Cybersecurity Is Big Business

In this podcast, Motley Fool analyst David Meier and host Deidre Woollard discuss:

• Metrics to watch in business-to-business tech companies.
• Why Palo Alto Networks reported on a Friday night.
• The growth trends for cybersecurity as a whole.

To catch full episodes of all The Motley Fool's free podcasts, check out our podcast center. To get started investing, check out our quick-start guide to investing in stocks. A full transcript follows the video.

This video was recorded on August 21, 2023

Deidre Woollard: It's a cybersecurity Monday as we look forward to a tech-heavy week, Motley Fool Money starts now. Welcome to Motley Fool Money. I'm Deidre Woollard here with Motley Fool analyst David Meier. David, how are you today?

David Meier: I'm doing fantastic. How are you?

Deidre Woollard: I'm doing great. You're a longtime Fool analyst, but you haven't been on the podcast for a while, so I'm happy to rectify that. I'm excited to have you on today because we've got a lot of business-to-business tech companies reporting later this week and one that reported last week that we're going to focus on. But looking forward this week, we've got Nvidia, of course, the big one, but we've got Zoom, Snowflake. We've got some others reporting this week. When I think about business-to-business, I think I want to look at customer growth, customer spend, what else should we be looking for.

David Meier: First of all, you're spot on. For every business we want to look at those things, because that's where the cash flow comes from, especially right now, one of the things that has been very important over the last 12-18 months, are these companies making comments about the sales cycles. During COVID, when everyone thought that work from anywhere was going to be the new way, the new normal, if you will. They spent a lot of money. But as the macro economy has changed, some companies are pulling back their budgets in response to what's happening.

The first thing we're going to do is we're going to figure out what is the current commentary about the sales cycles. Are they still lengthening, are customer deals getting pushed out. Things like that. The next thing we're going to look for are margin profiles. One of the things that since growth has slowed across the board, many companies early in this process made the switch to saying, you know what, if we're not going to be growing, we're going to make sure our margins are expanding. Because that's going to lead to increased profitability and increased cash flows, which a lot of these tech companies, especially smaller ones, weren't really promising a couple of years ago, pre-COVID, there were just all out growth. We're going to get big. We're going to grow. We're going to worry about margins and profits and cash flow later. But right now the game has changed and investors want to know, hey, if you're not profitable, when are you going to be profitable? If you are profitable, how profitable are you? How much cash flow are you generating? That's where my focus is going to be as these companies report.

Deidre Woollard: Yeah, companies are in their fiscal responsibility era. All of a sudden it's not about like, look how we're growing now. It's like but look how we're cutting.

David Meier: Yes, and the thing that they are trying to communicate to investors is scale. Because before when you're just growing, you're like, that's great. Invest for growth. But we also at some point, all the investors want to know, can you turn that growth into profits? If they're doing it correctly. That's what scale will bring investors.

Deidre Woollard: Absolutely. Well, I want to talk about a specific company because Palo Alto Networks, they announced their reporting on a Friday night after hours. For the entire week, the whole market was like, everybody's waiting an eyebrow, its stock goes down. Everybody is a little bit worried. They report on that Friday and it looks like a very good quarter for them that they apologized for a little bit of all the drama on the earnings call because it was not about anything bad to report, it was good, revenue was up 25%. It seems like they're solid. Why did they do that? Also what does Palo Alto Networks do?

David Meier: Let's address the Friday afternoon thing head-on. Over time in this business. If you have something bad to say and you don't want a lot of people to see it. You send it. You send it to the news wire at five o'clock on a Friday because most everybody is not in the office. The first reaction, mine too, was like, my goodness, they have something bad to say. But you're right. That that's not what happened.

