Max subs — the planned transaction spelled out in Saturday’s article (section 6) took place on Monday Morning as telegraphed. There have been no other portfolio changes since the last update sent.

Palo Alto is a cyber security company competing across endpoint, cloud and network use cases. Most of its platform is made up of integrated M&A, while it competes with pretty much everyone besides identity brokers in the space. Palo Alto is pushing very hard to bundle next-gen products into larger deals to differentiate vs. firewall-based competitors like Fortinet and beat next-gen disruptors. It calls this process “platformization,” which will again be a key piece of this review.

Its endpoint security segment is called Cortex. Extended Security Information and Event Management (XSIAM) is the main product being used for platformizing this section. XSIAM brings together Extended Security Orchestration, Automation and Response (XSOAR), Extended Detection and Response (XDR) and Security Information, Event Management (SIEM). XSOAR helps automate and guide best practices for incident response while ranking severity of threats. XSOAR is also where its attack surface management product (called Cortex Xpanse) lives to obsessively seek out and uncover any vulnerabilities.

XDR infuses non-endpoint data sources into breach protection to extend coverage beyond strictly that endpoint. It relies on significant 3rd party data sharing to optimize potential utility. SIEM aggregates data and events. XSOAR relies on scaled, complete data ingestion; SIEM’s and XDR’s capabilities allow that to happen.

The network security suite is called Strata. This is where Palo Alto is supplanting legacy firewall vendors by offering (what it views as) superior, software-enabled firewalls alongside a suite of network security software. It deploys software-defined wide area networks (SD-WANs) within firewall environments. SD-WANs serve as virtual network securers to use a software-based approach to protection. Palo Alto secures networks using a “zero trust” architecture. Zero trust means a bad actor cannot penetrate the most vulnerable part of a digital ecosystem and move freely within it thereafter. Zero trust ensures consistent and complex validation of these permissions at every turn. It ends the game of “everyone within a firewall environment getting perpetual, unconditional access” and greatly limits the potential damage of network breaches.

There are two pieces of the network bucket: modern hardware and software. In hardware, PANW provides “next-gen firewalls” with tools like contextual app inspection (more malleable access rules), intrusion prevention, URL filtering, data loss prevention (DLP) and more. Secure Access Service Edge (SASE) is the overarching software product that ties its network platformization approach together.  SASE conjoins tools that help prevent unauthorized access to data, abuse of networks (like phishing attacks to overwhelm networks with traffic) and broad visibility into health and performance of a network.

The cloud security suite is called Prisma. Like XSIAM and SASE are the platformization pillars in endpoint and network, in cloud it’s the Cloud Native Application Protection Platform (CNAPP). CNAPP includes Cloud Security Posture Management (CSPM), which organizes access compliance, provides overarching cloud ecosystem visibility, and proactively blocks misconfigurations. Beyond that, Cloud Workload Protection Platform (CWPP) is Prisma’s cloud workload protection tool. Most recently, Palo Alto debuted (CDEM) to “evaluate internet exposure risks and discover unknown internet-exposed cloud assets.” Finally, it added cloud detection and response (CDR).

While these three product groups are technically separate, they routinely pull context, service and data from each other to uplift overall value creation. Again, that’s how PANW is looking to more effectively compete. Prisma Access is important for network security, its AI runtime tool (more later) is vital for both Prisma and Strata, its CDR Cortex tool readily utilizes Prisma, etc.

Because this was Palo Alto’s fiscal Q4, we got new annual guidance from the company. Annual revenue and EBIT guidance were both slightly ahead. Annual $6.25 EPS guidance also beat expectations by $0.06. Its next quarter guidance was also slightly ahead across the board. It added NGS ARR guidance and RPO guidance of 29% Y/Y and 19.5% Y/Y respectively. It removed billings guidance, but did tell us it would have guided to 12% Y/Y billings growth had it not made this change. More on this later.

PANW trades for 58x next year’s earnings. Earnings are expected to rise by 10% next year and by 16% the year after.

