In case you missed it, I published Nvidia, Snowflake and Sea Limited Earnings Reviews, as well as a Lemonade Investor Day review during the week.

Amazon will invest another $4 billion in Anthropic, bringing its total cash outlay to $8 billion. This will be paid out in three equal increments. The announcement includes a significant deepening of an already tight relationship. In addition to being Anthropic’s primary cloud partner, it will now be its primary Foundational Model (FM) training partner as well. Per the press release, Anthropic is “excited” about AWS’s cost performance here. I think they’re also excited about access to another $4 billion in funding, but this still offers more evidence of Amazon’s training chips (appropriately called Trainium) gaining adoption. The two will work to further customize this hardware for Anthropic-specific needs. Amazon has spoken a lot on the last few calls about needing to deliver cheaper alternatives to Nvidia’s world-class, yet expensive processors. Trainium is an instrumental part of that. Anthropic will also use AWS’s inference chips (called inferentia), but it doesn’t sound like that will be as exclusive of an arrangement.

Beyond price performance and a large incremental investment, this news is also a response to the fantastic growth AWS Bedrock has delivered for Anthropic’s Claude models. It’s a lot easier to find business when directly plugging into a cloud business environment that does $100 billion+ in revenue per year.

Finally, the two will offer shared customers the ability to customize Claude models with their own first-party data. According to the press release, fine-tuning for these specific models will be a “benefit uniquely enjoyed by AWS customers.” Anthropic is considered world-class in terms of pure-play model builders creating elite products. It’s as good or better than OpenAI, Cohere etc. Considering this, the exclusive customization item is quite the selling point for winning more cloud workloads.

Read more about Anthropic in Section 5 of this article. 

News:

The company will be openly referred to as “Search Giant” or “mega-cap” in this piece to avoid Gmail flagging the email send. 

The Department of Justice is formally requesting a sale of Chrome by the Search Giant. This past summer, Judge Amit Mehta ruled that Alphabet created an illegal search monopoly, and this is the DOJ’s recommendation to resolve that finding. One may hear “illegal search monopoly” and think… uh what about Microsoft or all other mega-caps building integrated search engines or the new disruptors like Perplexity that everyone is (supposedly) using. That’s entirely fair, but remember that Chromium is what powers a lot of these players. This is Google’s open-source project used to build Chrome, Edge and many others and is the view regulators are taking to think of this as a monopoly. I think that’s a large reach.

Mehta will decide on the DOJ’s recommendation. If accepted, the search king will surely appeal and drag this process out for years. Based on the company calling this a gross power grab and bad for consumers, I think that’s a safe assumption.

Mehta’s concerns centered on two main things. First, its practice of pre-installing Chrome software on Android devices cuts consumer flexibility. It all but ensures consumers will use Chrome, as it’s the first one they see and perfectly integrated into all of the other productivity products they use every day. Secondly, the judge also explicitly called out its $20 billion deal with Apple to make Google Search the default option on Safari. This isn’t directly related to Chrome, but ties into the same dominant web presence that is being scrutinized here.

Mehta openly spoke out against these arrangements. He did not even mention the idea of forcing asset sales to weaken its grip on the industry.

Implications:

Chrome has a 60% market share and is a key piece of this mega-cap collecting needed data to target marketing impressions within ad campaigns and personalize content across search and YouTube. While it isn’t directly a cash printer for the company, it does strengthen the cash printing abilities of so many of its other products. For this reason, I don’t really find a forced sale to be a positive thing. Yes, it will make about $20 billion (estimated) from a sale and pocket another $20 billion if judges rule its Apple deal to be illegal. But? The ecosystem is what makes this company so truly special and dominant. Weakening data sharing and control within it is not good for the Search Giant in my mind. Still, if this were to happen, the company would surely create back-door data sharing agreements and preferred partnerships with Chrome to maintain as much control as it can. For this reason, I think this would be a small negative for for the company (still negative).

