Image source: The Motley Fool.
Proofpoint Inc (PFPT)
Q3Â 2020 Earnings Call
Oct 29, 2020, 4:30 p.m. ET
Contents:
- Prepared Remarks
- Questions and Answers
- Call Participants
Prepared Remarks:
Operator
Good day, and welcome to the Proofpoint Third Quarter 2020 Earnings Results Conference Call. Today's conference is being recorded. At this time, I'd like to turn the conference over to Mr. Jason Starr, Vice President, Investor Relations. Please go ahead, sir.
Jason Starr -- Vice President, Investor Relations
Thanks, Cody. Good afternoon, and welcome to Proofpoint's Third Quarter 2020 Earnings Call. Today, we'll be discussing our results for the third quarter, as detailed in the press release that we issued after the market close this afternoon, a copy of which is available on the Investor Relations section of our website. Joining me on the call are Gary Steele, Proofpoint's Chief Executive Officer and Chairman of the Board; and Paul Auvil, Proofpoint's Chief Financial Officer.
During the course of this call, we will make forward-looking statements regarding future events and the future financial performance of the company which are subject to material risks and uncertainties that could cause actual results to differ materially. Of note, we believe that the COVID-19 crisis creates additional complexity when it comes to providing a forward-looking view of the business, and we're providing our guidance on a good-faith basis for recent SEC recommendations.
We caution you to consider the important risk factors contained in the press release and on this conference call. These risk factors are also more fully detailed under the caption Risk Factors in Proofpoint's filings with the SEC, including our most recent Form 10-Q. These forward-looking statements are based on assumptions that we believe to be reasonable as of today's date, October 29, 2020. We undertake no obligation to update these statements as a result of new information or future events.
Also, it is Proofpoint's policy to neither reiterate nor adjust the financial guidance provided on today's call unless it is also done through a public disclosure such as a press release or through the filing of a Form 8-K. We will present both GAAP and non-GAAP financial measures on today's call. These non-GAAP measures exclude a number of items as set forth in our release. These non-GAAP measures are not intended to be considered in isolation from, a substitute for, or superior to our GAAP results, and we encourage you to consider all measures when analyzing Proofpoint's performance.
A reconciliation of GAAP to non-GAAP measures and a list of the reasons why the company uses these non-GAAP measures are included in today's press release. Finally, in addition to reading our press releases and SEC filings, we encourage investors to also monitor the Investors section of our website at investors.proofpoint.com as we routinely post investor-related information such as news and events, financial filings, webcasts, presentations and other relevant materials to it.
So with that said, I'll turn the call over to Gary.
Gary L. Steele -- Chief Executive Officer and Chairman of the Board
Thanks, Jason. I'd like to thank everyone for joining us on the call today. We are very pleased with our third quarter results, which came in above our expectations with revenue of $267 million, up 17% year-over-year, and free cash flow of $65 million, which equates to a free cash flow margin of 24%. These strong results demonstrate the financial leverage intrinsic to our business model, built on a foundation of 98% recurring subscription revenue, a high renewal rate and a highly efficient set of cloud-delivered solutions. I'd also like to take a moment to highlight that we have now surpassed $1 billion in revenue on a trailing 12-month basis, the first SaaS-based cybersecurity company to accomplish this milestone.
The current work-from-home mandates and our unique visibility into an increasingly active threat landscape continue to highlight the importance of Proofpoint's people-centric security and compliance services. Overall demand for our services was strong in the quarter with continued momentum in our email security offerings, complemented by strong performance from our emerging products, such as Email Fraud Defense, or EFD; Cloud App Security Broker, or CASB; Security Awareness Training, or PSAT; and Insider Threat management, or ITM.
The competitive environment remains favorable and our people-centric approach to cybersecurity and compliance is resonating with our customers and prospects alike, as evidenced by our continued high win rates, robust demand for our emerging products and the ongoing traction with our product bundles. As enterprises around the world remain in a work-from-home environment with employees often operating beyond the reach of traditional on-premise security controls, many security teams are increasingly realizing that the traditional enterprise perimeter has effectively shifted from the network to their individual employees. In other words, it is people, not infrastructure, that define a new perimeter, making Proofpoint's unique people-centric approach to cybersecurity and compliance even more relevant in enabling enterprises to protect their end users from advanced threats while also safeguarding their most sensitive data.
While Proofpoint established a clear leadership position for advanced threat protection for email through our protection Targeted Attack Protection and Email Fraud Defense capabilities, as we shared last quarter, we also see an attractive opportunity to disrupt the data loss prevention market, which we believe will represent a market opportunity in excess of $3 billion by 2024. To address this opportunity, we launched our enterprise data loss prevention service on schedule in September as originally targeted at the time of the acquisition of ObserveIT in November of last year. Proofpoint Enterprise DLP integrates our DLP capabilities across email, the cloud and endpoint to fundamentally reimagine how organizations protect their most critical information.
Legacy solutions are based on architectures that were developed 15 years ago and that's born during an era that was focused on a data-centric view of the problem with the primary focus of trying to classify and protect information across the places it should be and, importantly, where it shouldn't be, all designed around an on-premise world with a defined network perimeter and limited remote work. The advent of the cloud has revealed the shortcomings of that historical approach and, as such, creates an opportunity to solve the problem much more effectively. With a cloud-native people-centric solution, enterprises will finally be able to not only just -- not just content classification but also user behavior and threat context to assess in real time what users are doing with critical-intensive data across their myriad of venues where it resides, including email, cloud and endpoint.