Platformization remains the top priority for Palo Alto. This process creates higher retention, higher lifetime value customers, while also allowing it to flex the incremental value it provides beyond typical legacy firewall suites. Previously, the company had been waiting for contracts with competing vendors to expire before aggressively pursuing cross-selling. Now, it’s more proactively offering free trials to these clients while contracts unfold. This has already materially shrunk the sale cycle, as prospective customers have direct experience with these products before existing contracts end.

Palo Alto completed another 90 customer platformizations this quarter (moving customers to 1+ of its complete product platforms) vs. 65 last quarter. It has now completed 1,000+, with plans to bring that number up to 3,000 by 2030. That’s a big piece of its confidence in reiterated $15 billion in 2030 NGS ARR and a 22% NGS CAGR from now to then. Last quarter, leadership told us that non-platformized customers generate $200,000-$300,000 in ARR to start. For platformized customers, depending on how many of the three they choose, deliver $2,000,000-$14,000,000. It’s a massive difference, and that lead grew Q/Q with ARR per platformized customer again rising by over 10% sequentially. The pivot to platformization was abrupt, surprising and punished as key metrics like billings growth tanked (more on this later). A few quarters into this journey, and it’s looking like leadership absolutely made the right choice. 

For some evidence, it pounded its chest about several 7-9 figure deal wins and expansions, which were all driven by its breadth of solutions and “superior efficacy.” Short term pain; long term gain.

For the next 15 months, the platformization approach will hurt billings growth. Billings are realized only when payments are collected by Palo Alto. Part of platformization enables longer term contracts with more deferred payments as customers “grapple with the higher costs of money.” More free trials for potentially up-sold customers hurts too. Bookings and remaining performance obligations (RPO) (RPO includes bookings) are forward-looking demand metrics that eliminate this noise. It still counts all of that deferred business as “booked” even if it isn’t yet “billed.” For this reason, Palo Alto removed forward billings guidance and added RPO and NGS ARR guidance for next year. Importantly, everything included in RPO is “nonrefundable.” It did tell us that billings growth would be around 12%, but the explanation above and chart below both show you why they’re doing this. The change took place in early fiscal year (FY) 2024.

"I know there was significant consternation around our platformization strategy 6 months ago. All I want to say is I wish we had started down that path sooner. The amount of interest and activity around it has certainly been heartening and shows promise.”

CEO Nikesh Arora

Usage of its GenAI tools rose 2x over the last ten months. Its AI runtime app protection tool is enjoying “strong interest” early on. Its secure GenAI app access tool also already has 1,000 interested customers. We didn’t hear much more about the platform copilots teased last quarter. All in all, GenAI ARR rose 4x Y/Y from a very small base to $200 million. Like other technological waves, “innovation is driving the speed of adoption while security is currently an afterthought.” That’s ideal for PANW over the long haul. It means minimal friction associated with creating and running GenAI apps and workloads, which means maximum asset creation today. All of these assets will eventually all need proper security.

It’s more of the same here. Between the CrowdStrike incident (which is “elevating c-suite conversations”), new SEC disclosure requirements and 50% ransomware growth since 2022, the threat environment remains intimidating and chaotic. War has only accelerated these trends as adversaries take advantage of chaos. Notably, the public sector ransomware wave has picked up steam to add another layer to this complexity.

This is why cybersecurity is stickier and more durable as a spend category compared to other parts of software. Scaling and adding new products are not as mission critical as ensuring your existing infrastructure is secure. That’s why Palo Alto, despite its love for guidance sandbagging and the major strategic shift (platformization), still set initial annual targets slightly ahead of consensus. Barring economic turmoil, I expect modest beats and raises throughout the year like it usually delivers. This all bodes well for endpoint, network and cloud security vendors.

Firewall as a Platform (FWaaP) encompasses its hardware and its SASE suite. Over the last two years, SASE as a % of overall FWaaP revenue rose from 42% to 67% as Palo Alto continues to shed lower quality reliance on legacy firewall hardware sales. SASE customer count rose 21% Y/Y, and ⅓ of those new customers were brand new to Palo Alto. This is becoming a highly impactful tool for lead generation and new logo wins.