Likelihood & What Happens Next:

In addition to the negative impact here being modest, I don’t think this DOJ decision is at all material or meaningful. Why? Because the people making this decision will not be in power in a few weeks. The assistant attorney general has been working in tandem with FTC Chair Lina Khan on this decision. These are two of the most anti-mega-cap decision makers we’ve had in office in a long time. The new administration has already explicitly said it can create a “more fair company without breaking it up” which already offers clear evidence of the new leaders carrying a more friendly mindset.

I think it’s likely that the new administration is more friendly to this company. I also think it’s likely that a forced data sharing proposal between Google and its competitors will be thrown out. A hearing will take place next April, with a final decision expected next August.

One more note here. There’s a separate ad-tech-related antitrust suit that the Search Giant is currently dealing with. I think this one is actually a lot more material and will force the company to change its ad exchange practices. It is surely a conflict of interest to represent sell-side ad demand and to control a lot of the impressions this demand is routed to. I think that will have to change in the future, but see the material impact being a healthier digital advertising ecosystem, more so than a weak Alphabet.

More News:

Palo Alto is a cyber security company competing across endpoint, cloud and network use cases. It’s pushing very hard to bundle next-gen products into larger deals to differentiate vs. firewall-based competitors like Fortinet and beat next-gen disruptors. It calls this process “platformization,” which will again be a key piece of this review. There are 3 major pieces of their initiative:.

Cortex: Its endpoint security segment is called Cortex. Extended Security Information and Event Management (XSIAM) is the centerpiece for platformizing this section. XSIAM brings together Extended Security Orchestration, Automation and Response (XSOAR), Extended Detection and Response (XDR) and Security Information, Event Management (SIEM). XSOAR helps automate and guide best practices for incident response while ranking severity of threats. XSOAR is also where its attack surface management product (called Cortex Xpanse) lives to obsessively seek out and uncover any vulnerabilities. XDR infuses non-endpoint data sources into breach protection to extend coverage beyond strictly that endpoint. It relies on significant 3rd party data sharing to optimize potential utility. SIEM aggregates data and events. XSOAR relies on scaled, complete data ingestion; SIEM’s and XDR’s capabilities allow that to happen.

Strata: The network security suite is called Strata. This is where Palo Alto is supplanting legacy firewall vendors by offering (what it views as) superior, software-enabled firewalls alongside a suite of network security software. It deploys software-defined wide area networks (SD-WANs) within firewall environments. SD-WANs serve as virtual network securers using a software-based approach to protection. Palo Alto protects networks using a “zero trust” architecture. Zero trust means a bad actor cannot penetrate the most vulnerable part of a digital ecosystem and move freely within it thereafter. Zero trust ensures consistent and complex validation of these permissions at every turn. It ends the game of “everyone within a firewall environment getting perpetual, unconditional access” and greatly limits the potential damage of network breaches.

There are two pieces of the network bucket: modern hardware and software. In hardware, PANW provides “next-gen firewalls” with tools like contextual app inspection (more malleable access rules), intrusion prevention, URL filtering, data loss prevention (DLP) and more. Secure Access Service Edge (SASE) is the overarching software product that ties its network platformization approach together.  SASE conjoins tools that help prevent unauthorized access to data, abuse of networks (like phishing attacks to overwhelm networks with traffic) and broad visibility into health and performance of a network.

Prisma: The cloud security suite is called Prisma. Like XSIAM and SASE are the platformization pillars in endpoint and network, in cloud it’s the Cloud Native Application Protection Platform (CNAPP). CNAPP includes Cloud Security Posture Management (CSPM), which organizes access compliance, provides overarching cloud ecosystem visibility, and proactively blocks misconfigurations. Beyond that, Cloud Workload Protection Platform (CWPP) is Prisma’s cloud workload protection tool. Most recently, Palo Alto debuted (CDEM) to “evaluate internet exposure risks and discover unknown internet-exposed cloud assets.” Finally, it added cloud detection and response (CDR).

While these three product groups are technically separate, they routinely pull context, service and data from each other to uplift overall value creation. Again, that’s how PANW is looking to more effectively compete. Prisma Access is important for network security, its CDR Cortex tool readily utilizes Prisma, etc.

Cybersecurity remains the most macro-insulated, non-discretionary spend bucket in technology in the eyes of Palo Alto leadership (they’re right).