Where risky behaviors involved, security teams can dial up their level of monitoring and take advantage of our market-leading Insider Threat Management capabilities all with a single agent and unified investigation interface and ultimately take action as needed. Overall, we're seeing good traction in the various ways customers buy our DLP services across email, cloud and endpoint, and this is becoming an additional and effective entry point into accounts we haven't penetrated through our traditional advanced threat go to market. In particular, our CASB solution has seen a noticeable uptick in demand, including several six-figure ARR transactions that closed this past quarter, powered by our industry-leading combination of rich DLP capabilities, advanced threat protection and unified visibility all applied to a broad variety of cloud venues, including Office 365, Slack, Box, DropBox, Azure, AWS, Salesforce and ServiceNow. Additionally, our Insider Threat Management service continues to gain momentum with customers with several transactions closed in the quarter.
During the current work-from-home environment, many of these customers have described a keen interest in gaining visibility into their remote users and the sensitive data they're interacting with on endpoints while off the corporate network. And we believe our ITM offering will represent yet another driver of growth for Proofpoint in the coming quarters. Now turning to some of our key operating results during the third quarter. The rapidly changing threat landscape and the accelerating transition to the cloud and the migration to Office 365, in particular, continue to be the key secular trends that are helping to drive demand for Proofpoint's full suite of security and compliance solutions.
The work-from-home environment continues to reinforce email security as one of the most important vectors for security teams to protect, and we had a solid quarter of new protection and TAP wins as we continue to effectively demonstrate the strength of Proofpoint's products when compared to the baseline security solutions provided by Microsoft as part of their Office 365 bundles. Examples of customers who had moved to Office 365 and subsequently decided to upgrade their security capabilities with Proofpoint during the third quarter included a Global 2000 financial services company that purchased a P0 bundle for 60,000 users; an international retailer that purchased protection and TAP for 55,000 users; and a Fortune 500 packaging company that added protection and TAP for 35,000 users.
We are also pleased with the success of our add-on sales into our customer base, which contributed approximately 60% of our new annual recurring revenue growth this quarter. In particular, we are very encouraged by the ongoing strength in demand for our emerging products, which represented over 40% of the total new and add-on business closed during the quarter led by strong demand for Proofpoint Security Awareness Training, Email Fraud Defense, Cloud App Security Broker, Threat Response and Insider Threat Management. We also continue to make progress in our bundling initiative in support of these emerging products through our P0 through P3 offerings. These bundles aggregate our advanced threat and compliance capabilities into holistic solutions for customers.
This can range from a P0 or P1, which provide customers advanced email security through a combination of protection, Targeted Attack Protection, Email Fraud Defense, Threat Response and Security Awareness Training; to a P3, which provides a full people-centric security and compliance solution with 14 products, including browser isolation, CASB as well as more advanced versions of DLP, encryption and Security Awareness Training. We believe that these bundles make it easier for customers to consolidate their spending with Proofpoint and more easily consume our broad set of capabilities while also greatly simplifying the selling process for our sales teams and our channel partners. Bundled products again contributed nicely to our Q3 results with over 200 deals closed in the quarter, including a pharmaceutical company that purchased the P1 bundle for 50,000 users; a Fortune 1000 chemical manufacturing company that purchased the P1+ bundle for 25,000 users; and a hospitality and travel company that purchased the P2+ bundle for 6,000 users.
In our archiving business, we are seeing strong demand from our midsize -- for our midsize companies and won several new financial and healthcare customers in the third quarter, including a Fortune 500 technology company that expanded their archive to 45,000 users; and a Fortune 500 insurance company that expanded their archive deployment for an additional 28,000 users. We are also pleased with the recent launch of our Content Capture capabilities for Microsoft Teams and Slack. As these digital collaboration tools gain traction in the market, they need to capture, retain and review employee digital communications content, has been a key inhibitor that has slowed the adoption of these new collaboration tools by regulated industries.
With the launch of our capture services, we are now able to help companies embrace these solutions for expanded communications while ensuring digital communications is compliant just as we do with our email archiving service. We believe these new capabilities will represent another compelling growth opportunity not only in terms of adding new accounts but also serving as an attractive source of add-on sales opportunity into our installed base. Our technology ecosystem partnerships continue to help drive our pipeline, expand our market reach and increase our overall value customers by delivering an integrated framework across the family of best-in-class security solutions, including CrowdStrike, CyberArk, Okta, Palo Alto Networks, SalePoint and Splunk.
We had several wins this quarter that were influenced by these integrations, including a Global 2000 beverage manufacturing company that purchased protection and TAP for 30,000 users; and a Global 2000 mining company that purchased a P0 bundle for 7,500 users. Turning to our international operations. Overall, international revenue represented 21% of total revenue and grew 23% year-over-year. In addition to the Global 2000 wins just mentioned, other notable international transactions closed during the quarter included a Global 2000 financial services firm that purchased protection and TAP for 15,000 users; and a multinational electronics company that purchased TAP and protection for 10,000 users. So in summary, we are very pleased with our strong Q3 results and our market momentum.
