Image Source: FireEye

It's been a difficult year for FireEye (MNDT) investors. Shares of the cyber security company are down more than 20% year-to-date and more than 65% in the last 12 months alone. Most of that loss has been fueled by disappointing growth -- although investors have been willing to tolerate FireEye's lack of profits, its sales haven't risen as fast as many had anticipated.

In May, a disappointing revenue figure contributed to a major sell-off. In the first quarter, FireEye brought in $168 million. That was up 34% on an annual basis but was less than the $172 million analysts had been expecting. Worse, FireEye lowered its revenue guidance for the year, projecting weaker sales growth than it had previously forecast.

FireEye's more sluggish revenue growth is certainly disappointing, but there's more to the story than falling demand. FireEye's business is in the midst of a major shift, one that's taking a toll on the top line.

Ditching the box

Once upon a time, FireEye's business centered around the sale of physical appliances: tangible boxes that FireEye's customers attached to their networks. In the first quarter of 2014, appliances generated more than half of FireEye's platform revenue (a metric that tracks FireEye's core business, excluding less relevant factors like general support). But last quarter, that figure stood at just 31%. Increasingly, FireEye's customers are shifting their spending to subscriptions, and some are embracing FireEye-as-a-Service (FaaS).

Image Source: FireEye

Many of FireEye's subscriptions work in conjunction with its appliances, but some do not. In particular, FaaS gives customers the option to pay for a bundle of FireEye services without buying hardware. When FireEye's customers opt for subscriptions and services in place of its appliances, it weakens company revenue in the near-term.

When it comes time to calculate revenue, FireEye accounts for subscriptions and services differently than it does for appliance sales. The latter show up almost immediately on the top line, as the company recognizes appliance sales at the time of shipping. Subscriptions and services, however, are more complicated. FireEye bills its customers upfront but recognizes the associated revenue over time.

During FireEye's May earnings call, management emphasized this point repeatedly, blaming both its first quarter revenue shortfall and its weakened guidance on its customers' changing preferences. FireEye CFO Mike Berry explained:

We saw customer preference for cloud and subscription offerings pick up steam in the second half of 2015, but the acceleration in the first quarter of 2016 caused a more dramatic mix shift than we expected . . . during the last few weeks of the quarter we saw a fairly significant change in the composition of the first quarter product pipeline as many of the product heavy deals pushed into future quarters. While we expect some of these transactions to ultimately close as product deals, we also expect that some will switch to FaaS and other subscription offerings . . . the impact on product heavy deals was greater in the first quarter than in previous quarters, and the mix of subscription and total billings was higher than we expected when we first issued our Q1 guidance. As a result, we finished toward the low end of our total revenue range . . .

Then-CEO Dave DeWalt gave a specific example of a customer opting for a subscription over an appliance:

Our largest transaction in Q1 was an eight figure cloud email deal in the US federal region protecting more than 100,000 mailboxes. A year ago this deal would have been an appliance-based solution with at least half of it recognized as in period product sales.

Later, he emphasized how the growth of FaaS was also contributing to FireEye's disappointing revenue:

[FaaS] drives more product subscription and more billings in that area versus revenue in [the current] period . . . hence why we confirm[ed] the billings for the full year but had to lower the revenue a bit.

Billings growth has remained steady

In addition to reporting revenue, FireEye also discloses billings, an alternative sales metric that isn't affected by the company's shifting product base. FireEye's billings are based on its quarterly revenue but also add the service and subscription deals FireEye has made in a given quarter. To its credit, FireEye's billings have remained steady. Last quarter, FireEye generated $186 million of billings, up 23% on an annual basis and better than the forecast it gave in February. At the same time, it reiterated its full-year billings guidance.

The move away from appliances has certainly taken a toll on FireEye but could ultimately benefit the company in the quarters ahead. A more service-orientated business could offer better margins and the prospect of onboarding customers at a more rapid pace. Moreover, customers could find more value and be enticed to do more business with the company.

"Not only do we believe the initial deal sizes tend to be larger and the lifetime value of a customer higher, but the expanded pool of recurring business creates a solid foundation for future growth," Berry said. "We view this long-term as a good thing."