It removed annual billings guidance and disclosure from the supplemental release. This is related to a shift in business focus. It is now prioritizing large, bundled, multi-year deals over things like product sales where billings is a more important metric. RPO encompasses total deferred revenue and backlog, which does a better job of capturing this shift. 

EPS is expected to compound at a 13% clip over the next two years.

Platformization:

Platformization was again a key theme of the call, and will remain a key theme in the years ahead. The company completed 70 net new platformizations (standardizing on 1 or more of its product suites) to cross 1,100 during the quarter. Notably, about 23 of these came from its recent QRadar acquisition within security operations (SOC) and endpoint. 

PANW remains on track to reach 2,500-3,500 platformizations by fiscal year 2030, and that’s important. Platformization means higher retention, lifetime value and customer loyalty. It also means more deferred revenue and trials, which both heavily impact billings. Again, that’s why PANW is shifting away from a billings emphasis, to a focus on ARR and RPO. It’s pushing for longer-term contracts where more revenue is collected over time, rather than upfront.

This shift continues to bear incremental fruit. This quarter, NGS ARR for platformized customers rose another 6% vs. last quarter and overall NGS ARR from platformized customers rose from 50% to 53% Y/Y. This is a big reason for its continued optimism in $15 billion in NGS ARR by fiscal year 2030. The company talked about setting the platformization trend and now all others are following suit. Candidly, I don’t think that’s accurate. PANW did invent the platformization word, which I guess is cool. But? Competitors across endpoint, network and cloud have been pushing for vendor consolidation and platform unification for years. PANW wasn’t first, but they are finding great success here today.

All in all, Gartner sees 75% of security leaders pushing for point solution displacement, with just 15% of these leaders having embraced an overarching platform approach to date. The runway is long.

“While many of our competitors are talking about their platform approach, we don't believe they're equipped to deliver it in the way we can.” –

CEO Nikesh Arora

Network Security:

Palo Alto enjoyed 20% Y/Y SASE customer growth and 40% Y/Y growth in $1 million SASE deals. Interestingly, more than 40% of these SASE wins were brand new logos for the company this quarter. Meaning? SASE is quickly emerging as a modern top-of-funnel driver for this part of the suite. That matters a lot, as this tool has a far longer runway, with much faster expected growth than anything it does with modern, cloud-based firewalls. A dominant SASE presence is quickly building and quite encouraging.

While SASE is the true growth story here, ELAs that included firewall deployments still rose by more than 10% Y/Y. And to nurture this still solid growth, it debuted an “AI-powered tool for operational technology (OT) environments.” As part of this, it introduced a new version of its ruggedized firewalls, which can tolerate extreme temperatures, humidity etc.

“We are seeing customers deploy more software firewalls to protect their cloud instances… we continue to feel positively about strength in public cloud-deployed software firewalls. These represent 70% of our total virtual firewalls ARR and are driving our growth in this area.”

CEO Nikesh Arora

For AI-enabled network security, it now has products and agents in the hands of hundreds of customers. It also made its Strata Copilot generally available to the public. Like Microsoft Copilots, SentinelOne’s Purple AI, or CrowdStrike’s Charlotte AI, this is meant to turbo-charge and augment security analyst productivity by automating tedious workflows and processes. It can provide prioritized alerts, recommend the best course of action for remediation and even carry that out for customers.

Recall that PANW’s product suite was built mainly through M&A, rather than internally. As such, it takes time to fully integrate acquisitions. PANW has also not slowed down on purchasing new companies, which simply lengthens the to-do list. The initial focus was on ensuring that all three product suites were fully unified into cohesive platforms. Going forward, attention will turn to integrating cloud and endpoint security tools within its network security bread-and-butter. Enriching network security with endpoint and cloud-based context can greatly enhance coverage efficacy and speed. This is a key part of its planned differentiation compared to other firewall-based vendors and SASE vendors too.