I'll tell you what they do and then I'll tell you what are at least what management says they were thinking in making that decision. Palo Alto is a leading cybersecurity firm. What they have done over time is they started out focusing on firewalls, basically traffic moving into and out of businesses networks. They have transitioned themselves through to product development as well as a lot of acquisitions into a one-stop shop for all security products. The CEO, Nick Cachoeira, who joined in 2018, put the company on this journey. There were a number of rough patches so along that five-year journey. But it looks like they're really starting to hit their stride right now. One of the benefits of that is especially when you're dealing with big enterprises. If you have a full suite of products that you can present to a potential customer. That's great. That means that they don't have to go on different sales calls, they don't have to go. They can make hopefully better choices more quickly assuming that the products being offered are good. It turns out, what Palo Alto wanted to do was actually go through a look forward presentation in addition to reporting on their earnings and having the Q&A. That was the emphasis of doing it on a Friday afternoon, which to me still does not make sense. You if you want people tuning in, do not do it on a Friday afternoon.

Deidre Woollard: I thought that too. The reason they said they did it was because, I guess they've got a sales conference that was on Sunday, so they didn't want to have things out too far ahead. As you mentioned, it was not your traditional earnings score. I watched it on Saturday morning. I was expecting your regular earnings score instead, this is a two-and-a-half hour of video event, very, very well produced 134-page presentation. This was part earnings, but mostly it felt like an Investor Day to me, it felt like a pitch for a lot of the things that we're doing, including their move to real-time cybersecurity.

David Meier: Yes. You're exactly right. If they had planned a separate Investor Day, the back half or you're the back three quarters of the presentation that they put together. That would have been it. We'll see if they do this again. My guess is they won't, because unfortunately, when you're giving a long presentation about what you expect to do going forward. There's lots more questions. A lot of investors are going to question, hey, what are you doing here? Why are you doing this? Tell me more about what's happening in the marketplace. Those types of questions which need time, don't try to compress it onto the back half of an earnings call, just go through your earnings call, have your conference, have your Investor Day. I think their PR department is going to make some changes, but we will see.

Deidre Woollard: Well, it especially after seeing the way the stock reacted before the call because everyone was afraid of what to expect.

David Meier: Correct. [laughs] Unfortunately, optics matter here. Again, five o'clock on a Friday afternoon press release is not good optics.

Deidre Woollard: No. But I think it's interesting what they're trying to do with the real-time security. It makes perfect sense. They talked about it, how so much of the security that the cybersecurity that they're doing now is catching threats after they happen or trying to prevent them, but not being able to do that real-time, something's happening, mobilize the troops thing. It seems like that they really see that this is where AI comes in for them.

David Meier: Absolutely. There are a few firms out there in the space who have been pushing in this direction. One, it's completely logical that a company like Palo Alto, who again wants to be a one-stop shop, is also moving more strongly in this direction. Let's be clear. They have been doing this, but maybe not at the scale that they want to do going forward. But yes, attacks, no matter where they originate, the idea is to sniff them out as quickly as possible by analyzing data, figure out what the right remedy is to neutralize them, learn from it, and then be able to do it even quicker again. I cannot think of a better application for artificial intelligence and machine learning than that right there.

Deidre Woollard: Absolutely. Another thing that they talked about on the call was platformitization. They they used it over and over. As I understand it, thinking about platformitization as a larger thing in tech, we used to just be selling single services, now, companies are really selling a bunch of products. Zoom is doing this. We're going to talk about them after hours tonight. I'm sure we'll talk about on the podcast tomorrow about the platform, the things that they're trying to put together. It feels to me like everybody's saying their platform, and when everybody's saying there's something I tend to be like, maybe. What do we want to look for with Palo Alto Networks and others to know if the strategy is working? Is it customer spend? Is it recurring revenue? What do we look for?

David Meier: It's good that your spidey sense is working because platforming is actually been a buzzword for quite awhile, but it's actually important because again, if you can bring a suite of solutions, and it doesn't matter if it's necessarily just in cybersecurity, but it makes sense there. If you can bring a suite of solutions to a customer that basically accesses your platform and gets all of its access, whatever it decides to purchase through that one channel. It's a good thing for everybody. How do we want to evaluate it? Well, I think the first thing that we want to do is make sure that the company in question is spending heavily on research and development to make sure that its platform stays up-to-date, if you will, as well as expanding the number of opportunities that are available. Along the recurring revenue that you mentioned earlier, we want to look for billings growth as well. Essentially, once you've sign contracts, you get an idea of when the revenue can be recognized, the billings. Billings are a precursor to revenue. Hopefully, those two things should be moving in tandem. Again, what billings does it gives investors a look forward to say, OK, is the company's performance expected to come in strong? Is it starting to weaken? What's going on? It's a good indicator. One other thing you want to do from a platform standpoint is look at retention. Most companies are not giving you the churn number. That churn being people who have left the platform to try to find a different solution. But what you have seen, what you'll continue to see is called dollar-based net retention. What that is is it combines not only are people coming and going, so adding new customers, losing customers, but also it's a measure of our customers that you currently have spending more with you. If you see a number that's greater than 100%, what that means is even though some percentage of customers left, the current customers are buying more from you, and so it's another measure of health, if you will, of the platform. The last thing, if a company provides it, each one doesn't provide it, but some do, is a cohort analysis. Companies bring in a certain number of customers each year, so you have the 2019 cohort, 2020 cohort, etc. What you want to see is, what are the spending patterns of those groups of customers? If they're going up into the right, that's another sign that the platform is healthy.

Deidre Woollard: Interesting, I hadn't thought about the cohort analysis. I don't see that one reported too much. I see the customers grouped in terms of how much they spend. Everybody wants to talk about that or how their larger customers are doing, not that many of them want to talk about the specific cohorts.

David Meier: Once in a while you'll get it. As an analyst, I absolutely appreciate it. [laughs]

Deidre Woollard: Because it gives you a specialized window.

David Meier: Sure.

Deidre Woollard: Yeah. Well, the cybersecurity business in general, it's had this massive run-up in recent years. Obviously, the headlines keep growing. We see these attacks and everybody gets scared. We know that the big companies, they really have to have this. Of course, like we just said, they talk about the big spend with the larger, but what about the smaller companies? Is this something that we're just going to have? With a company like Palo Alto, are they just selling more things to the bigger customers or are they also looking at smaller and smaller customers as well?

David Meier: A great question. One of the paradoxes is, as company becomes a leader and gets bigger, it has to allocate its sales dollars to a sales force as effectively as it can. The best way to do that, unfortunately, is trying to move up in terms of the size of the deal. It's not that they're going to be ignoring smaller customers or customers who aren't going to come in with signing a $10 or $20 million deal upfront. Going back to what we were talking about the platform, a company like Palo Alto should have a set of offerings that are tailored toward smaller companies. Maybe they don't necessarily have a Salesforce that helps with them. Maybe there's a self-serve sales channel that can help bring that customer in and then hopefully, as their spending grows, then they can get an account manager dedicated to it then a sales force to figure out how to best serve their needs as they grow. You're never going to completely ignore potential sales dollars, but the reality is for companies like Palo Alto that are, this is almost a $75 billion company. They're going to focus on more of their investment dollars on larger deals. Figuring out how to get those existing customers to spend more of their budgets with Palo Alto.

Deidre Woollard: Absolutely. Though you talked earlier about that longer sales cycle that we definitely saw other companies talking about. It seems like that is going to continue maybe for a little while because there still is that lingering question with B2B companies. They know they need to spend, but they're also, they're trying to figure out what's happening. The economic numbers, they're wishy-washy. They're a little bit uncertain. Some companies are not quite sure how much they should be spending.

David Meier: I think you're exactly right. Again, as someone who follows this space, this has been a something that every management team has commented on. If we look at the billings in the fourth quarter for Palo Alto, they actually grew a little bit slower than their revenue did. It is an indication that it looks like at least Palo Alto is still in a, hey, I haven't gone through the call completely yet, but it looks like they're still in the mode of, hey, some customers may need a little more time to sign a deal. The other thing is, if, again, Palo Alto was very quick to point out that the number of $10 and $20 million deals grew significantly more quickly than smaller deals. If you're a CEO in this environment and basically you probably need your signature in order to sign off on a $10 or $20 billion deal. If it takes another month, they're going to do that. I won't read too much into the billings number because of the environment but this is why it's important to understand the context. If you get into the numbers, figure out what's going on in the environment, figure out if it makes sense what the company is reporting and then you can look forward as an analyst and figure out if it's a good deal or not.