Subscription traction here also continues to build and yield more high margin, high visibility revenue for the segment. Its Advanced URL Filtering subscription now has 34,000 customers, while its newer Advanced WildFire subscription already has 11,000 customers just 18 months into launch. On average, Palo Alto Strata has 3.5 subscriptions per customer vs. 2.6 in 2022 (offers 10 total within Strata). It just launched its newest Advanced Domain Name System (DNS) subscription to manage, filter and orchestrate network traffic.

Next-gen cloud momentum also remains palpable. CDR is enjoying “strong initial traction” while Prisma was credited for procuring 3 large deals. All in all, PANW is the first cybersecurity player to reach $700 million in cloud ARR and saw average contract value (ACV) rise 30% Y/Y. For evidence of product leadership here, it has signed deals with leading cloud platforms across HR, collaboration and customer resource management (CRM). These software leaders picked PANW to lead another section of their software-based operations. Good vote of confidence.

“We have the broadest footprint of cloud security capabilities in the market.”

CEO Nikesh Arora

XSIAM bookings just crossed $500 million during the quarter, compared to over $400 million last quarter. Active customer count quadrupled Y/Y. Overall, Cortex ARR crossed $900 million, with customer count now over 6,100.

XSIAM is driving significant compression in mean time to resolve (MTTR) an incident from 2-3 days down to “as low as” 60 seconds. More than half of XSIAM’s new customers are enjoying a sub-10 minute MTTR, with continued improvements as these relationships mature. This matters a lot considering hackers can exploit a vulnerability in less than a day, while GenAI shrinks that timeline further.

Per the team, CrowdStrike’s outage has “elevated cybersecurity conversations further” and pushed buyers to demand a deeper understanding of the tech behind protection. The blunder has “caused a number of customers to re-evaluate their options, which should help drive more Cortex momentum. PANW did say they were satisfied with how CrowdStrike handled the situation, but they clearly do see this as an opportunity to steal market share.

This was a very good quarter. The world is an immensely volatile place right now across macroeconomics and geopolitics. To offer initial guidance ahead of consensus is positive to me – no matter how small the beats were. NGS momentum is fantastic, and CrowdStrike’s misstep should bolster that traction at least for the next few quarters. Six months ago “platformization” was ridiculed and cited as evidence for PANW falling behind. Fast-forward to today, and their competitive positioning seems to be improving if anything. More compounding, margin expansion, successful product additions and execution.

I do find this stock to be too expensive based on expected profit growth. PANW’s forward gross profit multiple is about 18x compared to SentinelOne at 10x. Palo Alto is much more profitable today, but SentinelOne is currently inflecting to positive profits, delivering sharper leverage, much faster growth and is the next-gen endpoint pure-play. Endpoint is the category where CRWD’s issue leaves the largest market share opportunity. SentinelOne’s product reputation is second to none, and it’s currently fixing a broken go-to-market approach to nurture large enterprise traction. Palo Alto is a lot more mature of a name and not my favorite to pick. Still, I find nothing alarmingly wrong with PANW… I just think it’s too expensive. Strong showing regardless.

Much attention was paid to the ~800,000 job estimate reduction from Bureau of Labor Statistics (BLS). This was actually smaller than the 1 million job reduction expected. But regardless of that, I still find this news to be encouraging for stocks. Why?

Estimates try to forecast economic health. Companies operate within actual economic backdrops, rather than presumed economic backdrops. Earnings results from 2024 will not be revised lower alongside the labor metrics; companies had to execute within reality, rather than fiction. They delivered profit and revenue growth in a world where macro headwinds were stronger than we gave them credit for.

And now? A downward revision has zero impact on the real-time consumption trends these companies are enjoying. The economy didn’t suddenly worsen just because our government can’t correctly track data. This leaves us with a status quo economy, and a Fed that will be even more emboldened to practice aggressive dovishness.