More on Network Security – Secure Enterprise Browser and Talon M&A

Palo Alto bought Talon in 2023 to add a “secure enterprise browser and to augment its SaaS application security offering. This created the foundation for what is now called the Prisma Access Browser (PAB). It encrypts and secures remote network connections, prevents breaches and secures data across remote, siloed workforces. Per leadership, it “knew this technology” would become “increasingly important to secure unmanaged devices” for contractors, consultants, 3rd party vendors etc. PANW sees itself as the only firm to offer a product like PAB within an overarching SASE suite. Talon has become an instrumental part of SASE, cloud-native data loss prevention (DLP) and several more PANW capabilities and has already led to 115+ customer wins. 

This browser-oriented product has been especially popular with AI native applications and companies that routinely pull information and talent from all over the world. Finally, this product is becoming a key part of virtual desktop infrastructure (VDI) replacement to secure mobile devices remotely. Prisma overall has 16 million active SASE licenses, and PANW sees a clear opportunity for cross-selling this new, unique capability.

“Browser is the ideal place to counter targeted attacks such as phishing, secure privileged users, and enable access to risky web applications.”

CEO Nikesh Arora

Endpoint Security:

While Prisma crossed $700 million in ARR last quarter, Cortex crossed the $1 billion ARR milestone this quarter. Across XDR, XSOAR, Xpanse, and QRadar. As a reminder, Palo Alto bought IBM’s QRadar product for $500 million a few quarters ago. Qradar is a legacy SIEM tool. It will also pay an earn-out over “multiple years based on successful migration of QRadar on-premise customers to XSIAM.” PANW will become IBM’s preferred cybersecurity partner and IBM will platformize on Palo Alto’s three product suites too. So far, 550 QRadar customers have added PANW’s XSIAM product, which represents $80 million in total contract value. It also has a $1 billion pipeline, indicating more financial benefit to come.

XSIAM added 400 new customers and delivered 180% Y/Y growth in customers with over $1 million in ARR. It also just debuted its managed security service provider (MSSP) program for customers needing human-based support to run their SOC.

Like cloud and network security continue to converge, cloud and endpoint do too. For example, combined customers here rose 15% Y/Y. To nurture this progress, it debuted a CDR product for endpoint environments and integrated data security remediation with its XSOAR and DSPM products. IT also integrated XSOAR and DSPM tools within Cortex during the quarter.

More on Cloud Security:

AI Cybersecurity Product Momentum:

Palo Alto’s Secure AI by Design portfolio is finding needed traction. This simply refers to its suite of AI-enabled tools across all three product pillars. In network, it helps with things like Domain Name System (DNS); in cloud, it forms the backbone of its AI security posture management (SPM) tool used to optimize app hygiene. This and its AI runtime tool have enjoyed the most traction within this product bucket early on. For endpoint, it’s a vital part of XDR infusing and making sense of needed, incremental content to uplift threat protection. It helps everywhere.

So far, it has hundreds of AI access customers using it to secure 750 AI-native apps. It sees this as “leading the industry.”

During the quarter, it debuted its Strata Copilot as expected, and another interesting Copilot that deserves a lot of attention. It purpose-built a separate GenAI companion for internal work automation. While protecting AI apps will be a large revenue driver in the years ahead… This work will ensure that top-line strength coincides with optimal margins.

Like everyone else, Palo Alto is making Agentic AI a bigger focus area. The new buzz phrase. As a reminder, this is goal-oriented AI that tells models to complete a task in a more automated way at their own discretion. It offers less structure and rigid instruction. It’s working hard to “embed agentic capabilities across the copilots.”

Platformization Deals:

There were four large deals highlighted to depict continued platformization momentum. A large tech company signed a $50 million SOC deal with Palo Alto that XSIAM deployment and the displacement of several SIEM point solutions. The company also added XDR as it platformized across Cortex. Palo Alto was able to deliver large total cost of ownership benefits and broader SOC visibility. This was an existing QRadar customer, indicating that it can drive more powerful cross-selling. This client was already a network security platform customer, but deepened that contract with more SD-Wan purchases this quarter.