Deidre Woollard: Absolutely. Well, in cybersecurity, there's a bunch of players including CrowdStrike, Zscaler. They all went up a little bit on the Palo Alto news. Thinking about the space as a whole, it seems to me, as an outsider, it seems like they're competing for the same business. Maybe they have slightly different angles like I know Zscaler's all-in on zero-trust, Palo Alto has some zero-trust, too. If you're an investor, are you trying to figure out who's going to be the big winner? Is there going to be a big winner? How do you think about cybersecurity as an investment sector as a whole?

David Meier: That is an excellent question. I'll take you real quick backwards when Palo Alto started, it focused on the firewall, which was the most important thing at the time. Gradually it shifted with the market as new needs for cybersecurity presented themselves. Back in the early days, you couldn't necessarily predict where Palo Alto was going to be 10 years down the road because no one knew what the threat environment was going to be like. Picking winners versus going with leaders. It really depends, I think, on what an individual portfolio needs. For example, if there's no cybersecurity in someone's portfolio and they are just looking for it, Palo Alto is a great company to consider. Again, they're focused on a platform approach. They have a wide variety of products that you can benefit from because their addressable market by having products that go after those markets is enormous. If they can continue to do what they're doing, maybe it's not the 10-baggers or in a compressed time frame but you can get good exposure to the industry and hopefully generate a good return as Palo Alto performs. But you're exactly right, if you're looking for a winner or an individual name, first of all, you need to understand what it is that company does. If it's CrowdStrike, you're looking at the endpoint market. If it's Zscaler, you're looking at the cloud market. Then you have to ask yourself, are those two companies leaders? Who are companies that are trying to disrupt them? That's when you might be able to say, hi, what SentinelOne is actually trying to change the way that endpoint protection is done. Depending on what your portfolio needs, again, you can go for a leader, you can go for a disruptor but the good thing, this is a good thing is there will always be demand for these companies' products.

Deidre Woollard: We know there's always threats. Somebody is always trying to hack somebody because there's money to be had and when there's money to be had people do things. Is this a game that goes on forever? You've got the bad guys constantly trying to get in. You've got the hired guns constantly trying to protect. Hired guns keep having to hire more hired guns as the attackers try different things. Is this just a game that goes on forever?

David Meier: I think so. The reason is there's a huge incentive on both sides, unfortunately. whether the attacker or the attackee, is that the right word to use? Or you're being attacked? Yes. The behavior in this particular instance is absolutely being driven by the incentives. The incentives are, if I get smarter and figure out how to create new attack vectors, then I can perhaps penetrate into systems and cause some havoc and try to extract/extort money from the system. Again, instead of taking a step back, let's move higher and look down on the industry. We as a global phenomenon, we are becoming more and more dependent on data every day. We're not going backwards. We're not going to become less dependent on data. The more network connections there are, the more data that's being moving around the system, there's actually more opportunities being created for these attackers to go after. Just because of the innovation on one side to try to make better business decisions or trying to do business faster is actually perversely creating a more of an incentive for the attack vectors to come in. The answer, I think if we play that out it's just going to be back-and-forth. On the attacker side, if you innovate and figure out a new vector that gets you a short-term win, you're going to get your pay off and then the industry will figure out how to deal with it. That's what all those companies are trying to do. The next ingenious attacker will try to figure out the next one and so on and so on.

Deidre Woollard: It just keeps going on. Well, thank you for breaking that down with me today, David.

David Meier: My pleasure. This was a lot of fun.

Deidre Woollard: As always, people on the program may have interest in the stocks they talk about and the Motley Fool may have formal recommendations for or against, so don't buy or sell stocks based solely on what you hear. I'm Deidre Woollard. Thanks for listening. We'll see you tomorrow.