Our operating strategy is progressing very well even in the face of COVID-19 headwinds. Our product road map is exceptional, and we believe the investments we're making today, coupled with the strong secular trends driving our market opportunity, have us well positioned to gain share, reinforce our competitive position and build the leading people-centric cybersecurity and compliance franchise in the years ahead. I'd like to close by thanking our employees around the world for their continued execution, hard work and dedication during the current crisis and maintaining our focus on protecting our customers from their advanced threats and compliance risks they face in this unprecedented operating environment.
With that, let me turn it over to Paul.
Paul R. Auvil -- Chief Financial Officer
Thanks, Gary. We were quite pleased with our operating results this quarter, which peaked our updated guidance on all metrics. Revenue totaled $267 million, up 17% year-over-year and above our guidance range of $260 million to $262 million. Our Q3 billings were $294 million, a solid result given the headwinds that we continue to face from the vertical markets that are more heavily impacted by the current crisis, such as retail, travel, energy and parts of the healthcare industry, which collectively represent just over 20% of our installed base as measured through billings. As expected, our ARR retention rate dropped just below 90% in the third quarter.
But when excluding the reduction in seat counts stemming from layoffs and furloughs, this result would have been above 90%, consistent with the results recorded in all of our prior quarters since our IPO in 2012. Looking forward, as discussed on our prior call, we do expect to operate with this nominally higher headwind as the furloughs and layoffs associated with the pandemic persist. It is important to keep in mind that just as we saw during the recovery from the Great Recession over a decade ago, we do expect that this temporary uptick in churn, driven by the current layoffs and furloughs, will recover in the form of user-based license growth when the crisis wanes and these industries regain their footing. As a final point regarding billings, I would like to note that as we had outlined during our call in July, billings duration for Q3 was essentially unchanged from Q2 with long-term deferred revenue holding steady at just over 20% of total deferred revenue as of the end of the period.
We expect the duration will likely remain under pressure during the crisis as compared to the same period last year as companies try to preserve cash given the current economic environment. Turning to expenses and profitability for the third quarter. On a non-GAAP basis, our total gross margin was 81%, just above our expectations, driven by our strong revenue performance. This result puts us in the top quartile of all publicly traded SaaS companies and stands as a testament to the efficiency with which we operate our global cloud operations around the world. During the third quarter, total non-GAAP operating expenses increased 14% over the prior period to $168 million, representing 63% of total revenue. Moving down the income statement.
On a GAAP basis, we recorded a net loss for the third quarter totaling $32 million or $0.55 per share based on 58 million shares outstanding. We reported non-GAAP net income of $38 million, well above our guidance range of $24 million to $26 million, driven by our ongoing focus on controlling discretionary spending during the current pandemic, including reducing travel spending and entertainment as well as our shift to holding virtual customer events instead of in-person gatherings. These lower spending amounts due to the pandemic amounted to over $6 million in savings during the quarter spending, which we expect will eventually return as to crisis wanes over the course of the next year.
We also had delayed some marketing programs from Q3, which will create additional spend in the final quarter of the year as compared to our prior guidance back in July. Moving on to EPS. Non-GAAP earnings per share for the quarter was $0.59 per fully diluted share, above our guidance range of $0.37 to $0.40 based on 66 million shares. The EPS calculation applies the if-converted method to our convertible notes due in 2024 and, as such, assumes the conversion of approximately six million shares and adds back just under $0.5 million in cash interest associated with this debt instrument. In terms of cash flow, we generated $86 million in operating cash flow, which included $9 million in reimbursement for tenant improvements associated with our corporate headquarters project.
As a reminder, this result also reflected a onetime cash tax payment of $12 million for the transfer of intellectual property associated with our acquisition of ObserveIT, which was $3 million less than our guidance assumptions for back in July. We invested $21 million in capital expenditures, of which $12 million was associated with our new headquarters, resulting in free cash flow for the quarter of $65 million, well above the high end of our guidance range of $16 million to $21 million and representing a free cash flow margin of 24%. While this upside was principally driven by the strong billings linearity during the quarter, which helped to accelerate some cash collections into Q3 that otherwise would have been collected in Q4, it also provides a clear reminder of the significant operating leverage embedded in our financial model, as we consistently demonstrated in our financial results in both 2018 and 2019 prior to the onset of the pandemic.
Before moving on to guidance, I'd like to provide a brief update regarding our recently announced share repurchase program, which was approved by our Board in August. This evolution of our capital allocation strategy enables us to purchase up to $300 million of common stock over the course of the program, supported by our strong cash balance of over $1 billion and our ongoing generation of free cash flow. We believe that this is an effective means of providing additional value to our shareholders while also enabling us to continue our ongoing investments in our growth, such as our many investments in R&D as well as our disciplined approach to M&A. We implemented a 10b5-1 plan to get the program started in mid-September, and over the final two weeks of the month, we purchased a total of 112,000 shares at an average price of $105.
Thus far in the month of October, we have repurchased an additional 428,000 shares with an average cost of $108 or $46 million invested in total. We continue to view Proofpoint stock as an attractive investment at the current levels, given our execution and growth opportunity, and we will provide updates on this repurchase program in our upcoming quarterly calls. Now let's move on to guidance for the rest of the year. We are increasing our 2020 revenue guidance to approximately $1.043 billion to $1.045 billion, representing an increase at the midpoint of $8 million, reflecting 18% growth year-over-year. This infers a range for the fourth quarter of $268 million to $270 million, representing 11% growth year-over-year for Q4 and a raise against our implied Q4 guidance from the prior quarter.