It landed a $15 million network security platformization deal with a large hospital system, which included an Enterprise License Agreement (ELA) and legacy firewall displacement. ELA is its product bundle that laces together its next-gen SASE, XSIAM and cloud platforms with its firewall business. Its software-enabled firewalls, it thinks, position it perfectly for future SASE growth with this customer. The customer also added XSOAR to unlock future Cortex platformization. It then landed another network security platformization worth $20 million on the “basis on consistent architecture and lower costs.” That’s a platform in action: better interoperability… fewer vendors… broad efficiency… better outcomes. Finally, Palo Alto cited a $30 million platformization deal across SOC/endpoint and also network security. The customer added several network products, including a full SASE implementation, and also new endpoint products including XSIAM and XDR.

All in all, $1 million+ accounts rose 13% Y/Y to 305 and $5 million+ accounts rose 30% Y/Y to 60. And notably, PANW enjoyed a reduction in customer financing needs for landing these large deals compared to previous quarters.

The quarter was fine. Expectations and its multiple likely both got a bit ahead of themselves, but there’s nothing in here that creates pressing fundamental concern. Sell-siders probably just wanted a larger guidance raise and I don’t think that’s at all a reason to turn sour on this if you were bullish heading into the report.

I prefer other cybersecurity names, but do consider this the highest quality investment that I don’t currently own. Their presence across all three pillars continues to broaden as their platformization transition continues to work. This company companies to execute within multiple pieces of (I think) the most durable secular growth story on the planet: cybersecurity.

SoFi’s tech platform (Galileo) got a great piece of news this past week. It was named by the U.S. Department of the Treasury’s Bureau of the Fiscal Service as a “provider” in its “largest prepaid debit card program for Federal Benefits.” As part of the news, the program will add service for online access to funds, bill pay and more. The Bank of New York Mellon (BNY) will manage the program, Mastercard will be the payment network and Galileo will be one of four providers. According to the company’s Chief Product Officer, the providers will “work as a team,” but Galileo will be the program’s processor. This means about 3.4 million new accounts for the tech segment, representing 2.1% of the current base.

That part of the news is encouraging, as tech revenue growth has been the lone laggard in SoFi’s elite financial execution. More importantly, I think this is a great reputation-builder for Galileo in its bid to win large banks and embedded finance contracts. It’s hard to believe this vote of confidence from the Treasury Department won’t move the needle for  other customers. It should create incremental confidence in Galileo’s platform resilience and overall utility.

The Trade Desk announced Ventura this past week as its new cross-streaming platform TV operating system. This will put them head-to-head with other operating systems vying for traffic like Samsung, Roku and many others. It will partner with smart TV manufacturers and “other streaming aggregators” to drive adoption, with Disney, Paramount, Tubi and Sonos named as early supporters.

For the last several quarters, frustration with the opaque programmatic advertising supply chain has been a key theme of Jeff Green’s prepared earnings remarks. He laments about several players in the ecosystem confusing publishers and brands with unfair measurement and “extracting more value than they provide.” This shows up in a large disconnect between ad return reports and actual revenue contributions from marketing dollars. With that context, this announcement makes a lot of sense.

“At The Trade Desk, all we want is a fair marketplace, where supply chain costs are minimized, and advertiser trust can thrive.”

Co-Founder/CEO Jeff Green

How do you control the ecosystem? How do you trim the fat from this ecosystem while supporting value-creating partners and stakeholders in the best way you can? How do you create a better ad supply chain? By extending its supply chain presence from ad campaigns all the way to a standardized operating system across publishers (starting with just a few). This is stretching its grip right to the core of the infrastructure.

As always, The Trade Desk will provide this publisher-facing support without owning any content. And while that’s highly important, Ventura is still another mark of it working more closely with the sell-side (publishers). In this case, it will simply allow streamers to participate in a more open-source operating system. This will ensure more complete access to industry advertising demand, better data sharing and better results.

TTD’s pristine reputation makes it the perfect candidate to build this product in a trusted manner. Just another positive byproduct of always doing things the right way and being the company that creates more value than you charge for: people want you to do more for them.

While the supply chain efficiency is quite exciting, the impact it could have on the user experience is equally exciting. If TTD controls more of the streaming OS landscape, it can infuse its industry-leading targeting algorithms into a larger portion of streaming ad impressions — again while eliminating unneeded supply chain players and reducing the number of mouths to feed. All of this means more revenue for publishers and still higher returns for buyers (while TTD gets a handsome 20% cut). In turn, this means lower ad load needs for consumers (because impressions work so much better) to create a better product offering.