Snowflake’s overarching platform is called the Data Cloud. This infrastructure unlocks the ability to affordably store, organize, query and learn from data sources at gigantic scale. It offers these services with elastic compute capabilities to allow for flexible scaling up and down of usage. The architecture naturally separates the functions of data storage and consumption, unlike legacy data warehouse solutions. That means data consumption capacity is untethered from public computing resources. This removes the computing capacity bottleneck and enhances the scalability of data storage.

Under this framework, I can store as much data as I want without the requirement for immediate processing. That processing utilizes computing capacity. In Snowflake’s case, the storage is done in a centralized data repository in the Snowflake Data Cloud. It’s processed only as needed. Data is utilized virtually, which removes the need for dedicated hardware. This scalable (or “elastic”) reality limits waste and cost. Snowflake does all of this for clients in a managed fashion to minimize client talent and infrastructure needs. There are a few key products to know & track:

The Snowflake Data Warehouse is where structured data is stored and (on command) processed. Structured data is formatted data. It’s utilized for record keeping and report creation. Data can be easily fetched via structured query language (SQL).

Snowflake Data Lake does what the warehouse does for unstructured data. Unstructured data is unformatted and used to uncover new insights and patterns.

“Snowpark” is its application-building platform. It frees developers to work with data in any source code language. With it, developers can process and visualize data (through Snowpark functions) and build apps (through Snowpark Native Apps). Snowpark is their data-equipped playground to build new things. GenAI models are voracious data consumers. Snowpark Container Services allow GenAI models to run closer to the data that they require. This enhances performance and expedites model training. Movement of apps, workloads and developer attention from Apache Spark to Snowflake is a key source of growth here. Cortex AI is another important new product that we’ll dig into below.

Snowflake data sharing is its secure product for, as the name indicates, sharing data among the rest of Snowflake’s participating users. As more opt in, a compelling network effect of relevant data builds and Snowflake’s value proposition deepens.

Snowflake’s revenue model is consumption-based in nature. This means visibility compared to SaaS business models is not as strong. It also means customers can more easily scale down (or up) usage when times are bad (or good).

Billings is a lumpy metric. It can be highly influenced on a quarterly basis by timing of service and invoicing. The team was asked if there were any changes in billing patterns from last year, which could help explain this material miss. There were no changes. This unfortunately seems to be more structural than timing-related.

The sharp Y/Y margin contraction is as expected. Snowflake is greatly ramping GenAI infrastructure investments and R&D spend to reignite the innovation engine.

Snowflake added $2.5 billion in buyback capacity. I don’t think this is the right decision. The company trades for over 100x next year’s earnings. They have explicitly told you they need to invest more in innovation, and this, to me, hints at them having fewer promising growth opportunities than previously thought. A company in this stage of its growth curve should not be deploying 75% of its cash & equivalents pile in buybacks. I get that they generate free cash to help cover the cost, but that free cash is solely from a stock comp add back on the cash flow statement. This company has so much potential that it should be taking advantage of. Maybe it’s time for an activist here.

Snowflake raised its annual product revenue guidance by 1.7%, which beat by 1%. Sell-side was expecting small raises to product gross margin and EBIT margin, which did not come. For next quarter, product revenue guidance slightly beat and EBIT margin guidance slightly missed. The combination of margin beats this quarter with no margin raise is related to spend timing. It couldn’t secure all of the GPUs that it expected during the quarter.

Snowflake’s most mature analytical, structured data business saw accelerating Q/Q consumption traffic this quarter to growth levels “in line with historical patterns.” Snowflake, like many other firms, has changed its go-to-market approach to prioritize new clients and consumption. It has fixated on rewarding success within the variables that actually drive its profitable growth. These changes are taking longer to take effect than they did at a company like Cloudflare, for example. Leadership sees the new approach bearing material fruit starting next year.

Snowflake dealt with data security leakage earlier this year. The issue was related to 3rd party shortcomings, while there was no evidence of any breach of Snowflake’s security systems. Still, it led to sensitive data being impermissibly accessed. Encouragingly, Snowflake has zero interruption in consumption trends amid this drama. It also saw zero material impact from the CrowdStrike blunder last month.

