information across the entire enterprise. Not uncommon to have enterprises have your information in hundreds of different repositories. Sits over the top of all of them and allows the company to define a set of policies as to who can receive what information, which partners can receive your information. And if it sees a request, say, for example, of your social security and that partner is not allowed to see that, this product will literally strip it out of the response.

This is allowing companies to get a better centralized control over the policy of data sharing, hopefully, stay out of the way of these fines. But that product is directly driven on the heels, the demand of that product based upon the regulations and the associated fines.

Gur Talpaz -- Stifel Financial Corp. -- Analyst

That's really helpful. And maybe one more for you, Andre. Just going back to the API security product. As you noted, it feels like there's really a lot of movement in the space coming out of RSA, and you've been ahead of the curve.

But how do you see yourself positioned versus, I think, the new round of pure-plays kind of coming out of there and getting early funding these days.

Andre Durand -- Chief Executive Officer

We have a pretty significant lead, technology lead, I would suggest. The company that we acquired was in stealth for nearly 4 years. And then Ping has accelerated that in the last couple of years once they've joined the Ping team. So I feel we are in a really good position, in first-mover advantage position to take advantage of what's coming in our direction.

The other thing here is that these API security programs, there are multiple facets to what needs to happen to protect APIs. Ping today already provides the OWASP standards to protect the front door of the APIs. This is now a second level of defense. As I just mentioned, providing data governance over the APIs is the third leg to the stool.

So when we go into a customer and we talk about their API-first initiatives, what are they doing to protect their APIs, what are they doing to make sure that the wrong data doesn't lead through those APIs, Ping has a very comprehensive story here.

Gur Talpaz -- Stifel Financial Corp. -- Analyst

Very helpful. Thank you.

Operator

Your next question comes from Tal Liani of Bank of America. Please go ahead. Your line is open.

Tal Liani -- Bank of America Merrill Lynch -- Analyst

Hi, guys. I have just a quick question first on the guidance and then a question on the business. On the guidance, you beat expectations by $8 million, but the outlook for the year is $3 million above. So that means you're effectively reducing the guidance by $5 million for the rest of the year.

This is not what you mean, but that's kind of that's the embedded part in the numbers. So the question is why are you conservative through the rest of the year. And what are the factors that could drive better performance for the remaining quarters? So that's number one. And number two, I want to — why don't you answer this, and then I'll go on the other one.

Raj Dani -- Chief Financial Officer

OK. OK. Sure, Tal. Thanks.

So our guidance philosophy is to guide to the best view of where we see the year today. And we continue to see strong demand, and we're excited about all the new products that we're investing against, as we've talked about. But we are cautious as to how we model the impact of these new products, which could certainly be accelerants. We're seeing early proof points.

But every quarter, we will update you on that. And I'll just leave it with the demand for Ping is very strong in the enterprise, and we expect that to continue.

Tal Liani -- Bank of America Merrill Lynch -- Analyst

Got it. So there's no change in the way you see the environment versus two quarters ago when you went public, it's more of your conservatism versus the upside this quarter. I don't want to put words into your mouths, but that's what my understanding.

Raj Dani -- Chief Financial Officer

Yes. I would just say it a little differently. I just think I'd just say our philosophy is to guide to where we have visibility. We're constantly looking at pipeline.

We're triangulating with our customers as well as getting current data from our field, and that's how we come up with our guidance. So...

Tal Liani -- Bank of America Merrill Lynch -- Analyst

OK. The second question is about the numbers also. Your opex was up, roughly, if I do the math, about $4 million above what we expected, what the Street expected. Majority is in R&D.

Where is it going to? Why do we see higher opex? And what's the outlook for the rest of the year. You touched on it a little bit before.

Raj Dani -- Chief Financial Officer

The R&D for Q4?

Tal Liani -- Bank of America Merrill Lynch -- Analyst

Yes. Hold on. Why don't you answer just about the opex? The opex was about $46 million. The Street was at $42 million.

So for this quarter, it was about $4 million above expectations. And sales and marketing, I'm sorry, I said R&D. Sales and marketing is the majority.

Raj Dani -- Chief Financial Officer

Yes. Yes. And that's fairly consistent, Tal, with the messaging that we've been giving from the get-go is we've invested in R&D and in product. We've introduced several new products which we're very encouraged by the early traction we're seeing.

And now we're really putting our muscle behind the sales and marketing engine there. So to the extent we have opportunities to invest in channel, to invest in sales enablement, quota-carrying reps, customer success, all those areas to help drive further growth, we're doing that. And that's what you see in our numbers.

Operator

Your next question comes from Michael Turits of Raymond James. Please go ahead. Your line is open.

Michael Turits -- Raymond James -- Analyst

Back on the legacy replacement side, are you seeing any more of Okta with their Access Gateway?