Note that, in Q3, our hardware and services revenues benefited by approximately $3 million due to a handful of archiving and port projects that we completed during the quarter, as well as an appliance refresh with a large financial services customer that runs a private cloud deployment in their own data centers. We do not expect a similar benefit here in the fourth quarter. We expect annual and fourth quarter non-GAAP gross margin to be approximately 80%. In terms of guidance on net income, for the full year, we are increasing our net income guidance by $15 million at the midpoint from our prior range of $106 million to $110 million to an updated range of $122 million to $124 million, which equates to $1.88 to $1.91 earnings per share based on 66 million fully diluted shares outstanding. In terms of a tax rate under C&DI, for 2020, we expect a rate of approximately 17%.
Note that this guidance for the year assumes capital expenditures of $73 million, of which $38 million are associated with the new corporate headquarters. The guidance also assumes and includes tenant improvement reimbursements of $16 million and depreciation for the year of roughly $39 million. In the fourth quarter, we expect non-GAAP net income of $26 million to $28 million or $0.41 to $0.44 in terms of earnings per share based on 65 million fully diluted shares outstanding as spending catches up to revenue and some expenses that were originally expected to be incurred in Q3 will now fall into Q4. You'll note that this still reflects an increase when compared to our implied Q4 guidance range from our call in July.
Our Q4 guidance includes capital expenditures of $27 million, including $19 million associated with our headquarters project and depreciation of approximately $10 million. Now turning to free cash flow. In terms of free cash flow, we are raising our outlook for the full year to $166 million to $168 million, an increase of $32 million at the midpoint when compared to our prior guidance. In terms of some additional detail, given the strong linearity during the third quarter, the cash collections that otherwise would have been expected in Q4 were accelerated into Q3.
And with that in mind, in terms of free cash flow for the fourth quarter, we are expecting this to be in the range of $3 million to $5 million, which is, of course, down from the implied Q4 range, part of the guidance in July, thus still representing a substantial increase in free cash flow for the second half as illustrated by our updated guidance for the full year. It is also important to note that this Q4 guidance includes the final $19 million in capital spending associated with the completion of our new campus headquarters project offset by just under $2 million from the remaining tenant improvement allowance. And as such, our Q4 free cash flow carries the vast majority of the full year impact of the net spending associated with our new corporate headquarters. As we noted in July, given the pandemic and its impact to our visibility measured over somewhat longer time horizons, we won't be providing our traditional initial outlook for the fiscal year 2021 on today's call.
With that said, I would still like to provide a few thoughts to assist in shaping expectations for the coming year with the caveat, of course, that the ongoing COVID-19 crisis, which as of yet, has not shown the stabilization that we hoped for back in May, creates particular complexity here. And as such, these assumptions could, of course, change depending on how the pandemic plays out in the months ahead. Here in 2020, we have seen a gradual decline in our year-over-year revenue growth rates as we absorb the economic headwinds that are impacting our overall new and add-on sales as well as the nominally higher churn rates that we are seeing due to the layoffs and furloughs across certain segments of our installed base.
As we look ahead to 2021, we believe it is reasonable to expect that some of these headwinds may likely persist over the next few quarters, which we believe will be partially offset by a number of key initiatives, including the sales capacity that we put in place over the course of this year; our further traction with bundling initiatives; our developing momentum with our enterprise DLP solutions; and our continued success in scaling our international operations. When viewed in total, we currently expect a U-shaped recovery in our business over the coming year with our revenue growth rate in the first quarter, stabilizing at a level roughly consistent with our guidance for the fourth quarter of 2020, followed by a gradual sequential improvement in revenue growth rates over each of the three remaining quarters of the year.
Given this U-shaped recovery for revenue growth rates, we would expect in this context that overall billings growth will likely be modestly lower than the overall revenue growth for the full year. I'd also like to provide a few other modeling reminders for next year, as we have shared in the past. First, remember that revenue growth tends to be a bit lower sequentially from the fourth quarter to the first quarter given that we employ a daily revenue recognition methodology with respect to releasing subscription revenues from our deferred revenue accounts. More specifically, given that Q1 has only 90 days of revenue to recognize as compared to 92 in Q4, the result is a sequential decline in subscription revenue from existing business of approximately 2%, which equates to roughly $5 million at our current size and scale.
Second, on the cost side, keep in mind that the first quarter always includes a step-up in spending from the fourth quarter, driven by seasonal increases in costs associated with payroll taxes, sales kickoff, initial sales and marketing investments for the year as well as the timing of the payment of the company's annual bonus program. And as a final point, note that over the course of next year, we also expect that as the recovery from the crisis takes hold, we will see a return to normalcy in terms of our travel spending and marketing investments as compared to the $6 million to $7 million in quarterly savings that we have realized during the current work-from-home environment that has persisted for the majority of 2020.
Finally, with regards to free cash flow, similar to past years, we expect the majority of the cash flow in 2021 to be delivered in the second half of the year with roughly 30% to 40% contributed in the first half. In conclusion, despite the challenging operating environment, we continue to execute well, delivering strong top and bottom line results in the third quarter and we believe that we will remain well positioned to drive disciplined growth in the years ahead, built on our proven capability to defend enterprises against today's advanced security and compliance threats.