Cortex AI is what Snowflake calls its “AI layer.” It’s a slew of new GenAI-powered tools to (as Snowflake always says) bring AI, application-building and analytics right “to a customer’s data.” That conjoining routinely lower data transfer costs, and storage costs too.

Cortex AI offers unstructured text summary, sentiment analysis, helps beginners write SQL etc. Traction here was called “strong,” and while this isn’t in the company’s annual guide, CFO Michael Scarpelli did tell us during the Q&A that it would likely contribute this year. That should mean upside to guidance, but we’ve been told this for 3 quarters now, and the positive revenue guidance revisions have been quite modest.

At this quarter’s Snowflake Summit, it debuted Cortex Search. This brings to life Snowflake CEO Sridhar Ramaswamy’s vision of making complex data querying seamlessly conversational. With it, anyone who knows Sequel can practice advanced, multi-stage queries and work directly with cutting edge large language models (LLMs) from its partners. Cortex Analytics is also now live. This uncovers patterns, insights and trends from massive, entirely unstructured datasets to sharpen things like trend forecasting. Both tools are enjoying strong early adoption.

The case studies above are nice. Still, they’re less concrete and substantive than we’ve heard from several other players building enterprise GenAI apps. I’d love to hear more about how these customers are using Cortex AI to deliver an X% improvement on some key performance indicator. I’m sure that will come with time.

Iceberg Tables have been a hot topic for Snowflake’s sector recently. As a reminder, Iceberg Tables are open-sourced data storage offerings, often with lower storage costs, open-source integration flexibility and more data control. They were actually originally created by Netflix. The proliferation here is leading to data storage and duplication revenue headwinds, with storage making up about 11% of Snowflake’s total business. Support for these Iceberg Tables was just added by Snowflake, and traction is quite strong. Still, doesn’t that mean 11% of its entire revenue base is now vulnerable? Yes and no.

It’s true that cheaper open source storage options could very likely hurt this revenue bucket. At the same time, almost all of the remaining 89% of revenue is tied to consumption of data within Snowflake. Offering Iceberg Table support will diminish friction associated with using all of Snow’s other applications for larger sums of their data. Most Iceberg Table users that are Snowflake clients store most of their data outside of SNOW anyway. This gives SNOW a better chance at turning that external data into more non-storage product revenue. So far, it’s seeing incremental product demand stemming from Iceberg with 400 clients. Additionally, very little data has moved out of its storage base because of this new offering, but the majority of this headwind was always expected to come in Q3 and Q4.

Snowflake leadership has been vocally critical about its own pace of product innovation. That has been new CEO Sridhar Ramaswamy’s core company priority, and there are some modest signs of improvement. It has shipped 9 new products and 15 capabilities so far this year, which is already more than all of 2023. The most exciting launch, to me, was its Arctic Medium Language Model (MLM) from last quarter. This doesn’t come with the type of revenue potential that Cortex or Snowpark do, but is encouraging in a different way. It rolled this out in 90 days and for 12% of the training cost vs. comparable models. It was purpose-built for enterprise data and ranks highly in vital SNOW categories like SQL and code following. To me, this launch screamed “we can still drive rapid innovation” more than anything else they’ve done in a long time. More of this, please.

The team was bluntly asked if it’s falling behind others in terms of product and innovation. It still thinks its core capabilities are best-in-class. Now, it thinks its round of Cortex debuts make its AI products “world-class.” World-class is talk; faster growth is evidence. That faster overall growth is not expected to come from these products until next year.

The quarter was better than expected, but I still don’t think we can call it amazing. For context, the new revenue guidance is still 19% lower than initial analyst expectations. The lack of EBIT margin raise comes after EBIT estimates had already tanked by more than 50%. The billings miss was sharp and we got very little new financial information on its AI products.

When combining this with SNOW carrying a 2025 earnings multiple of 135x, it’s probably fair to say analysts wanted a much larger beat and raise. This might sound harsh, but its valuation multiple commands better results than it’s delivering. This was once one of the highest quality software names on the planet, and it needs to again act like that to earn its premium. More innovation; more traction for that innovation; more selling; faster growth; rapid margin expansion. It’s capable of delivering all of that.

For now, SNOW trades for about double the price of Zscaler, Palantir, Datadog and CrowdStrike, yet is expected to see flat profit growth for the next two years. Conversely, the others will rapidly compound on the top and bottom lines during that time period. All of this is to say I still think there are just better places to park my money today.

For review, one of PayPal’s largest financial drivers is its Braintree business. This is a white-label processor that calls Uber and Airbnb its clients and competes with Stripe and Adyen. PayPal does partner with these players in some areas (like offering its branded checkout button to their clients) but Braintree also directly competes with them. And? Adyen and Stripe are very capable competitors.

Considering this reality, I find recent PayPal/Adyen partnership news to be encouraging. As part of a deepening relationship, Adyen will offer its Fastlane guest checkout accelerator to its U.S. merchants. The two plan to expand globally thereafter. This is set to deliver the same guest checkout conversion edges for Adyen merchants that it has for PayPal’s early on.

Adyen is arguably the most compelling distribution partner for this product to land. It represents a beachhead of iconic merchants looking to optimize checkout. Now? They’ll be doing so with the help of Fastlane in what should greatly accelerate adoption for the new product.

Beyond this obvious piece of good news, there’s another positive, yet subtle read-through here. Braintree, Stripe and Adyen essentially operate in a global oligopoly for private label processing. Old PayPal leadership had chosen to compete on price and margin with Stripe and Adyen to steal market share. That damaged relationships a bit, as the decision hurt the entire sector. New PayPal leadership has since pivoted back to profitable growth, which was cheered by Adyen leadership on last week’s conference call. They’re now trying to compete on innovation and value, rather than predatorily pricing services.

This enhanced partnership is more news of these two powerful players getting along once more. While coordination on checkout fees is absolutely anti-competitive, there are (legal) signals key vendors can send one another on their willingness to maintain fair pricing. Braintree sent a big signal late last year, and this increasingly close relationship is a byproduct of that change. Good for the entire sector’s potential margin profile.

There are a lot of new readers this week (welcome), so I wanted to include last week’s piece on Fastlane here below. For existing readers, this is all review.

Fastlane is PayPal’s guest checkout profile that allows customers to enjoy the convenience of checkout accelerators. PayPal’s vast database allows it to identify a large proportion of online shoppers and expedite sign in and check out. That’s the luxury of having 400+ million accounts. Once a customer opts into a Fastlane profile, they can enjoy lightning-fast checkout at any opted-in PayPal merchant. It doesn’t matter if a consumer shops with that merchant weekly or hasn’t even entered its site – Fastlane delivers the same seamless checkout experience. Considering 80%+ of consumers at some point have abandoned a cart due to checkout friction and that guest checkout struggles to check a 50% shopper conversion rate, this is a massive issue… and a massive opportunity. That’s all review. So what did we learn this past week?

Fastlane is yielding a conversion rate between 75% and 90% for several highlighted merchants and is powering 32% faster guest checkout. PayPal is orienting Fastlane to focus on the merchant. It isn’t trying to build this product into some ubiquitous brand like PayPal or Venmo. It’s merely using the product to support its merchant base’s success. That, in turn, drives more transaction volume and PayPal growth. It’s carrying out this aim in two ways. First, it’s not showcasing the Fastlane profile option up-steam (before checkout) across a merchant’s site. Secondly, it is not charging any incremental service fees for Fastlane access through the end of this year. It will still profit from any incremental volume the product delivers and it sounds like PayPal will eventually treat this as an upcharge, like it does for Hyperwallet.

I am excited by the prospects of this product bending the growth curve upward for PayPal. The impact won’t be immediate, but it can be powerful heading into 2025. Between this, Braintree’s profitable growth, Venmo monetization, fixing Xoom and now tap-to-pay on iPhone opening up in Europe… there are tailwinds galore here.