Andre Durand -- Chief Executive Officer

The Okta Access Gateway has not been present in our large legacy WAM replacements. And I think that's largely due to the fact that we become so proven as a replacement of those systems, having done so many systems, migrated tens of thousands of apps, with the network and reputation. These are probably some of the scariest transitions companies will go through. You can really sense, they're connected to everything, first of all.

They're typically protecting mission-critical applications, the teams that are involved in this. I would say there is an era of conservatism that goes along with any change that is this mission-critical to those things. And in those environments, Ping has invested for several years in our product. It's very mature.

It's very proven. And as a result of that, every big legacy replacement, WAM replacement that we've seen, it's Ping. It's only Ping.

Michael Turits -- Raymond James -- Analyst

And then just a follow-up. Can you talk about the take rate, especially from larger enterprises on PingOne, both for enterprises as well as for consumer?

Andre Durand -- Chief Executive Officer

Yes. Well, as I said, most of our enterprises are hybrid. It turns out that many large enterprises also leverage the Ping solution in kind of a hybrid fashion. Not uncommon for our large customers to deploy our software in their data center to integrate all of the on-prem assets, if you will, simultaneously leverage PingOne to connect all of their SaaS and cloud applications.

And so many of our large customers have deployed us exactly that way. They're leveraging our cloud service to connect to the cloud. They're leveraging our software to connect to essentially legacy and on-prem. And on that front, we've had really solid adoption.

PingID, shall I point out, is essentially our MFA. It is a service of PingOne. And we have hundreds and hundreds of customers leveraging that product now.

Operator

Your next question comes from Jonathan Ho of William Blair. Please go ahead. Your line is open.

Jonathan Ho -- William Blair and Company -- Analyst

Good afternoon. I'm just curious. What percentage of Ping deployments are actually in AWS now? Does this sort of follow the general listed shift trends that we're seeing out there? And maybe why do folks opt to use Ping rather than a native AWS offering or a public cloud offering?

Andre Durand -- Chief Executive Officer

I'll start with the last part. There really is no native cloud offering to Ping for a customer that wants to deploy Ping in their AWS or Azure. While I don't have that percentage, we've just, I would say, in the last maybe two quarters begin to inventory the companies that have been deploying Ping in their cloud of choice. As I've said I think in the prior call, many of our largest implementations have been deployed, many of them in AWS.

And we've got one company with over 150 million users running in the PingDirectory, authenticating through to PingFederate in their AWS instance. I think I reported recently, there was an event ticketing company that has deployed Ping also in their AWS instance. And the transaction volumes of that company are just unbelievable, through the roof. This is a trend we're following very closely.

It's why we've invested in dev ops and the containerization and really an evolution toward cloud native, of all of our most advanced capabilities. And we are seeing that as a primary deployment model for the future. We are delivering our software in such a way that those companies can deploy the entire Ping platform in their cloud of choice really inside of minutes in some cases. What we're also seeing is those companies are deploying this in their own dev ops program and kind of according to the security model and all the other kind of dev ops best practices that they have going.

We're seeing that consumption model, especially for the large customer-facing use cases, as being a kind of a preferred deployment model.

Jonathan Ho -- William Blair and Company -- Analyst

That's helpful. Thank you. And then just in terms of the channel engagement, I think you talked a little bit about, I guess, launching some new programs in terms of training. Can you talk about some of the initiatives that you're engaging with the channel a little bit more as you continue to build out that go-to-market effort? Thank you.

Andre Durand -- Chief Executive Officer

I would say that that probably is the primary effort under way right now. So we're really proud of the team for having developed the certification program. And the primary audience for that outside, obviously, our customers who are deploying Ping is essentially the channel and partners that are trying to train up to keep pace with the demand of the professional services around many of our implementations. So that is the primary focus.

Operator

Your next question comes from Gregg Moskowitz of Mizuho Securities. Please go ahead. Your line is open.

Gregg Moskowitz -- Mizuho Securities -- Analyst

OK. Thank you very much. Good afternoon, guys. Maybe in the interest of time, I'll just keep it to one.

So for either Andre or Raj. You added around 80 new logos on a net basis in 2019, which is much better than the prior year. And I know that the customer count in 2018 was impacted by a low level of churn in a segment that you were effectively deemphasizing. But I guess the question is, as you look ahead to 2020, do you think the number of net adds that you had last year are sustainable or potentially even something that you can further improve upon.

Andre Durand -- Chief Executive Officer

Well, we can't comment on that last part of your question, but let me say this. We are seeing great traction in landing new customers with both our SaaS offering, our customer identity offering, our MFA offering and our API offering. All of those are driving new logos for us. We are focused on growth in new logos now.

We have a dedicated team focused on that, that we didn't have in prior years. And we have, as Raj said, been increasing our sales and marketing investment, and we do have focus in those teams on new customer acquisition. So last year was a good year, for certain. We began focusing on it again last year.

And I would expect that that focus continues into 2020 and does accelerate.

