Ping Identity Holding Corp (PING) Q3 2021 Earnings Call Transcript

Image source: The Motley Fool.

Ping Identity Holding Corp (PING)
Q3 2021 Earnings Call
Nov 5, 2021, 8:00 a.m. ET

Contents:

• Prepared Remarks
• Questions and Answers
• Call Participants

Prepared Remarks:

Operator

Ladies and gentlemen, thank you for standing by. And welcome to the Ping Identity Third Quarter 2021 Earnings Conference Call. At this time, all participants are in a listen-only mode. Later, we will conduct a question-and-answer session. [Operator Instructions]

I would now like to turn the conference over to David Banks, Vice President of Investor Relations. Please go ahead.

David Banks -- Head of Investor Relations

Thanks, everyone, for joining us today. And welcome to the Ping Identity conference call, where we will discuss results for the third quarter, provide outlook for the fourth quarter and update our outlook for the full year 2021. Shortly after the market close today, we issued a press release announcing our third quarter 2021 financial results. In addition to the financial results, we will be presenting a live supplemental set of slides through the webcast portal. These will be published to our website following the call. You may access the press release and presentation on the Investor Relations section of pingidentity.com. With me today is our CEO, Andre Durand; and our CFO, Raj Dani.

Today's discussion may include forward-looking statements. Please refer to our annual report on Form 10-K for 2020 and our quarterly report on Form 10-Q for the quarter ended September 30, 2021 filed with the Securities and Exchange Commission. There you will see a discussion of factors that could cause the company's actual results to differ materially from these statements. I would also like to remind you that during the call, we will discuss certain non-GAAP measures related to Ping Identity's performance. You can find the reconciliation of those measures to the most closely comparable GAAP measures in our third quarter press release and the slides we are posting on our website. To ensure we can address as many analyst questions as possible during the call, we ask that you please limit your questions to one plus a follow-up. We will end the call after 60 minutes.

With that, I will turn the call over to Andre.

Andre Durand -- Chief Executive Officer

Thank you, David. Q3 was another strong quarter of solid growth against all our key performance metrics.

Annual recurring revenue again grew by 19%. Revenue of $76.2 million grew 27% year-over-year, once again reflecting solid sales results and contract durations. SaaS revenue of $15.3 million grew 56% compared with Q3 of 2020 and our dollar based net retention rate again increased, up a percentage point from last quarter to 112% and also up year-over-year for the first time in several quarters. Raj will cover the financials in more detail and update our guidance in a moment. I wanted to focus today on the first of four core themes we focus on each quarter, delivering our entire platform in the cloud to help companies secure their hybrid IT environments. For starters, I'd like to thank and congratulate our PingOne advanced services team as we continue to exceed all expectations with this new offering.

In just the past year, we brought 25 of the most sophisticated and complex global enterprises to PingOne advanced services, five of which were in our top 10 largest deals so far in 2021. Nearly 70% of these 25 customers are leveraging Ping for their customer use case, a trend not dissimilar to the one we are experiencing more broadly across our base. Speaking of the PingOne Cloud Platform, much of our investment over the past two years has been behind the scenes, but these investments are now becoming a major driver of future growth.

During our 12th Annual Users Conference, which took place last month, we announced several new PingOne Cloud Platform enhancements and services related to recent acquisitions. This includes the immediate availability of PingOne Verify to validate the real identity of users, PingOne API Intelligence to bring security to all API transactions. PingOne Fraud to detect malicious behavior in our customers' solutions and PingOne Authorized to centralize authorization of any transaction coming in Q1 of next year. Together with our existing PingOne offerings, these new services enable a comprehensive platform from which to secure customer and workforce identities, ensuring access to any resource or application by verifying, authenticating, authorizing and monitoring any identity from a single intelligent, cloud delivered identity platform.

But it gets better; through our recent acquisition of Singular Key, we can now not only integrate and orchestrate Ping's technologies without the need for custom coding, but we can integrate and orchestrate identity technology into an extraordinary end user experience that spans the entire lifecycle of identity use cases. And we can do all of this without the need for an army of developers. As our cloud offering matures, so to have the request to operate in different regions around the world with mission critical resiliency. To meet these growing demands, we have invested to expand our geographic coverage, while improving resiliency through investments aimed at providing active/active redundancy across multiple regions around the globe.

Lastly, with regards our cloud platform, I am pleased to announce that we have officially received our FedRAMP sponsorship from the Department of Energy, and as such, we expect to make PingOne for government broadly available in 2022. Focusing on another one of our core themes, embracing partners, we continue to make significant investments in our channel ecosystem. Our investments in channel, marketing and enablement resources supporting our partners is up nearly 50% this year, helping support more than 125 customer and prospect facing programs through and with our partners.

Our investment enabled increase sales, technical and implementation training, including the sales certification of 125 partner representatives. This training, along with an important shift in our professional services team to support partner led implementations has helped to grow our delivery approved program, now with more than 20 such delivery partners. We continue to refine our framework for working with a global system integrators or GSIs. These partners are eager to lead with Ping in their key business portfolios, especially as we have increased the pace of our acquisition activity.