“The Trade Desk has been a great partner and real innovator in the programmatic space, and we are excited to see them bring their approach to the OS marketplace. Both broadcasters and consumers will undoubtedly benefit.”

Paramount Advertising President John Halley

Walmart is expected to compound EPS at an 11% clip for the next two years.

“U.S. customers remain resilient with behaviors largely consistent over the past 4 to 6 quarters. They continue to seek value to maximize their budgets while also choosing convenient options to save time.”

CFO John Rainey

“We continue to gain market share in the U.S., both in grocery and general merchandise. Households earning more than $100,000 made up 75% of our share gains.”

CEO Doug McMillon

While this is positive for Walmart, it does point to affluent consumers continuing to trade down, which is not indicative of an overly healthy consumer. Taking the first two quotes together, the macro backdrop for Walmart seems to be sequentially stable. It isn’t terrible, but it’s not amazing either.

“Across the company, inventory is in very good shape. The unique characteristics of this quarter included a U.S. port strike, 2 large hurricanes and the flooding they caused. Our team did a really nice job preparing before those events, and they worked hard to aid recovery after the storms.”

CEO Doug McMillon

Starbucks is reportedly considering a partial sale of its China business. I love this. China is the market where the coffee giant’s struggles have the lowest probability of turning around. Irrational price competition has been consistently intense, sales growth has been abysmal and this has been a large black-eye in the overall portfolio. It’s hard to durably compete in China for popular U.S. brands. Others, like Disney, have had to do so through joint ventures, and it looks like SBUX might as well. The Chinese government has no issue with U.S. companies helping its economy generate more growth. Whether you or I like it or not, it does have an issue with U.S. companies (in their mind) extracting value from its consumer base. One could argue that SBUX is currently seen in this light, but selling a chunk of its ownership to a local entity could quickly resolve this.

Starbucks is also not struggling to find growth opportunities. There is significant low-hanging fruit to right the ship in the U.S., with plenty of other promising growth stories across Korea, Japan, India, The Middle East, Latin America etc. To me, this could remove a large distraction for the company and allow it to focus on markets where its value proposition is more compelling. It also diminishes geopolitical risk, which is especially notable as the incoming administration continues to talk about more tariffs. 

Friendly reminder that I think Brian Niccol is one of the largest CEO upgrades that I can think of in recent history.

Disney (DIS) is accelerating investments in Korean and Japanese content. Fox and Disney’s Hulu also signed a new 5-year agreement, including advertising purchases, streaming rights and more.

Apple (AAPL) is offering Indonesia a $100 million investment to remove the current iPhone ban there. It’s also building a large language model (LLM) to release in 2025. This is interesting, as it has relied on partner models from OpenAI and Alphabet up until now.

Uber (UBER) is considering a $10 million Pony AI investment (driverless technology based in China) as part of that firm’s upcoming IPO.

Morgan Stanley sees CrowdStrike (CRWD) sharply bouncing back from the July outage. It sees upside potential for Q3 results.

I was also finally able to get to the Cloudflare (NET) Q&A to finish reviewing those earnings materials. It was somewhat uneventful, but here were the highlights:

Macro is starting to improve for them. This was especially true in Europe, which is different than many of its peers. Across Asia and North America, it’s also seeing slight macro improvement. Interestingly, the go-to-market overhaul for NET is most advanced in Europe, and it saw another 22% Y/Y boost to sales productivity there during the quarter. North America and Asia are closely behind in this progress, and while NET thinks it has made a ton of go-to-market progress, there’s even more improvement ahead. That’s what Prince was getting at in the prepared remarks I covered in part 1 of the earnings review. Separately, NET has focused most of its GenAI attention on the inference side of things. Models are trained once and periodically retrained. Asking models to connect more dots on their own or infer new insights happens constantly. It’s a larger opportunity. I thought this was an average quarter, with the Q4 revenue guidance a bit underwhelming. Still, go-to-market overhauls take time, and this company’s product suite should be easy to sell once systems are fully in place.

Inflation Data:

Output Data:

Employment & Consumer Data: