MANDIANT, INC. The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our condensed consolidated financial statements and related notes appearing elsewhere in this Quarterly Report on Form 10-Q and our Annual Report on Form 10-K for the year endedDecember 31, 2020 . The following discussion and analysis contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended. These statements include, but are not limited to, statements regarding: •the evolution of the threat landscape facing our customers and prospects; •our ability, and the effects of our efforts, to educate the market regarding the advantages of our security solutions; •our ability to continue to grow revenues, in particular annual recurring revenues from cloud and subscriptions; •our expected rate of decline in mature appliance revenues and associated subscription and support revenues; •our future financial and operating results; •our business plan and our ability to effectively manage our growth and associated investments; •our beliefs and objectives for future operations; •our ability to maintain our leadership position in advanced network security; •our ability to attract and retain customers and to expand our solutions footprint within each of these customers; •our expectations concerning customer retention rates as well as expectations for the value of subscriptions and services renewals; •our ability to maintain our competitive technological advantages against new entrants in our industry; •our ability to timely and effectively scale and adapt our existing technology; •our ability to innovate new products and bring them to market in a timely manner; •our ability to maintain, protect, and enhance our brand and intellectual property; •our ability to expand internationally; •the effects of increased competition in our market and our ability to compete effectively; •cost of revenue, including changes in costs associated with products, manufacturing and customer support; •trends in operating expenses, including changes in research and development, sales and marketing, and general and administrative expenses; •anticipated income tax rates; •potential attrition and other impacts associated with restructuring; •sufficiency of cash to meet cash needs for at least the next 12 months; •our ability to generate cash flows from operations and free cash flows; •our ability to capture new, and renew existing, contracts withthe United States and international governments; •our expectations concerning relationships with third parties, including channel partners and logistics providers; •the release of new products; •economic and industry trends or trend analysis; •the impact of the COVID-19 pandemic and related public health measures on our business and the global economy; •the attraction, training, integration and retention of qualified employees and key personnel; •future acquisitions of or investments in complementary companies, products, subscriptions or technologies; •our expectations, beliefs, plans, intentions and strategies related to our acquisitions ofCloudvisory LLC ("Cloudvisory") andRespond Software, Inc. ("Respond Software "); and •the effects of seasonal trends on our results of operations. as well as other statements regarding our future operations, financial condition and prospects, and business strategies. Forward-looking statements generally can be identified by words such as "anticipates," "believes," "estimates," "expects," "intends," 33 -------------------------------------------------------------------------------- "plans," "predicts," "projects," "will be," "will continue," "will likely result," and similar expressions. These forward-looking statements are based on current expectations and assumptions that are subject to risks and uncertainties, which could cause our actual results to differ materially from those reflected in the forward-looking statements. Factors that could cause or contribute to such differences include, but are not limited to, those discussed in this Quarterly Report on Form 10-Q, and in particular, the risks discussed under the caption "Risk Factors" in Item 1A of Part II of this Quarterly Report on Form 10-Q and those discussed in other documents we file with theSEC . We undertake no obligation to revise or publicly release the results of any revision to these forward-looking statements, except as required by law. Given these risks and uncertainties, readers are cautioned not to place undue reliance on such forward-looking statements. Investors and others should note that we announce material financial information to our investors using our investor relations Web site (http://investors.fireeye.com/),SEC filings, press releases, public conference calls and webcasts. We use these channels, as well as social media, to communicate with the public about our company, our services and other issues. It is possible that the information we post on social media could be deemed to be material information.