And now, I'd like to highlight a few of our recent customer stories. Internationally, we landed a new logo with Catia Economica Federal or Catia. This government owned company is one of Brazil's largest banks and the largest publicly held bank in Latin America, serving more than 30 million customers. They signed a contract to start their Brazilian open banking journey with Ping using our authentication and authorization capabilities. Their plan is to extend the Ping footprint in 2022 and this new sale was a great example of how we are going to market with partners internationally, in this case, Netbr. Also, in the quarter, one of the leading East Coast warehouse club operators became a new Ping customer, the company which operates 215 warehouses in 16 states, serving more than 600,000 members sought to protect their digital assets tied to their website and mobile applications. They look to Ping to enhance their existing authentication capabilities by layering risk and evoking step up authentication to identify suspicious and fraudulent activity.

In a third story, we both expanded and extended our relationship with a Canadian-based multinational media conglomerate to secure 25,000 employees leveraging PingOne Advanced Services. We are currently nearing completion of a second agreement to extend the relationship to the customer use case. In another expansion story, the State of Colorado, which leverages Ping for both their state employees and for Colorado citizens, has expanded the relationship based upon the success of their Ping deployment. More than 350,000, Coloradones now leverage Ping for their digital driver's licenses, proofs of vaccination and other state issue IDs.

With regard to successful deployments, we went live with Flinks to provide open banking to Canada, based in Montreal, Flinks provides financial institutions a complete open banking ready environment to empower those organizations to drive new business. Joining us in this implementation was Simyo [Phonetic], a longtime partner who is managing the Ping solution for Flinks in Canada to adhere to Canada's strict residency standards.

We were also pleased to celebrate a go live with SCL Health, a non-profit healthcare organization serving several western states. Our solutions streamline authentication and workflows for hospital staff and physicians, while adhering to strict patient data confidentiality. SCL Health was also recognized as our 2021 Identity Innovation Champion, along with other award winners, Eurofins, TIAA, Old Mutual and Banco Itau. We also recognize notable partners, including Altron Security, ProofID and Netbr, and other significant finalists, Schneider Electric, TransUnion, and Accor Hotels. Thank you to all of our customers and partners for another great quarter expanding the boundaries of Identity Security.

In closing, Q3 was a solid quarter for growth across all key metrics and we are pleased to see a healthy return of larger deals. We are also excited to see years of hard work and our recent acquisitions start to reach a critical mass on our PingOne Cloud Platform. We believe the Singular Key acquisition is a game changer and that no code orchestration will drastically simplify identity integration and the developer experience. I'd like to take this opportunity to thank the Ping team for their dedication and hard work, helping our customers succeed in identity and welcome Jason Kees as our new Chief Information Security Officer. Jason has a long track record of enhancing cybersecurity strategies for large enterprises and managing security teams, most recently as CISO at Groupon, but also with McAfee, Siebel, Oracle and CBS Interactive.

Finally, I'd like to invite you all to our upcoming virtual Investor Day on December 1st. We will go into greater depth on our strategy and vision, our product roadmap and provide key metrics while hearing from a number of our senior leaders. Please look for an official invite from our Investor Relations team.

And with that, I will now turn the call over to Raj to walk through the Q3 results in more detail and provide an outlook for Q4 and the full year. Raj?

Raj Dani -- Chief Financial Officer

Thanks, Andre. We are pleased to have delivered above our guided ranges for all key metrics.

We ended Q3 with ARR of $289.6 million, up 19% year-over-year. Q3 net ARR of $10 million was up 36%, compared with the $7.4 million of net ARR added in Q3 of 2020. This quarter's performance reflects a continued return to a more normalized activity, with some solid large deals and average durations that are more consistent with historic averages. Third quarter total revenue grew by 27% to $76.2 million, of which 94% was subscription based. Growth was driven by SaaS and multiyear term license revenue. SaaS revenue grew 56% in the quarter and acceleration from Q2, as we generated $15.3 million in SaaS revenue, primarily from increased adoption of our PingOne Cloud Platform. We now have more than 780 customers using at least one SaaS solution, up more than 20% year-over-year.

Subscription term based license revenue grew by 25% year-over-year in Q3. Given the impact that deployment mix and contract duration have on GAAP revenue, we continue to believe that ARR is the key growth metric of a subscription business. Our Q3 dollar based net retention rate was 112%, calculated on a trailing 12-month basis and again tracking consistently with accelerating ARR growth. We ended the quarter with 288 customers with more than $250,000 in ARR, up 14% year-over-year.

Unless otherwise stated for the remainder of the P&L, I will refer to non-GAAP metrics. You can find a reconciliation of non-GAAP to GAAP numbers in the accompanying press release. Gross profit margin for the third quarter was 78%, and comparatively, our GAAP subscription gross margin was 84%. Total operating expenses in the third quarter were $55.1 million. Year-to-date operating cash flow is $38.1 million due to the usage of $6 million of cash in Q3 reversing last quarter's strong cash generation as expected due to the timing of collections. This led to unlevered free cash flow of negative $11.1 million for the quarter with $23.4 million of positive unlevered free cash flow year-to-date.

We ended Q3 with $51 million of cash on hand. The $53 million quarter-over-quarter cash reduction was driven partially by working capital changes, but chiefly by the acquisition of Singular Key. The $73.2 million price tag for Singular Key at acquisition included $40.3 million of cash consideration and 1.26 million shares of Ping stock valued at $32.9 million. Even with our continued investments to drive innovation and growth, we remain in a strong cash position as we enter the fourth quarter.

Moving now to guidance, for the full year, we are raising our ARR projection to $306 million to $308 million, growth of 18.5% at the midpoint compared with 2020. We expect Q4 revenue growth of 11% at the midpoint of $67 million to $73 million range, with full year revenue expectation of $291 million to $297 million or 21% growth at the midpoint. We expect to end the year with unlevered free cash flow of $10 million to $12 million, slightly lower than prior levels, with negative $13.4 million to negative $11.4 million expected for Q4; this includes the impact of both SecuredTouch and Singular Key acquisitions.

In closing, we feel great about our year-to-date performance and are optimistic about the continued growth trajectory for the balance of this year and longer term. We are looking forward to sharing more with you at our December 1st Investor Day.

With that, I will turn it over to the operator for your questions.

Questions and Answers:

Operator

Thank you. [Operator Instructions] We have your first question from Andrew Nowinski with Wells Fargo. Your line is open.

Andrew Nowinski -- Wells Fargo -- Analyst

Great, thank you. Congrats on a great quarter. Just want to start off with, you are clearly seeing an inflection in subscription growth. This is the second consecutive quarter you have had over 30% growth on a year-over-year basis. So can you just talk about how your products have evolved and what might be driving that inflection and growth?

Andre Durand -- Chief Executive Officer

Andy, this is Andre. Thanks for the question. Our product platform, the PingOne Cloud Platform is reaching a level of maturity. Now it's a combination of our Advanced Services coming online Q4 of last year, combined with several new services, some acquired some built organically, like Risk, Fraud, Verification, and those services coming online line as well. So it -- the story here really is the maturation of the Ping Cloud Platform being offered to existing customers, as well as new customers.

Andrew Nowinski -- Wells Fargo -- Analyst

Okay, great. And then, I want to ask about some of the recent acquisitions, including SecuredTouch in June and then now Singular Key here in September. How do you think those acquisitions fit into this product evolution, where your platforms headed to them? How should we think about the inorganic contribution from those acquisitions in 2022?

Andre Durand -- Chief Executive Officer

We have always had a vision that identity needs to be intelligent, informed by risk and fraud signals to make better authentication and authorization decisions. So SecuredTouch is consistent with that. We had introduced PingOne Risk, which was a risk service for our workforce use case earlier in the year. SecuredTouch completes that by offering risk and fraud signals now for the customer and consumer use case. So the entire notion that we are building a virtuous cycle, where risk and fraud signals inform the identity control plane how to behave. It's also instrumental toward our password list vision, there is no way to achieve a password list experience without leveraging the implicit signals that are available to us, such that if risk is low and trust is high, we just let the user in, so to speak. So that acquisition was part of our strategy around an intelligent identity control plane.

The Singular or this -- yes, the Singular Key acquisition is a little bit different. If you step back identity is an integration game. We are trying to connect everyone to everything, speed of integration, time to value and the flexibility with which companies can actually integrate, not just the basic, but the more advanced identity technologies is critical to all of these large enterprises. Singular Key allows us to achieve a 10x on the time to value and the speed to integration. And it does so because much of the historical coding, as we say, the point-to-point hard coding has all been done in now Singular Key. So it allows the business to design user experiences without coding. So identity is an integration game, time to value, speed to integrate really matters, Singular Key allows us to orchestrate all of these identity experiences without coding.

Andrew Nowinski -- Wells Fargo -- Analyst

That's great. Any color on how we should think about their contribution in 2022 or is still too early?

Raj Dani -- Chief Financial Officer

Yes. Hey Andy, this is Raj. It is a little early. We are just a couple of weeks and a couple months into the -- into these integrations. So our first order of business right now is to integrate them with our own SaaS platform and continue to build pipe. What I will tell you is that, there's a ton of excitement from our customers, from our sales force, and just generally in the marketplace around these solutions; so just watch the space.

Andrew Nowinski -- Wells Fargo -- Analyst

Sounds good. Thanks very much.

Andre Durand -- Chief Executive Officer

Thanks, Andy.

Raj Dani -- Chief Financial Officer

Thanks.

Operator

We have your next question from Adam Tindle with Raymond James. Your line is open.

Adam Tindle -- Raymond James -- Analyst

Okay, thanks. Good afternoon. I wanted to start on ARR. Last year you had just over $250 million and based on guidance this year, it's going to be just over $300 million. So I look at the new ARR that you are adding about $50 million, which I think would mark the highest level ever. Just wondering if you could maybe break down some of the composition of new ARR, and as we think on a forward basis, the puts and takes to adding this sort of level of ARR on a go forward basis? Thanks.

Raj Dani -- Chief Financial Officer

Sure. Hey, Adam. So no surprise, right, based on what we have been talking about, SaaS ARR has been growing and multiples of the overall rate of growth of the business. We have introduced several new SaaS services over the past three or four quarters, including PingOne Advanced Services, which has a tremendous amount of pipe building and an interest and adoption, frankly, within our customer base. So when I think about sort of this year, it's really kind of that inflection point in our SaaS delivery. As Andre mentioned, that feature function parody, along with these independent services on our platform are really sort of changing the game for us in terms of SaaS competitiveness. So -- and we are seeing that translate into wins in the market. So that's driving a lot of our success there and overall growth. In fact, in Q3, we actually saw the majority of our overall bookings for the quarter come from SaaS services. So we are really excited to see that.

Adam Tindle -- Raymond James -- Analyst

Okay. Yes, sounds sustainable. Okay, I did want to ask maybe a follow up on Cloud. Andre, you talked about the active/active coverage expansion in different geographies. I am wondering kind of a two-parter, the benefits from this anyway to kind of comment on the size and scale of incremental opportunity with maybe the U.S. potential precedent? And then, secondly, the cost, I wanted to clarify our investments already in place for this or they're going to be incremental investments needed as you do this and maybe Raj can help with sizing any of that? Thank you.

Andre Durand -- Chief Executive Officer

All of our customers, well, many of them, most of them treat authentication as a Tier 0 or mission critical service, if their own users or customers cannot authenticate, transactions basically don't occur, people don't access the network, they can't work. So resiliency is a very big part of what we need to do when we deliver identity services. This is more than application. It really is mission critical infrastructure. Active/active in the cloud is one of the ways in which we achieve our four nines of availability and our SLAs and so the investments there, obviously, are critical to the credibility and really acceptance of our cloud offering to our large enterprises. A lot of the investments now are behind us, to be clear. We do run our services in AWS. So these are not large capital outlays, but really just bringing a new region within AWS online. There is work that we have to do, obviously, to bring a second region in a territory online. There is data residency is as we know, that's driving a lot of decisions about where companies are able to put customer data or even their employee data in the cloud.

So in order to offer four nines of availability and the level of resiliency customers are demanding, you really want to get to an active/active state in country or in territory as best you can. Most of the investments in our geographic expansion or let me just say, many of them now are behind us. So, I don't expect there will be continued investment going forward. But all the major regions that Ping now operates in the U.S., India, Australia and now Canada are now covered under our -- under really our cloud active/active program.

Adam Tindle -- Raymond James -- Analyst

Very helpful, thanks. And congrats on the results.

Andre Durand -- Chief Executive Officer

Thank you.

Operator

We have your next question from Gray Powell with BTIG. Your line is open.

Gray Powell -- BTIG -- Analyst

Great. Thanks for taking the questions and congratulations on the good numbers.

Andre Durand -- Chief Executive Officer

Thank you, Gray.

Gray Powell -- BTIG -- Analyst

So, yes, I just want to follow-up on Adam's question, I was just kind of in some back of the envelope math. I mean, roughly speaking, it looks like your SaaS product drove about two-thirds of the net new ARR in Q3 versus more like 50% or 55% in the first half of the year. Does that seem about right to you? And then do you see a point where more like, I don't know, 90% plus of new business is coming from SaaS or is there sort of like a natural point where the on-prem to SaaS mix stabilizes?

Andre Durand -- Chief Executive Officer

As Raj noted, this was an important quarter in the inflection of our business and really the validation, if you will, of the investments we have made over several years in our cloud platform, in our SaaS platform PingOne. This was the first quarter where SaaS outstripped -- the bookings outstrip the software bookings. We do expect that to continue. Now that the product is reaching a level of maturity, obviously, we continue to invest in it. We are a cloud your way company to be clear, many of our largest customers continue to maintain or run Ping either on-premise or some of the newer deployments in the public cloud, but leveraging our DevOps program, so they are running our software in our DevOps program, but they are managing it in their public cloud -- one or more of their public clouds. We don't do anything to, say, tip the table one direction or another. It is advantageous for us that we give these customers the choice of how they want to consume identity, whether it's on-prem in their public cloud or as SaaS from Ping. So -- and I would expect that that would continue.

You made a statement about 90% at some future point. I do think that there is a resting point in the future where there is a healthy balance. SaaS dominated ARR. It is a faster growing part of our business. We expect that to continue into the future. I don't know if the balance point ends up at 90/10, 80/20, 25/75, for example, but I think you are directionally correct in assuming that the transition to SaaS for Ping is now well underway.

Gray Powell -- BTIG -- Analyst

Okay, that's really helpful. And then just my follow up business is would be that coming the SaaS is just clearly seeing good traction. How should we think about the product set and its potential to drive better headline customer growth metrics? Is that something we should be looking for over the next six months to 12 months?

Andre Durand -- Chief Executive Officer

It hasn't been the primary focus. We have been very focused on bringing our entire platform to the cloud, number one. Introducing the new services that are building into the future, these are the Risk and Fraud services, the API Security, focus on the customer use case, so product differentiation has been very important. And now focusing on how companies will integrate our platform into everything through no code orchestration. That's been the primary focus. And a lot of the ARR growth has been customers expanding into Ping as a strategic platform for both the workforce and the customer use case. I do believe that going forward as the platform can be consumed all from the cloud and as orchestration reaches some level of maturity over the course of the next year, I do think that more focus and attention will come back to the customer count, but much of the focus has been on making sure we have the right platform that is differentiated, that is focused in the right places and that we acquire through these technology tuck-ins, the acquisitions which complete our story.

Gray Powell -- BTIG -- Analyst

That makes sense. Okay, thank you very much.

Andre Durand -- Chief Executive Officer

Thanks, Gray.

Operator

We have your next question from Adam Borg with Stifel. Your line is open.

Unidentified Participant

Hi, this is Hasan Devgan [Phonetic] for Adam Borg, and thank you for taking the question. Maybe for Andre just on SaaS, obviously, your sweet spot has been in the upper end of the market? And so if you could talk more about, one, the receptivity by your largest customers and prospects to adopt SaaS if any, and two, the opportunity for SaaS have moved down market more below the Global 3000? Thanks.

Andre Durand -- Chief Executive Officer

I think some of the success of advanced services among some of the larger enterprises speaks well to some of the large enterprises willingness to adopt cloud in the solution that we are giving them and being won advanced services. So I think that begins to speak for itself. We expect a lot more of that. I think down market, it is -- the down market tends to focus on different things than the larger enterprise market. There is a lot of hybrid integration there is a lot of legacy integration, not just cloud or SaaS app integration for large enterprises. It's an area where Ping tends to be very, very strong. So everything related to on the large enterprise that wants to put identity in the cloud consume it as SaaS, but reach back into the hybrid enterprise for all of those legacy and on-prem use cases, I think we are very differentiated there and foresee we will continue to be very differentiated for some time.

That use case or that level of sophistication hybrid sophistication is not paralleled by the down market the SMB market. So they do tend to focus on some different things. Our intention is not necessarily to go down market say, below the Global 5000, so I will extend it a little bit beyond the 3000 there. I will say, however, as the maturity of PingOne continues and as we introduce new services like orchestration that are new to the market and help. As I said 10 times the speed and simplification with which identity services, multiple identity services and platforms can be integrated, that I would not preclude the opportunity that some of our new services have down market appeal. So all is open to it, but from a go-to-market point of view, it's not our primary focus.

Unidentified Participant

Great, thank you.

Operator

We have your next question from Catharine Trebnick with Colliers Securities. Your line is open.

Catharine Trebnick -- Colliers Securities -- Analyst

Thank you for taking my question, I am not sure if you can quantify this, but in speaking with many of the CIOs, the first piece that they are looking at, when they are looking at is Zero Trust architecture's identity and can you explain to me are all of us know how -- soon you fit into that process when they start that architecture decision? And then how long it takes to really drive their use cases? Thank you.

Andre Durand -- Chief Executive Officer

Good question, Catharine. So Zero Trust is an awfully big word, it's been commandeered by the marketers as of the last six, seven months to stretch to mean a lot of different things, but at its foundation. We are moving from essentially perimeter security where there was high trust, meaning if you were inside the perimeter you were very trusted, to a world where we neither want to trust the user, the network they are on or the device they are on. So Zero Trust is an embodiment of what do we do when the network, the users and the applications don't reside within our control and we need to presume that we cannot trust them. However, we need to somehow let them in. So the reason why identity is foundational to Zero Trust is or really the cornerstone of Zero Trust as we move from perimeter based security to identity being the perimeter. We only want to let the right users and who are appropriately authorized and on a device that we either Trust or we are managing thinking endpoint a laptop or a cellphone. For example, neither of which are necessarily in the building on the network, they could be anywhere vis-a-vis at home. So Zero Trust is fairly synonymous at its most foundational level with the notion of identity-based security or identity as being the new perimeter that we are creating.

There are two major pieces of identity, both of which are central to our platform in Zero Trust. One is authentication making sure you are talking to the right user we need to strongly authenticate every user. And the second is authorization, what can they user do, what can they see, what are we going to allow them access to. So the cornerstone of the Ping platform really are both authentication and authorization, which is why the second accompany begins as Zero Trust journey. The focus and attention begins to move from firewalls and VPNs and all of the traditional layers of perimeter security and it begins to move toward. How are we going to authenticate everybody, how are we going to do that frictionlessly, aka password list if possible and then what are we going to allow them into. So that connection tends to happen within the first day, as you said. And to support that, one of our -- well, our largest deal in the history of the company the event services deal I announced this a quarter or two ago. The initiative that, they are looking to achieve is both the cloud transformation one and number two a Zero Trust transformation now for them, it's going to be a five year journey I want to be clear. This is a very, very large global enterprise 10s of 1,000s of users 100s of 1,000s of customers.

And they are moving from a perimeter based security to Zero Trust, this is a company that makes significant weaponry and other big machinery that you would want to make sure that you need to maintain security on. So this move is happening, it's a secular shift, it's not going to happen overnight, identity is central.

Catharine Trebnick -- Colliers Securities -- Analyst

All right. Thank you very much.

Operator

We have your next question from Matt Hedberg with RBC Capital Markets. Your line is open.

Matt Hedberg -- RBC Capital Markets -- Analyst

Okay, great. Thanks, guys. Andre, as we kind of maybe in a period of a bit more reopening here from a COVID scenario, how do you think about the large the opportunity to replace legacy solutions, I mean do you think some of those things could come up a bit more frequently now? And I guess to what extent can partners help with either the timing of understanding when some of these renewals come up or ultimately helping to replace some of these with Ping?

Andre Durand -- Chief Executive Officer

I will start with the last part partners are instrumental in helping us understand when the terms are essentially up on that infrastructure. So you are right in honing in on the importance of the channel and partners to identify that. It is a bit of a waiting game, right, they -- this is critical infrastructure. They don't necessarily rush to replace it until a term is up and then they look to modernize. We are seeing a return of legacy modernization some of -- many of those projects were put on hold for the first year of COVID, now we are seeing those projects begin to return. We do anticipate we have been asked for years, whether or not there is an accelerated tipping point where everyone just rushes to get rid of that legacy. We have not seen that, we see this as a large almost steady state replacement of legacy.