While the headwinds we've absorbed from customers in hard-hit industries have temporarily impacted our ability to drive our targeted 20% top line growth and mid-20s free cash flow margins here in the short term, we remain well positioned to weather the COVID-19 crisis over the coming quarters with over 98% of our revenues recurring annually, a cash balance in excess of $1 billion, healthy free cash flow generation, strong secular drivers, a favorable competitive environment and our broad people-centric product set. We will continue our targeted investments with discipline, and we expect these to help us to emerge from this uncertain period stronger than ever and, further, our opportunity to protect our customers and drive strong returns for our shareholders in the years ahead with the goal of returning to our rule of 40 operating paradigm, targeting a score of 40 or better as the crisis resolves and we return to a more normal operating environment.
I'd like to now turn it over to Jason to review our upcoming IR schedule before taking questions from the sell side. Jason?
Jason Starr -- Vice President, Investor Relations
Thanks, Paul. In the fourth quarter, Proofpoint will be presenting in the Needham Security, Networking and Communications Conference on November 17, the RBC TIMT Conference on November 18, the Wells Fargo TMT Conference on December 1, the Credit Suisse Technology Conference on December two and the NASDAQ Investor Conference on December 3. A webcast of these presentations will be made available on our Investor Relations page at investors.proofpoint.com.
Okay. We'll now take questions from our sell-side analysts. [Operator Instructions] Thank you for taking the time to join us on our call today. And with that, we would be happy to take your questions. Cody?
Questions and Answers:
Operator
[Operator Instructions] We'll take our first question today from Matt Hedberg with RBC Capital Markets.
Matt Hedberg -- RBC Capital Markets -- Analyst
You continue to talk about enterprise DLP, which sounds like really a great product, especially in a post-COVID world. And I know it's still early, but I'm sort of curious, what is the right way to think about attach rate of that, either within existing customers? And maybe even more interestingly, do you think it has the potential to attract net new customers and then expand even beyond sort of an initial DLP interest?
Paul R. Auvil -- Chief Financial Officer
Yes. The one thing I'd comment on, and then Gary can add to this, is with enterprise DLP, to the extent that the customer buys a combination of our endpoint and email capabilities, along with the CASB that comes with it, and then maybe a little bit of Insider Threat Management to be able to provide additional levels of surveillance across key targeted employee segments, the value of this in terms of price per user per year is actually greater than we would otherwise see from, say, an archiving deployment, which is one of our historically high-value segments.
And because this product line is broadly applicable to pretty much all of our verticals, there's a tremendous opportunity to sell into our installed base of 7,300 customers and, of course, potentially use this as a net new entry point into accounts but for what other reason aren't ready to make a change with respect to their email security solution that are currently running a legacy solution, whether it's from Symantec or McAfee or others, and they're looking to upgrade to a next-generation platform.
Gary L. Steele -- Chief Executive Officer and Chairman of the Board
Yes. And I would say right out of the gate, our focus has been on getting the word out to our broad customer base. We held our Protect conference, which is our version of our user conference that was held across the globe in geo-specific events in September, and we had record attendance there. And it was universally well received across that broad set of customers.
So I suspect in the initial days, we will be very focused on our customer base. But as Paul described, we're very excited about the opportunity to use this as a beachhead into new accounts. So I think the opportunity really to penetrate across our installed base is very high. It resonates with all customers across all specific verticals. So we're super enthusiastic about this.
Operator
We'll now take our next question from Phil Winslow with Wells Fargo.
Phil Winslow -- Wells Fargo. -- Analyst
Emerging products had another good quarter here. And Gary, I wonder if you could provide some more color into sort of what's driving this. Are there some individual products within that emerging products bundle really starting to take off? Or is Proofpoint starting to see the benefit of having, say, a broad range of products now and sort of your people-centric strategy into the bundles and sort of just the multiple products from one vendor are sort of driving that inflation?
Gary L. Steele -- Chief Executive Officer and Chairman of the Board
Yes, I think there's a couple of things going on here. One is we're seeing this opportunity for consolidation driven by our dialogue with bundles. So customers basically coming to us saying, "Hey, we love what you guys are doing. This people-centric approach makes sense, and I'd love to consolidate more spend with you." And the bundles, as we indicated, we did over 200 bundled deals in the quarter. That's really helping facilitate that dialogue.
And then we see critical capabilities that are missing from customer environments. And so there's just a tremendous amount of demand. Whether it's Security Awareness Training, it's an obvious thing when you're buying the rest of our suite to buy that capability from us. And so I think the broad theme here is a high level of customer loyalty that's driving bundles or add-on deals.
Operator
We'll hear now from Gur Talpaz with Stifel.
Chris Speros -- Stifel -- Analyst
This is actually Chris Speros on for Gur. Just to piggyback off of the last question for Gary. Obviously, the appetite for bundling was quite healthy during the quarter. To what degree is this growth being driven by customers upgrading from entry-level P0 or P1 bundles to the more people-centric P2 or P3s?
Gary L. Steele -- Chief Executive Officer and Chairman of the Board
Yes. So we saw healthy demand for P0s and P1s, and that was a combination of new customers coming to the platform as well as customers who may originally just have bought, for example, protection and TAP but they want additional capabilities like Security Awareness Training. So we're seeing very good demand there. And then as we move more broadly with an installed base where customers want to consolidate more spend, that's where you see the higher bundles coming into play. And we continue to see tremendous demand for these kinds of bundled capabilities broadly in the installed base.
Operator
We'll hear next from Hamza Fodderwala with Morgan Stanley.
Hamza Fodderwala -- Morgan Stanley. -- Analyst
Paul, perhaps a question for you. So it seems like the current billings growth in Q3 actually improved a bit versus Q2 based on our math. Could you maybe dig a little deeper into your comment on durations? Is there any sort of underlying bookings momentum perhaps that's not being captured in that billings metric? And is the expectation that revenue growth trough, let's say, Q1 next year, and then gradually improves as we enter a more normalized environment perhaps in like '22?
Paul R. Auvil -- Chief Financial Officer
Yes. Kind of addressing your second question first, as I outlined at the end of my prepared remarks, yes, we're looking at what we believe as a U-shaped recovery for the business with the Q1 revenue growth rates, roughly consistent with Q4 and then a sequential improvement in growth rates year-over-year as you work your way across Q2, Q3, Q4. And it's a combination of a variety of things, including, again, the additional core capacity we put in place this year, the bundling efforts as they continue to take hold, the DLP product line and our ongoing success with the international markets.
So we think all those things should contribute to driving that recovery. In terms of billings here in the third quarter, it was just a good quarter. Again, the fact that we had essentially consistent duration in third quarter as we did in the second quarter while delivering that number north of $290 million just speaks to some of the underlying strength of the new and add-on business that we closed for the quarter. It was a bit above our initial expectations going into July.
Operator
We'll hear our next from Walter Pritchard from Citi.
Walter Pritchard -- Citi -- Analyst
Wondering -- just two questions. One on the sort of upfront rev rec that came in from some of these products that have that model. Could you help just quantify that for us? And how do you expect that to impact Q4 and then into next year? And then I have a quick follow-up.
Paul R. Auvil -- Chief Financial Officer
Yes. In terms of the 606 benefits, whether they're from our legacy on-premise's MTA products or customers choosing to buy the Insider Threat Management product and deploy it on-premise, we saw a relatively consistent contribution in Q3 as we saw in Q2, and I'm not really expecting a change in the fourth quarter. So there's a little bit of acceleration there, but it's not meaningfully impacting how you're seeing our revenue growth rates from one quarter to the next.
And I would expect that impact to wane over the course of next year because the Insider Threat Management product, in particular, now that we have the cloud products launched, people are very interested in that. And if you buy the cloud solution, there's obviously no upfront component at all. And so there'll be a nominal headwind associated with having that 606 upfront revenue that we've seen each quarter of this year, staying in the background as people move to the cloud.
Walter Pritchard -- Citi -- Analyst
Great. And then just on the guide, not the guide with, I guess, the guidelines you gave for next year, I was a little surprised that billings would grow below revenue there, given you're seeing, I guess, a little bit of a recovery. And usually, when that happens, you see a leading indicator billings growing faster than revenue. Can you just help us understand maybe why that -- why I shouldn't be thinking about the way I was thinking about it?
Paul R. Auvil -- Chief Financial Officer
Yes. Understood. I think there are a couple of things. One, we do expect in the current guide the duration will be down. But then combined with that, it's just -- it depends, to exactly your point, it depends on what you model in terms of the rate of reacceleration. The faster the reacceleration, the more billings might grow a little bit faster than revenue.
And so I just think we just want to have people think about maybe a somewhat more modest recovery as an initial starting point, given the fact that the timing of when the pandemic really starts to wrap up and we see more of a return to a more robust economy takes place. And then obviously, there are opportunities to check in over the course of both January, April, July, etc. as we see things evolve from there.
Operator
We'll take our next question from Rob Owens with Piper Sandler..
Rob Owens -- Piper Sandler -- Analyst
Gary, some of the hospitals are being targeted in this latest wave of ransomware attacks. Is this same thing to accelerate the move from legacy systems? And maybe talk about Proofpoint's capabilities here.
Gary L. Steele -- Chief Executive Officer and Chairman of the Board
Yes. These various forms of ransomware definitely spur demand for us. Ransomware continues to be a top priority and top concern by buyers, and we see ourselves blocking the classic early stage elements of broad ransomware attacks today. So downloaders, etc. that ultimately download ransomware and get ransomware installed, we're blocking that stuff on a day-to-day basis.
So it is of prime importance. It's also a key demand driver for us. I would say ransomware and then business email compromise or email account compromise are probably the two primary things that people are most concerned about right now and driving demand for us and people taking out legacy solutions.
Operator
We'll take our next question from Jonathan Ho with William Blair..
Jonathan Ho -- William Blair -- Analyst
Just wanted to maybe understand some of the dynamics around your international business. And are you seeing any bifurcation there between your domestic and international business? And maybe is that a focus point for some of the sales investments you're talking about as well?