Overview
We provide a broad portfolio of cybersecurity products, SaaS solutions and services that allow organizations to prepare for, prevent, respond to, investigate and remediate cyber attacks. Our product, subscription and support solutions include security controls for network, email, endpoint and cloud security, forensics solutions, our extended detection and response (XDR) SaaS solution, our security validation SaaS solution, threat intelligence and analytics solutions, our Helix security operations platform, and managed services. Our products, SaaS solutions and managed services are complemented by our technology-enabledMandiant consulting services, including incident response, security assessment and transformation services, training and education services and expertise on demand. InMarch 2020 , theWorld Health Organization declared the novel coronavirus disease (COVID-19) a global pandemic. We operate in geographic locations that have been impacted by COVID-19. The pandemic has impacted, and could further impact, our operations and the operations of our customers as a result of quarantines, various local, state and federal government public health orders, facility and business closures, supply chain shortages, and travel and logistics restrictions. While we instituted a global work-from-home policy and restricted employee travel to essential, business-critical trips toward the end of the first quarter of 2020, we were able to maintain strong customer relationships and deliver our technology-enabled managed and professional services to customers without interruption. As a result, we did not incur significant disruptions to our operations during the quarter endedMarch 31, 2021 . We anticipate governments and businesses may take additional actions or extend existing actions to respond to the risks of the COVID-19 pandemic. We continue to actively monitor the impacts and potential impacts of the COVID-19 pandemic in all aspects of our business. Although we are unable to predict the impact of the COVID-19 pandemic on our business, results of operations, liquidity or capital resources at this time, we expect we may be negatively affected if the pandemic and related public health measures result in substantial manufacturing or supply chain problems, disruptions in local and global economies, volatility in the global financial markets, overall reductions in demand, delays in payment, restrictions on the shipment of our products, or other ramifications from the COVID-19 pandemic. For a further discussion of the uncertainties and business risks associated with the COVID-19 pandemic, see the section entitled "Risk Factors" in Part II, Item 1A of this Quarterly Report on Form 10-Q. Our Business Model We generate revenue from sales of our network, email endpoint and cloud security solutions, our security validation platform, our threat intelligence, our managed detection and response services, our Helix security operations platform, and ourMandiant professional services. We disaggregate our revenue into two main categories: (i) product, subscription, and support and (ii) professional services. For the three months endedMarch 31, 2021 and 2020, product, subscription and support revenue as a percentage of total revenue was 74% and 77%, respectively. Revenue from professional services was 26% and 23% for the three months endedMarch 31, 2021 and 2020, respectively. Product, subscription and support Within the product, subscription and support category, we provide supplemental data to distinguish between sales of our product solutions that are deployed on-premise (or in hybrid on-premise/private cloud configurations), and sales of our platform, cloud-based subscriptions and managed detection and response services. Security product solutions deployed on-premise (or in hybrid on-premise/private cloud configurations) are included in the product and related subscription and support sub-category. Our security validation platform, Helix security platform, cloud-based security solutions, detection-on-demand, threat intelligence subscriptions and managed detection and response services are included in the platform, cloud subscription and managed services sub-category. For the three months endedMarch 31, 2021 and 2020, product and related subscription and support revenue as a percentage of total revenue was 34 -------------------------------------------------------------------------------- 39% and 47%, respectively. Revenue from platform, cloud subscription and managed services was 35% and 30% for the three months endedMarch 31, 2021 and 2020, respectively. Sales of our network, email, and endpoint security solutions, platform, cloud subscriptions and managed detection and response services, initially increase our deferred revenue. Deferred revenue from our product, subscription and support sales totaled$800.7 million and$845.3 million , as ofMarch 31, 2021 andDecember 31, 2020 , respectively. The decrease in deferred revenue from our product, subscription and support sales was due primarily to a decrease in sales of our appliance hardware and attached DTI cloud and support subscriptions compared toDecember 31, 2020 . Product and related subscription and support Revenue in the product and related subscription and support sub-category consists primarily of revenue from sales of our network, email and endpoint security solutions that are deployed on the customer's premise, either as an integrated security appliance or in distributed hybrid on-premise/private cloud configurations. Both deployment options are available on pre-configured appliance hardware or as virtual sensors and include our detection and MVX analysis technologies, our DTI cloud updates and support services. Integrated and distributed solutions deployed on virtual sensors are offered as an "all inclusive" subscription that includes our detection and MVX analysis technologies, DTI cloud updates, and support services. There is no limit to the number of virtual sensors a customer can deploy, and capacity can be distributed throughout the customer's IT environment as needed. Subscription revenue is recognized ratably over the contractual term, typically one to three years. Customers purchasing our network and email security subscriptions have the option of purchasing our appliance hardware at additional cost, but are not required to do so. Integrated network and email security solutions can also be deployed on pre-configured appliance hardware purpose-built forFireEye security solutions with scalable capacity. Integrated security appliances are delivered with pre-installed detection and MVX analysis technologies and require subscriptions to our DTI cloud updates and support services, which are priced as a percentage of the appliance price per year. Subscription terms are typically one to three years and include a material right of renewal. Historically, the majority of our installed base of on-premise network and email security customers purchased our solutions under this pricing model. Since our network, email and endpoint security solutions require regular DTI cloud and software updates to maintain detection efficacy, physical appliances and virtual sensors, together with the related DTI cloud and support subscriptions are considered a single performance obligation, whether deployed as an integrated appliance, virtual sensor or in a distributed hybrid on-premise/cloud configuration. As a single performance obligation, revenue from sales of appliance hardware and related subscriptions is recognized ratably over the contractual term, typically one to three years. Such contracts typically contain a material right of renewal option that allows the customer to renew their DTI cloud and support subscriptions for an additional term at a discount to the original purchase price of the single performance obligation. For contracts that contain a material right of renewal option, the value of the performance obligation allocated to the renewal is recognized ratably over the period between the end of the initial contractual term and end of the estimated useful life of the related appliance and license. A small portion of our revenue in the product and related subscription and support revenue is derived from the sale of our network forensics appliances and our central management system appliances. These appliances are not dependent on regular security intelligence updates, and revenue from these appliances is therefore recognized when ownership is transferred to our customer, typically at shipment. Platform, cloud subscriptions and managed services Revenue in the platform, cloud subscription and managed services sub-category consists primarily of revenue from sales of our cloud-based network, email and endpoint security, our detection-on-demand service, our security validation platform, our threat analytics platform (either standalone or within the Helix security platform), our Helix security platform, our standalone threat intelligence subscriptions and our managed detection and response services. The majority of revenue from our platform, cloud subscription and managed services category is recognized ratably over the contractual term, generally one to three years. A small portion of our revenue in the platform, cloud subscription and managed services category is derived from term licenses of our security validation platform, and revenue from these sales is recognized when the license key is issued to the customer. Professional services In addition to our product, subscription and support solutions, we offer professional services, including incident response and other strategic security consulting services, to our customerswho have experienced a cybersecurity breach or desire assistance assessing and increasing the resilience of their IT environments to cyber-attack. The majority our professional services are offered on a time and materials basis, through a fixed fee arrangement, or on a retainer basis. Revenue from professional services is recognized as services are delivered. Revenue from our Expertise-on-Demand subscription and some pre-paid professional services is deferred, and revenue is recognized when services are delivered. Deferred revenue from professional services as ofMarch 31, 2021 andDecember 31, 2020 was$110.0 million and$111.2 million , respectively. 35 -------------------------------------------------------------------------------- Key Business Metrics We monitor our key business metrics set forth below to help us evaluate growth trends, establish budgets, measure the effectiveness of our sales and marketing efforts, and assess operational efficiencies. We discuss revenue and gross margin below under "Components of Operating Results." Deferred revenue, annualized recurring revenue, billings (a non-GAAP metric), net cash flow provided by (used in) operating activities, and free cash flow (a non-GAAP metric) are discussed immediately below the following table (in thousands, except percentages). Three Months Ended or as of March 31, 2021 2020 Product, subscription and support revenue$ 183,017 $ 174,083 Professional services revenue 63,331 50,639 Total revenue$ 246,348 $ 224,722 Year-over-year percentage increase 10 % 7 % Gross margin percentage 66 % 64 % Deferred revenue, (current and non-current)$ 910,698 $ 919,856 Annualized recurring revenue$ 642,963 $ 590,099 Billings (non-GAAP)$ 200,589 $ 170,011 Net cash provided by (used in) operating activities$ 20,860 $ (24,456) Free cash flow (non-GAAP)$ 10,837 $ (36,136) Deferred revenue. Our deferred revenue consists of amounts that we have the right to invoice but have not yet been recognized into revenue as of the end of the respective period. We monitor our deferred revenue balance because it represents a significant portion of revenue to be recognized in future periods. The majority of our deferred revenue consists of the unamortized balance of deferred revenue from previously invoiced sales of our security appliance hardware and non-cancelable contracts for subscriptions to our network, email and endpoint security solutions, Helix and security validation platforms, threat intelligence, managed detection and response services and support and maintenance contracts. Invoiced amounts for such contracts can be for multiple years, and we classify our deferred revenue as current or non-current depending on when we expect to recognize the related revenue. If the deferred revenue is expected to be recognized within 12 months it is classified as current, otherwise, the deferred revenue is classified as non-current. A table for our deferred revenue is provided below (in thousands): As of March 31, 2021 2020 Deferred revenue, current$ 587,933 $ 572,533 Deferred revenue, non-current 322,765 347,323 Total deferred revenue$ 910,698 $ 919,856 Annualized recurring revenue. Annualized recurring revenue ("ARR") is an operating metric and represents the annualized revenue run-rate of active term licenses, subscriptions, and support contracts at the end of a reporting period. ARR should be viewed independently of revenue and deferred revenue as ARR is an operating metric and is not intended to be combined with or replace these items. ARR is not a forecast of future revenue, which can be impacted by contract start and end dates and renewal rates, and does not include revenue from appliance hardware and its associated perpetual software, consumption-based contracts or professional services except for service level agreement payments. We consider ARR a useful measure of the value of the recurring components of our business because it reflects both our ability to attract new customers for our solutions and our success at retaining and expanding our relationships with existing customers. Further, ARR is not impacted by variations in contract length, enabling more meaningful comparison to prior periods as we align our invoicing practices to growing customer preference for annual billing on multi-year contracts. We disaggregate ARR by the same sub-categories we use for disaggregation of billings and revenue in the table below (in thousands): As of March 31, 2021 2020
Product and related subscription and support
Total annualized recurring revenue$ 642,963 $
590,099
36
--------------------------------------------------------------------------------
Billings. Billings are a non-GAAP financial metric that we define as revenue
recognized in accordance with generally accepted accounting principles ("GAAP")
plus the change in deferred revenue from the beginning to the end of the period,
excluding deferred revenue assumed through acquisitions. We monitor billings as
a supplement to revenue (the corresponding GAAP measure), because billings
impact our deferred revenue, which is an important indicator of the health and
visibility of trends in our business and represents a significant percentage of
future revenue. However, it is important to note that other companies, including
companies in our industry, may not use billings, may define billings
differently, may have different billing frequencies, or may use other financial
measures to evaluate their performance, all of which could reduce the usefulness
of billings as a comparative measure. Additionally, the calculated billings
metric represents the total contract value we have the right to invoice, which
includes multi-year subscriptions to our solutions. Calculated billings are
impacted by changes in average contract length, thereby reducing the usefulness
of comparisons to prior periods. A reconciliation of billings to revenue, the
most directly comparable financial measure calculated and presented in
accordance with GAAP, is provided below (in thousands):
Three Months Ended March 31,
2021 2020
Revenue $ 246,348 $ 224,722
Add: deferred revenue, end of period 910,698 919,856
Less: deferred revenue, beginning of period (956,457) (974,567) Billings (non-GAAP)$ 200,589 $ 170,011
We have provided disaggregation of billings below (in thousands):
Three
Months Ended
2021 2020
Product and related subscription and support $ 62,589 $ 75,233
Platform, cloud subscription and managed services 75,887 52,454
Professional services 62,113 42,324
Billings (non-GAAP) $
200,589
Net cash provided by (used in) operating activities. We monitor net cash
provided by (used in) operating activities as a measure of our overall business
performance. Our net cash provided by (used in) operating activities performance
is driven in large part by sales of our products and from up-front payments for
both subscriptions and support and maintenance services. Monitoring net cash
provided by (used in) operating activities enables us to analyze our financial
performance without the non-cash effects of certain items, such as depreciation,
amortization and stock-based compensation costs, thereby allowing us to better
understand and manage the cash needs of our business.
Free cash flow. Free cash flow is a non-GAAP financial measure we define as net
cash provided by (used in) operating activities, the most directly comparable
GAAP financial measure, less purchases of property and equipment and
demonstration units. We consider free cash flow to be a liquidity measure that
provides useful information to management and investors about the amount of cash
generated by our business that, after the purchases of property and equipment
and demonstration units, can be used by us for strategic opportunities,
including investing in our business, making strategic acquisitions and
strengthening our balance sheet. However, it is important to note that other
companies, including companies in our industry, may not use free cash flow, may
calculate free cash flow differently, or may use other financial measures to
evaluate their performance, all of which could reduce the usefulness of free
cash flow as a comparative measure. A reconciliation of free cash flow to cash
flow provided by (used in) operating activities is provided below (in
thousands):
Three Months Ended March 31,
2021 2020
Net cash provided by operating activities $
20,860
Less: purchase of property and equipment and demonstration units (10,023)
(11,680)
Free cash flow (non-GAAP) $ 10,837 $ (36,136)
Net cash provided by (used in) investing activities $ (172,559) $ (20,230)
Net cash provided by (used in) financing activities $ (7,783) $ (6,051)
37-------------------------------------------------------------------------------- Factors Affecting our Performance Market Adoption. We rely on market education to raise awareness of today's cyber attacks and articulate the need for our products, solutions and services. Our prospective customers often do not have a specific portion of their IT budgets allocated for our advanced security solutions. Additionally, the markets for security validation software such as ourMandiant security validation platform (formerly Verodin Security Instrumentation Platform), security operations platforms such as FireEye Helix, and our Mandiant Defense extended detection and response solution (formerly Respond Analyst) are in the early stages of development. We invest heavily in sales and marketing efforts to increase market awareness, educate prospective customers and drive adoption of our products, solutions and services. This market education is critical to creating new IT budget dollars or allocating more of existing IT budget dollars to advanced threat protection, security validation, security operations management solutions, and extended detection and response. The degree to which prospective customers recognize the mission critical need for our solutions will drive our ability to acquire new customers and increase renewals and follow-on sales opportunities, which, in turn, will affect our future financial performance. Sales Productivity. Our sales organization consists of in-house sales teamswho work in collaboration with external channel partners to identify new sales prospects, sell additional products, subscriptions and services, and provide post-sale support. Our direct sales teams are organized by territory to target large enterprise and government customerswho typically have sales cycles that can last several months or more. We have also expanded our inside sales teams to work with channel partners to expand our customer base of small and medium enterprises, or SMEs, as well as manage renewals of subscription and support contracts. Newly hired sales and marketing employees typically require several months to establish prospect relationships and achieve full sales productivity. In addition, although we believe our investments in market education have increased awareness of us and our solutions globally, sales teams in certain international markets may face local markets with limited awareness of us and our solutions, or have specific requirements that are not available with our solutions. These factors will influence the timing and overall levels of sales productivity, impacting the rate at which we will be able to convert prospects to sales and drive revenue growth. Customer Acquisition and Retention. Since we expect that our existing customers are likely to expand their deployments and purchase additional solutions from us over time, we believe new customer acquisition and retention of existing customers is important to expanding the value of our installed base, which we monitor through our key business metrics, including annualized recurring revenue. We believe our ability to maintain strong customer retention and drive new customer acquisition will have a material impact on future sales of our security solutions and services and therefore our future financial performance. Follow-On Sales. To grow our revenue, it is important that our customers make additional purchases of our products, subscriptions and services. After the initial sale to a new customer, we focus on expanding our relationship with the customer to sell additional products, subscriptions and services. Sales to our existing customer base can take the form of incremental sales of our solutions, managed services, and professional services either to expand their deployment of our technologies, to extend their internal security resources with our managed and professional security services, or continuously measure the effectiveness of their security controls. Our opportunity to expand our customer relationships through follow-on sales will increase as we add new customers, broaden our security solutions portfolio with additional subscriptions and services and enhance the functionality of our existing solutions. Follow-on sales lead to increased revenue over the lifecycle of a customer relationship and can significantly increase the return on our sales and marketing investments. With many of our large enterprise and government customers, we have realized follow-on sales that were multiples of the value of their initial purchases. Components of Operating Results Revenue We generate revenue from the sales of our products, subscriptions and services. Revenue is recognized when a contract has been entered into with a customer, the performance obligation(s) is (are) identified, the transaction price is determined and has been allocated to the performance obligation(s) and only then for each performance obligation after we have satisfied that performance obligation. •Product, subscription and support revenue. Our product, subscription and support revenue is generated from sales of our network, email, and endpoint security solutions deployed on the customer's premise (or in a hybrid on-premise/private cloud deployment), as well as our cloud-based security solutions, threat intelligence subscriptions, security validation and Helix security platforms, and managed detection and response services. We combine our virtual sensors and physical appliances and software licenses with mandatory subscriptions to our DTI cloud updates and support services as a single performance obligation. As a result, we recognize revenue for this single performance obligation ratably over the contractual term. Contracts containing this single performance obligation typically contain a material right of renewal option. For contracts that contain a material right of renewal option, the allocated value of the performance obligation is recognized ratably over the period between the end of the initial contractual term and the end of 38 -------------------------------------------------------------------------------- the estimated useful life of the related appliance and license. Significant judgment is required in estimating the useful life of our intelligence dependent appliances and assessing the material rights associated with such products. Revenue from our security validation and platform solutions, subscriptions to our cloud-based security and intelligence solutions, and our managed detection and response services is recognized ratably over the contractual term, typically one to three years. •Professional services revenue. Professional services, which includes incident response, security assessments, and other strategic security consulting services, are offered on a time-and-material basis, through a fixed fee arrangement, or on a retainer basis. We recognize the associated revenue as the services are delivered. Some professional services and our Expertise-on-Demand subscription are prepaid, and revenue is deferred until services are delivered. In the fourth quarter of 2020, we experienced an attack from a highly sophisticated threat actor that targeted and accessed certain Red Team assessment tools that we use to test our customers' security. This security incident did not have a material adverse impact to our revenues in the three months endedMarch 31, 2021 . In addition, we do not expect the incident to materially impact our revenues going forward. Cost of Revenue Our total cost of revenue consists of cost of product, subscription and support revenue and cost of professional services revenue. •Cost of product, subscription and support revenue. Cost of product, subscription and support revenue primarily consists of costs paid to our third-party contract manufacturers for our appliances, other costs in our manufacturing operations department, personnel costs associated with maintaining our threat intelligence, managed detection and response services, and global customer support operations, and hosting costs paid to third party cloud platform providers. Personnel costs associated with our manufacturing operations department, our threat intelligence, our managed detection and response services and our global customer support organization consist of salaries, benefits, bonuses and stock-based compensation. Overhead costs consist of certain facilities, depreciation and information technology costs. Our cost of product, subscription and support revenue also includes product testing costs, shipping costs and allocated overhead costs. If revenue from sales of product, subscriptions and support declines, the cost of product, subscription and support revenue may increase as a percentage of product, subscription and support revenue due to the fixed nature of a portion of these costs. Additionally, our appliance related cost of goods sold is capitalized and amortized on a systematic basis that is consistent with the pattern of transfer to which the asset relates. •Cost of professional services revenue. Cost of professional services revenue primarily consists of personnel costs for our services organization and allocated overhead costs. If sales of our professional services decline or we are unable to maintain our chargeability rates, our cost of professional services revenue may increase as a percentage of professional services revenue. Gross Margin Gross margin, or gross profit as a percentage of revenue, has been and will continue to be affected by a variety of factors, including our average selling prices, the mix between products, subscription and support and services sold, the mix of revenue among products, subscriptions and services and manufacturing costs. We expect our gross margins to fluctuate slightly over time depending on these factors. Operating Expenses Our operating expenses consist of research and development, sales and marketing and general and administrative expenses. Personnel costs are the most significant component of operating expenses and consist of salaries, benefits, bonuses, stock-based compensation and, with regard to sales and marketing expense, sales commissions. Operating expenses also include allocated overhead costs consisting of certain facilities, depreciation and information technology costs. In the fourth quarter of 2020, we experienced an attack from a highly sophisticated threat actor that targeted and accessed certain Red Team assessment tools that we use to test our customers' security. This security incident did not have a material adverse impact to our operating expenses during the three months endedMarch 31, 2021 . In addition, we do not expect the incident to materially impact our operating expenses in future periods. •Research and development. Research and