Now the truth is, every year it becomes a little bit more brittle. We are really the go-to company that has migrated hundreds of large, very large, very complex enterprises wholesale from legacy to a modern identity stack or modern identity platform. So, we are in a very, very good position to -- essentially wait until these monetizations occur. We are working with partners to identify them as they happen.

Matt Hedberg -- RBC Capital Markets -- Analyst

Got it, that's helpful. Super helpful. And then, you guys have -- you have had a little bit of hybrid work activity whether it's corporate officer or sales and marketing folks out in the field. As we think forward to 2022, I guess it's somewhat related question. Do you anticipate sales people getting out and seeing clients more face-to-face meetings next year? And in fact, if that's the case and do you think that could have a positive impact on pipeline generation as well?

Andre Durand -- Chief Executive Officer

We do, I am pleased with the pipeline generation will be able to create through COVID without traveling. But the truth is, in large enterprises relationships do matter, seeing people eye-to-eye does matter. So while we have been able to operate effectively through it, I think the team and our customers are looking forward to getting back together. Whether it's white boarding sessions, whether it's kick off of implementations, where the first two or three days, you want to get the team together so, I do anticipate that there is going to be more face-to-face. I do believe it will have a positive impact on pipeline.

Matt Hedberg -- RBC Capital Markets -- Analyst

Great, thanks a lot. Congrats on the results, guys.

Andre Durand -- Chief Executive Officer

Thank you, Matt.

Operator

We have your next question from Brian Colley with Stephens. Your line is open.

Brian Colley -- Stephens -- Analyst

Hey, guys. Thanks for taking the questions. So I am curious, can you just talk about the competitive environment and kind of how it trended during 3Q? And also are you seeing any change in win rates against kind of some pure play SaaS vendors like Okta's and Auth [Phonetic]?

Andre Durand -- Chief Executive Officer

We are seeing improved win rates as a result of the -- really the maturity and differentiation of some of our cloud capabilities as of recent. We have not noticed, and overall, there is no -- there's been no rapid necessarily change in the competitive environment. We watched whether or not the Okta or Auth would have any material impact on where they showed up or how they showed up. I would say that our own cloud maturity has made us more aware if you will, of those deals. I think we are included where we might not have been included before, but generally speaking, where we were historically strong. We continue to be historically strong, this is in large enterprise, hybrid deployments cloud your way in an areas where we might not have been considered in prior years because of the maturity of our own SaaS PingOne that -- is absolutely improving in our world.

Brian Colley -- Stephens -- Analyst

I mean just thinking about channel and investments you made there I am curious if you are seeing channel partners start to have more meaningful impact on the pipeline now that's it's been a year or two since you have been investing there?

Raj Dani -- Chief Financial Officer

Yes. Brian, this is Raj. I can take that. So we are deeply committed to our channel partners and are working with channel partners now in almost all our deals or at least really pushing to do that and that's just a manifestation of just going all in with the channel. And I think they are feeling that. We have always been a good channel partner to folks, but I think we have -- this year, we have really sort of amped up that commitment. As we have talked about in and previous quarters. And it's not engaging in the channel is not something that is a flip you just sort of switch and now you are 100% channel company overnight, but we are seeing the kind of steady improvements that we expected to see at the beginning of the year and it's also in the come together. So we are really pleased with our team and how they are doing and how channel partners are reacting to those investments. We have over 125 channel partners out there; we are investing in them in terms of certifications around sales and enablement and all sorts of other training and marketing activity. So we would expect that trend to continue.

Brian Colley -- Stephens -- Analyst

Great. I appreciate the time.

Raj Dani -- Chief Financial Officer

Thanks, Brian.

Operator

We have your next question from Michael Romanelli with Mizuho Securities. Your line is open.

Michael Romanelli -- Mizuho Securities -- Analyst

Yes, thanks. Hi, guys. Just one from me actually touched on this a bit earlier, but was there any shift this quarter in the customer identity business vis-a-vis workforce identity?

Andre Durand -- Chief Executive Officer

Customer has been trending at an accelerated pace relative to workforce for several quarters now. This quarter was no different. So the majority of our new ARR now is being generated from customer use case that is by design where we have been leaning heavily in the customer use case, many of our acquisitions have been focused on our platform solution capabilities around the customer use case. So, we are very -- to be clear, our vision of the platform is one platform both use cases. 25% of our customers use us for both use cases that is increasing. I have signaled that before we do see a desire from large enterprises to consolidate, where they can to gain leverage from both the partner that they have for identity, but as well as the platform that they are using for both customer and workforce identity.

All of that said, the customer use case we believe to be a ultimately a larger it is today, and we expect in the future a faster growing use case in our platform has been differentiated for some time now on scale and performance. Some of the larger systems in the world run off of Ping, but in the future, we believe will be differentiated in the speed with which we can generate incredible user experiences without coding vis-a-vis the singular key acquisition, which is focused on the user journey enabling a user journey through identity that both frictionless and do so with the minimal amount of coding.

Michael Romanelli -- Mizuho Securities -- Analyst

Perfect, thanks.

Andre Durand -- Chief Executive Officer

Thank you, Mike.

Operator

We have your next question from Mike Cikos with Needham & Company. Your line is open.