Paul R. Auvil -- Chief Financial Officer
Yes. I wouldn't say we're seeing a bifurcation per se. I think what we're seeing is that we've made these investments in the various international geos over the course of the last several years, and we're now starting to see an improvement in the productivity of those teams. And so that's been helping you see this disproportional improvement in their growth rate. But the U.S. teams, I think, have executed quite well in a challenging economic environment this year. And I do think that with the benefit of some of the newer product lines, especially around enterprise DLP, it sets up an opportunity for some really interesting secular growth opportunities in the domestic markets as we work our way to next year.
Gary L. Steele -- Chief Executive Officer and Chairman of the Board
Yes. And the only thing I'd add to that is we're seeing some nice participation globally. So while we've been very focused on driving growth in EMEA, and there's been great participation there, we're starting to see some nice green shoots coming out of APJ. We think those green shoots can play an interesting role as we get into '21.
Operator
We'll take our next question from Gray Powell.
Gray Powell -- BTIG -- Analyst
Okay. Great. Yes, I just wanted to -- I was hoping to circle back on the Q1 commentary. Specifically, is there anything different that you're seeing in the pace of your growth recovery today versus what you're seeing three months ago? And I guess I asked because last quarter, Q4 was going to be the trough. This quarter, you've upped the Q4 outlook, which is good. But now Q1 growth is expected to be on par with Q4. So I guess I'm just asking, like, was this the plan the whole time? Or has something changed?
Paul R. Auvil -- Chief Financial Officer
It's a good question, Greg. Thanks for asking it. I think it's more about just -- as we see how the crisis has continued to unfold, it's just a visibility question, right? And so I think there's certainly a possibility that Q4 could be the low point, and we see more of a V-shaped recovery from there. But at this point, given the fact that it's a little hard to handicap exactly how both Q4 will come together but also what Q1 might look like, we're giving ourselves a little bit more room for kind of a bottoming out before we see a step back up in terms of reacceleration of growth rates.
Operator
We'll now take our next question from Alex Henderson with Needham.
Alex Henderson -- Needham -- Analyst
Great. Given what's happened with respect to the lack of a stimulus program and the fact that a lot of programs rolled off, as you're looking at your fourth quarter and the programs that have rolled off may now result in an acceleration of people being laid off, have you factored that type of change in the environment into your forecast? And if so, can you give us any sense of the mechanics of it so that we can talk to it in our thinking?
Paul R. Auvil -- Chief Financial Officer
Yes. We're -- as you can imagine, very close to our installed base. And we typically start working with customers about six months before their renewal to understand timing of the renewal, what products they might want to buy above and beyond what they currently have as well as obviously what their user counts look like. So we're pretty close to all these customers that are in these affected industries where, to your point, with the rolling off of the stimulus programs, what do people expect in terms of layoffs and furloughs that are above and beyond what may have already been published in the newspapers. So I feel like we've got that as well dialed in as we can, quite honestly, based on the churn that we factored into the forecast that we gave you.
Is it possible that things could be worse on the margin? Sure. But I think realistically, just given what we've seen so far for the first six months of this thing, it ought to be within the margin of error of how we think about guiding at this stage in terms of how it would impact billings and revenue for the quarter. And so we'll see how things play out here. But again, one thing I always like to remind people, and while the pandemic is a little bit different, it is, to some degree, very similar to the Great Recession in that these furloughs and layoffs are mostly temporary.
Now some industries may take a little bit longer to recover once we get through this than others, but these people will all essentially get hired back, which then just creates a rebound in terms of license revenue for growth for us somewhere over the arc of 2021 and early '22, depending on that recovery rate. So the net of it is we factored it into the models as part of having a churn rate that's a little bit over 10%, hence an ARR retention rate of a little under 90 here in the fourth quarter. And so I feel like we've got that reasonably factored into the current guide.
Operator
Your next from Taz Koujalgi with Guggenheim Partners..
Taz Koujalgi -- Guggenheim Partners. -- Analyst
Paul, a question on the cash flow guide. You mentioned that the cash flow in Q3 was benefited from the pull-forward due to better linearity. But you're also raising your cash flow for the full year. So it can just be the changes with timing, Q4 to Q2, because you're raising the number for the full year. So can you -- I'm trying to get -- I was trying to reconcile how the cash flow guide is going up in spite of billings coming in pretty much, I guess, in line to the Street. Are your -- is the billings expectation going up this quarter was what you expected by the first quarter?
Paul R. Auvil -- Chief Financial Officer
So it's a few things. First, obviously, we did a little bit better on billings. We had that good spend helps across the arc of both Q3 and Q4 in total. Spending was a bit lower than we had expected. The overall campus projects coming in several million dollars lower. We spent about $3 million less on the intellectual property repatriation. And I am, compared to my more conservative assumptions, assuming somewhat better linearity in my Q4 collections, which then benefit for the full year as well. And so even though you see the overall Q4 implied guide-down for cash flow, you see it pick up in the full second half in terms of the benefit. So it's a number of different moving parts.
Quite frankly, working our way through the crisis, we've always been wondering how is this going to affect the timing of how and when we get paid by the customers. And so we've been handicapping that so far in a fairly maybe overly conservative way. And now that we've seen how things have played out here in the first couple of quarters, it gave us the opportunity to be somewhat more optimistic about how the pieces fit together. But I still think leaving a little bit of room potentially for upside, depending on how things come together here in the fourth quarter.
Operator
Our next from Andrew Nowinski with D.A. Davidson..