Gregg Moskowitz -- Mizuho Securities -- Analyst

Very helpful. Thank you.

Operator

Your next question comes from Shaul Eyal of Oppenheimer. Please go ahead. Your line is open.

Shaul Eyal -- Oppenheimer and Company -- Analyst

Thank you. Good afternoon, guys. Thank you for squeezing me in. Congrats on the ongoing performance and outlook.

Andre, can you talk to us about the length of the typical sales cycle as it relates to PingIntelligence? And also just a word about international versus domestic business during the quarter and as it relates to the fiscal '20 outlook. Thank you.

Andre Durand -- Chief Executive Officer

OK. I'm going to have Raj answer that second point. But with respect to sales cycles of API intelligence, we are, as we said, in early innings of that one. I guess we can start to model what that looks like right now.

But frankly, we've been so focused on making sure customers understand the product, that they have successful PoCs. And now the customers that are in production, we're looking to see that they're successful in what they have purchased from us, in detecting and blocking anomalies in their system and building visibility for API traffic. My sense, if I were going to project on this product into the future, this product is a little bit different than other products that we offer in identity management where integration is a prerequisite and a pretty significant prerequisite before customers see the value of the implementation. This is a product that goes in with a much lighter footprint, if you will.

We run agents to the side of the existing API gateways that companies are already running to manage their APIs. And as a result of that and as a result, I think of the fact that this is all about protecting APIs that we know are being attacked today, I suspect we are going to see a shorter sales cycle from kind of PoC and trial to ultimately purchase. As a result, as I said, of the attacks are coming, they're already on the APIs, number one. And number two, the integration model itself is enhanced by the fact that we've done all of this pre-integration work with all of the API management gateways out there.

Shaul Eyal -- Oppenheimer and Company -- Analyst

Got it. And then what about international versus domestic?

Raj Dani -- Chief Financial Officer

Yes. I'll take that second question, Shaul. Basically, when we look at our investments over the last couple of years, we have expanded quite significantly in EMEA and ANZ in particular. We don't have direct exposure to Asia.

And I will say that our international ARR in those regions in EMEA and ANZ, where we focus, is growing faster than the overall rate of the business in North America. So it continues to be strong. From a GAAP revenue standpoint, we do disclose that. As you'll see in the 10-K, it's still just shy of about a quarter of our revenue.

And we continue to see strong demand, strong demand in EMEA and all our international regions where we operate.

Operator

Your last question comes from Gray Powell of BTIG. Please go ahead. Your line is open.

Gray Powell -- BTIG -- Analyst

Hi. Great. Thanks for coming in. I'll be quick.

Where do you think most enterprises are on the adoption curve with MFA? And then how should we think about the growth profile of that product category over the next 12 to 18 months relative to the rest of the identity stack?

Andre Durand -- Chief Executive Officer

I think we still have a long ways to go on MFA. We have had for some time an MFA everywhere campaign. It is a fact that passwords are the weak link in the security models of all of these enterprises. Putting MFA on everything is critical.

It's our belief that the correct way to do that in enterprises is not to put MFA on every app individually but centralized authentication, enable strong MFA authentication to a central or global authentication authority and, from there, leverage single sign-on and standards to gain access to all the applications across the hybrid enterprise. But we are still in early innings. MFA has a long ways to go before it has covered every single application in the market.

Gray Powell -- BTIG -- Analyst

Got it. That's helpful. Thank you very much.

Operator

There are no further questions at this time. I will turn the call over to Andre Durand for closing remarks.

Andre Durand -- Chief Executive Officer

Thank you. So I want to thank everyone for joining today's earnings call. We certainly appreciate your time and the thoughtful questions. We look forward to the upcoming year, and we're excited to continue Ping's mission of securing the digital world through Intelligent Identity.

Thanks, everyone.

Operator

[Operator signoff]

Duration: 68 minutes

Call participants:

Hugo Doetsch -- Vice President of Finance, Strategy and Corporate Development

Andre Durand -- Chief Executive Officer

Raj Dani -- Chief Financial Officer

Heather Bellini -- Goldman Sachs -- Analyst

Saket Kalia -- Barclays -- Analyst

Matt Hedberg -- RBC Capital Markets -- Analyst

Phil Winslow -- Wells Fargo Securities -- Analyst

Brad Zelnick -- Credit Suisse -- Analyst

Drew Foster -- Citi -- Analyst

Gur Talpaz -- Stifel Financial Corp. -- Analyst

Tal Liani -- Bank of America Merrill Lynch -- Analyst

Michael Turits -- Raymond James -- Analyst

Jonathan Ho -- William Blair and Company -- Analyst

Gregg Moskowitz -- Mizuho Securities -- Analyst

Shaul Eyal -- Oppenheimer and Company -- Analyst

Gray Powell -- BTIG -- Analyst

More PING analysis

All earnings call transcripts