Mike Cikos -- Needham & Company -- Analyst

Hi, thanks for taking the question guys. Just a real quick one for Raj to kick things off, but could you talk to the return of these large deals that you are seeing and maybe if we are trying to quantify what that, impact was to Q3. And in addition to that, anything you can talk to, regarding the decline in gross margins we saw this year. There was a slight decline in subscription. But I am more looking at the compression we saw in the professional services side as we are looking at the future of the business?

Raj Dani -- Chief Financial Officer

Yes. Let me take that one at a time. So in terms of deal activity -- we are seeing a return to what I would call more normalized buying behavior, which is in contrast to the COVID quarters', I will call them where we saw deals not go away, but it's not going away. But really get sort of phased -- phase and jumped up into smaller deals that sort of culminated into the original deal size over a period of time. That's largely now behind us, we are seeing that on an one-sie, two-sie basis. But for the most part that has -- largely sort of come back to more normal levels -- where what we were seeing pre-COVID which is a bunch of transactional run rate activity coupled with a couple of large sort of high six figure, seven figure deals. And we are starting to see that come back, we saw that in Q2, as we talked about last quarter that was probably an anomaly, the other way.

If I am recalling correctly, but in Q3, we saw a more normalized quarter similar to what we saw on -- in pre-COVID quarters. From a margin standpoint -- we are investing in our cloud, right. And we have been talking about that for several quarters now. We have introduced several new services, including PingOne advanced services and we are seeing a lot of traction there, but we are building our kind of entire infrastructure in advance of that. So, we will see operating leverage on that once we hit more scale, but where we are certainly sort of building out the -- our support and cloud infrastructure and hosting infrastructure in advance to that. On the pro-server side, it's largely a function of timing of hiring. It's also a function of enablement for our channel partners versus us directly maybe billing. We think that's healthier in the long run for our business. I'd say those are probably some of the factors that come to mind.

Mike Cikos -- Needham & Company -- Analyst

Thanks for that. And then just one real quick one for Andre, I am curious because we did talk to Global 3000 or maybe I am answering my own question here with the commentary that you had earlier about the Global 5000. But my sense is that, would this maturing and growing number of SaaS services that you have. It is in a sense expanding Ping's market opportunity and what I mean by that is, do you see these services is making Ping more consumable as we think about potential to expand down market is that a fair characterization. Can you extrapolate on that?

Andre Durand -- Chief Executive Officer

It's 100% accurate. The skills to maintain infrastructure down market are not present. Those companies essentially are required to consume identity capabilities. However, they can get them, but they don't have the skill sets to deploy and maintain mission critical infrastructure, the same way that the large enterprises do. So as our capabilities now our consumable as SaaS you can go in create an account and all of the services, which were historically only available in software for companies to run are now available as a SaaS or cloud offering. In addition to all of the new things that we have either built and/or acquired which are very SaaS focused that is going to inherently increase the acceptance and the opportunity for companies without the same level of sophistication that consume them. Now, many of the services that we provide probably do cater to down market and down market has those problems like single sign-on for example and MFA almost every company has those needs.

But some of the more advanced capabilities that we offer like data governance and authorization and API security. It might be that those services. Our address problems or issues that only large enterprises have. So we are cognizant that our product portfolio. It has been optimize the complete portfolio, let's just say that is optimized to tackle the sorts of challenges that large enterprises tend to have. But you are right. That offering at all in the cloud is going to improve our ability to move down market, should we choose.

Mike Cikos -- Needham & Company -- Analyst

Thanks again, guys. I appreciate the color.

Andre Durand -- Chief Executive Officer

Yes.

Operator

We have your next question from Patrick Colville with Deutsche Bank. Your line is open.

Patrick Colville -- Deutsche Bank -- Analyst

Hey, thank you so much for squeezing me in. Can I just ask about the guidance does the fiscal 2021 ARR guidance includes the inorganic contribution from Singular Key. And I guess if so, is any framework, you can kind of give us help quantify it or any kind of metrics you can share in terms of the how big Singular Key was even like as a kind of private company was kind of employees or anything to kind of help us -- understand that acquisition?

Raj Dani -- Chief Financial Officer

Patrick, this is Raj. I can take that. So Singular Key is a relatively small company probably just over a dozen folks between employees and between employees and contractors. They didn't have much in the way of ARR required. So it's really insignificant. And we are spending the time now rather than just simply rush to roll it out there. We are taking our time to integrate it into our PingOne cloud platform. And so the fiscal 2021 guidance really doesn't have much of anything on-coming from that.

Patrick Colville -- Deutsche Bank -- Analyst

It's relative and helpful. And can you speak over to margins I am looking at the model now, I would say one of the most impressive things of fiscal 2021 has been increase in profitability on the free cash flow line if I am calculating this correctly and so -- free cash flow margin year-to-date, up from five last year negative two years ago? So just help me understand, I guess that dynamic where that's coming from and clearly can't guide to next year, but just give us a framework as to how we should I guess, thinking about the margin profile from here? Thank you.

Raj Dani -- Chief Financial Officer

Absolutely. Patrick I will take that, too. So we are, as you know -- our financial ethos is to be a profitable growth company as you mentioned, we were close to breakeven a couple of years ago and cash flow positive last year, and again expect to be this year. So that's not by accident. We were very efficient and very disciplined and everything that we undertake and the business model has a lot of operating leverage in it. I'd say that we have been in investment mode last year and this year, again not sort of looking too far ahead, but we will continue to lean into investments where they are paying off. But we are not -- we don't sort of peanut butter spread our investments around and hope for the best we are pretty surgical in what we invest in how we invest. And in measuring those things and pivoting quickly from initiatives that maybe aren't delivering the highest ROI to doubling down in those that are.

Patrick Colville -- Deutsche Bank -- Analyst

That's right here. Thank you so much.

Operator

We have your next question from Jonathan Ho with William Blair. Your line is open.

Jonathan Ho -- William Blair -- Analyst

Hi, good afternoon. I just wanted to maybe start out with I guess, the improvement in terms of the Ping cloud capabilities, you have had this for a little bit of time now. And I am just wondering has this. If I could at all your relationship with Microsoft, which is oftentimes been a large partner on that side?

Andre Durand -- Chief Executive Officer

There's been no change in relationship as a result of the maturation of our cloud platform, our capabilities, Jonathan. We have enjoyed a good relationship with Microsoft as you would imagine nearly every, if not all of our large enterprises have strong Microsoft relationships, they are looking to provide identity services that integrate not just with their own Microsoft consume technologies, but they are on-prem, their legacy and there are other cloud capabilities or other cloud deployment. So Ping is pretty instrumental in providing a neutral identity set of services that allow those large enterprises to integrate identity across all of their clouds, their legacy and their on-prem. That's always been the case. I do believe that there will be an emerging set of opportunities between Ping and Microsoft relative to some of our new orchestration capabilities of Singular Key. We haven't explored those yet. We do anticipate exploring those in the years to come.

Jonathan Ho -- William Blair -- Analyst

Got it. And then, just in terms of I guess the U.S. government opportunity. Can you talk a little bit about how big of an opportunity PingOne for government could be in 2022 and maybe some of the rationale for why now to try to push into that vertical? Thank you.

Andre Durand -- Chief Executive Officer

We have had a number of government customers for some time that have run us on-prem. We have had growing demand from those and new customers for a FedRAMP certified offering but I would suggest that the FedRAMP certified offering isn't limited to simply federal government new or existing opportunities. There is a good swath of our private sector enterprises that do business with the government and it is a requirement that there solutions that interface with the government also be FedRAMP certified. So the FedRAMP opportunity FedRAMP certification is larger than simply an opportunity to sell the federal government. It's to allow the large private enterprises who are running Ping to also interface with the federal government. So we are very bullish on where this goes, we have been wanting a FedRAMP solution for some time. Getting a sponsor for FedRAMP certification is non-trivial.

We have got a very, very strong sponsor in the Department of Energy, who has been a Ping customer for some time and they have agreed to sponsor us for multiple levels of FedRAMP certification, some of the higher levels of which will allow us to move into some highly secure environments with our existing customers who do business with the federal government great.

Jonathan Ho -- William Blair -- Analyst

Thank you.

Operator

We have your next question from Andrew Nowinski with Wells Fargo. Your line is open.

Andrew Nowinski -- Wells Fargo -- Analyst

Well, great, thank you for squeezing me in for one more. I know you talked about PingOne and the maturity of your cloud solution, bringing into more deals, but I was wondering if the recent cyber-attacks. Like the one that Microsoft detected are creating new demand or do you think the impact from those attacks will be felt more in 2022 when companies reset their priorities in the budget?

Andre Durand -- Chief Executive Officer

I think all of these cyber-attacks are putting essentially more focus on what is already a secular shift from traditional security methods and paradigms to an identity-based security paradigm. So I don't see that there is any one attack necessarily pointing to, you must do this, so to speak. But what I am seeing is the nature and the persistence of the attacks and the nature of the attacks themselves are essentially exposing identity weaknesses and/or identity immaturity. And all of that combined with the notions of Zero Trust, which is basically moving from the notion of perimeter based security, firewalls and VPNs and trusted users on company issued computers in the building to a world where everybody is distributed, yet we still need to secure it and we are going to need to steer through the identity capabilities. So, I don't see it as an immediate and pending change from anyone cyber-attack, but every one of these attacks, adds to the argument that they need to invest in identity.

Andrew Nowinski -- Wells Fargo -- Analyst

Great, thank you.

Andre Durand -- Chief Executive Officer

So that concludes our today's earnings call. I want to thank everyone for joining us. We look forward to providing you with additional updates at our December 1, Investor Day. Thank you and good evening.

Operator

[Operator Closing Remarks]

Duration: 59 minutes

Call participants:

David Banks -- Head of Investor Relations

Andre Durand -- Chief Executive Officer

Raj Dani -- Chief Financial Officer

Andrew Nowinski -- Wells Fargo -- Analyst

Adam Tindle -- Raymond James -- Analyst

Gray Powell -- BTIG -- Analyst

Unidentified Participant

Catharine Trebnick -- Colliers Securities -- Analyst

Matt Hedberg -- RBC Capital Markets -- Analyst

Brian Colley -- Stephens -- Analyst

Michael Romanelli -- Mizuho Securities -- Analyst

Mike Cikos -- Needham & Company -- Analyst

Patrick Colville -- Deutsche Bank -- Analyst

Jonathan Ho -- William Blair -- Analyst

More PING analysis

All earnings call transcripts