Hannah Baade -- D.A. Davidson. -- Analyst
This is Hannah Baade on for Andy. Last quarter, you mentioned that the renewal rate could drop into the high 80s and then you report it just below 90 this quarter. Just to clarify, would this involve your internal expectation? And have you seen any indications that the headwinds are worsening? And do you expect the renewal rate to grow in line with the U-shaped recovery that you're predicting next year?
Paul R. Auvil -- Chief Financial Officer
Yes. No, it's a good question. So again, I would say that we were just under 90, so high 80s. So we're really right on top of the guidance that we provided back in July. And we did indicate that we would expect to be that way for the next few quarters. Hence, our guidance in the fourth quarter continues to reflect a renewal rate that's a bit under 90%, so high 80s. I feel like we, again, as I've mentioned a little bit earlier, given the ongoing report that we have with our whole installed base, I think we have a very good handle kind of week-to-week, month-to-month on how things put together. In fact, just to add a little more color here, we normally have a weekly meeting where we go through renewals that may be at risk or have an issue.
But now with the advent of the pandemic, we've actually added a second meeting that we have each week where we look at not just customers that might be at risk because they're -- for whatever reasons, thinking of leaving the Proofpoint platform, but anyone that's particularly affected by the crisis and whether they are asking for onetime discount associated with dealing with, again, layoffs or furloughs or they're having budget challenges, what have you. That meeting covers all of those. And so there's a lot of attention and focus here, and hence, we have a lot of visibility into it.
So the net of it is, I feel like we've actually executed quite well here over the last six-plus months of the crisis. And I feel like we've got a very detailed and dialed-in process in terms of how to handle this and manage our way through the remainder of it until we get to the other side.
Operator
Our next from Nehal Chokshi with Northland Capital Markets.
Nehal Chokshi -- Northland Capital Markets. -- Analyst
Yes. There seems to be a rise in the need of using the APIs to cloud email providers to combat some of these more sophisticated phishing attacks. And at least if you talk to a private cloud email security supplement players, they talk about that being a big advantage for them. So the question is that does Proofpoint -- I guess, do you guys view it that way? And if so, do you guys also utilize these APIs from the cloud service providers from the cloud email security players, cloud email players as extensively as these smaller CESS players? And if not, why not?
Gary L. Steele -- Chief Executive Officer and Chairman of the Board
Yes. There's been a number of funded companies that fall into the category that they use the APIs to try to help on a specific problem. We look at this holistically because none of those helpers today, for example, catch any malware. And as we described earlier on the call, things like ransomware, our top priority and those kinds of helper apps don't help because you've already delivered the mail and you would have already been infected with ransomware. So we think about this holistically. And while they saw very specific problems, we don't see it's fundamentally shifting the market or changing the market in any way.
Operator
We'll take a final question from Brian Essex with Goldman Sachs..
Arindam -- Goldman Sachs -- Analyst
This is Arindam on for Brian. So I just wanted to touch on Office 365 migration. It sounds like it remains a tailwind, but do you feel as though you are seeing any kind of delays with the migration due to the pandemic, especially as enterprises may be delaying their projects or workload architectural change?
Gary L. Steele -- Chief Executive Officer and Chairman of the Board
No, we actually have continued to see the migration to Office 365 as an important catalyst in our business. While there was considerable disruption because of the pandemic, the move to cloud has been a more focused and high prioritized effort within enterprises. And I think as a result of that, that broader move then continues to help drive opportunity and demand for us. And whether that customer evaluates us before they get to Office 365 or they go to Office 365 and use the built-in capabilities and come back to us later, all of that's very good for us.
Operator
That concludes today's question-and-answer session. I would like to turn the call back over to Gary Steele, Proofpoint's CEO, for final comments..
Gary L. Steele -- Chief Executive Officer and Chairman of the Board
Great. Thanks. I just want to take a moment and thank everyone for joining us on the call today. We're very pleased with our Q3 results and our continued progress with our people-centric approach to cybersecurity and compliance while also supporting the health and safety of our employees and customers.
We believe we remain well positioned to drive attractive returns for our shareholders, and we look forward to talking to you on our next call and to seeing many of you virtually on the conference sector this quarter. We wish you all good health as we press forward through the crisis and hope that we return to normalcy soon. Thanks so much.
Operator
[Operator Closing Remarks]
Duration: 52 minutes
Call participants:
Jason Starr -- Vice President, Investor Relations
Gary L. Steele -- Chief Executive Officer and Chairman of the Board
Paul R. Auvil -- Chief Financial Officer
Matt Hedberg -- RBC Capital Markets -- Analyst
Phil Winslow -- Wells Fargo. -- Analyst
Chris Speros -- Stifel -- Analyst
Hamza Fodderwala -- Morgan Stanley. -- Analyst
Walter Pritchard -- Citi -- Analyst
Rob Owens -- Piper Sandler -- Analyst
Jonathan Ho -- William Blair -- Analyst
Gray Powell -- BTIG -- Analyst
Alex Henderson -- Needham -- Analyst
Taz Koujalgi -- Guggenheim Partners. -- Analyst
Hannah Baade -- D.A. Davidson. -- Analyst
Nehal Chokshi -- Northland Capital Markets. -- Analyst
Arindam -- Goldman Sachs -- Analyst