development expense consists primarily of personnel costs and allocated overhead. Research and development expense also includes prototype related expenses. We expect research and development expense to remain relatively flat in terms of absolute dollars and decrease slightly as a percentage of total revenue. •Sales and marketing. Sales and marketing expense consists primarily of personnel costs, incentive commission costs and allocated overhead. Commission costs are capitalized and amortized over the expected period of benefit, taking into consideration the pattern of transfer to which the asset relates and the expected renewal period. When commissions paid for 39 -------------------------------------------------------------------------------- initial contracts are higher than those paid for renewal contracts, the initial commissions are not commensurate and as such, are recognized over the expected period of benefit. Renewal commissions are generally amortized over the renewal period. Sales and marketing expense also includes costs for market development programs, promotional and other marketing activities, travel, depreciation of proof-of-concept evaluation units and outside consulting costs. These costs are recognized as incurred. We expect sales and marketing expense to increase in absolute dollars and remain relatively flat or decrease slightly as a percentage of total revenue. •General and administrative. General and administrative expense consists of personnel costs, professional service costs and allocated overhead. General and administrative personnel include our executive, finance, human resources, facilities and legal organizations. Professional service costs consist primarily of legal, auditing, accounting and other consulting costs. We expect general and administrative expense to stay relatively flat in terms of absolute dollars and remain relatively flat or decrease slightly as a percentage of total revenue. •Restructuring Charges. InApril 2020 ,August 2020 andDecember 2020 , we implemented restructuring plans designed to align our resources with the strategic initiatives of the business. These restructuring plans resulted in a reduction of 7% of our total workforce as well as the exiting and downsizing of certain real estate facilities and the impairment of certain assets. The expenses incurred primarily consisted of employee severance charges and other termination benefits, as well as real estate and related fixed asset charges for the consolidation or exiting of certain leased facilities. Interest Income Interest income consists of interest earned on our cash and cash equivalent and investment balances. We have historically invested our cash in money-market funds and other short-term, high quality securities. We expect interest income to vary each reporting period depending on our average cash and cash equivalent and investment balances during the respective reporting periods, types and mix of investments and market interest rates. Interest Expense Interest expense consists primarily of interest at the stated rate (coupon) and amortization of discounts and issuance costs relating to our convertible notes. We expect interest expense to decrease slightly as a result of the repurchase of Series A Notes inJune 2020 . Other Income (Expense), Net Other income (expense), net includes gains or losses on the disposal of fixed assets, gains or losses from our equity-method investment, gains or losses on the extinguishment of convertible notes, foreign currency re-measurement gains and losses and foreign currency transaction gains and losses. We expect other income (expense), net to fluctuate primarily as a result of foreign exchange rate movements. Provision for (Benefit from) Income Taxes Provision for income taxes relates primarily to income taxes payable in foreign jurisdictions where we conduct business, withholding taxes, and state income taxes inthe United States . The provision is offset by tax benefits primarily related to the reversal of valuation allowances previously established against our deferred tax assets. Should the tax benefits exceed the provision, then a net tax benefit from income taxes is reflected for the period. Income in certain countries may be taxed at statutory tax rates that are lower than theU.S. statutory tax rate. As a result, our overall effective tax rate over the long-term may be lower than theU.S. federal statutory tax rate due to net income being subject to foreign income tax rates that are lower than theU.S. federal statutory rate. 40 -------------------------------------------------------------------------------- Results of Operations The following table summarizes our results of operations for the periods presented and as a percentage of our total revenue for those periods. The period-to-period comparison of results is not necessarily indicative of results for future periods.
Three Months Ended
2021 2020
% of total % of total
Amount Revenue Amount Revenue
(Dollars in thousands)
Revenue:
Product, subscription and support $ 183,017 74 % $ 174,083 77 %
Professional services 63,331 26 50,639 23
Total revenue 246,348 100 224,722 100
Cost of revenue:
Product, subscription and support 51,968 21 53,136 24
Professional services 32,602 13 28,450 13
Total cost of revenue 84,570 34 81,586 36
Total gross profit 161,778 66 143,136 64
Operating expenses:
Research and development 72,420 29 67,503 30
Sales and marketing 99,601 40 100,200 45
General and administrative 26,489 11 27,429 12
Restructuring charges - - 10,974 5
Total operating expenses 198,510 81 206,106 92
Operating loss (36,732) (15) (62,970) (28)
Interest income 1,644 1 4,424 2
Interest expense (14,624) (6) (15,846) (7)
Other income (expense), net 571 - (989) -
Loss before income taxes (49,141) (20) (75,381) (34)
Provision for income taxes 1,503 1 925 -
Net loss $ (50,644) (21) % $ (76,306) (34) %
41--------------------------------------------------------------------------------
Comparison of the Three Months Ended
Three Months Ended
2021 2020 Change
% of Total % of Total
Amount Revenue Amount Revenue Amount %
(Dollars in thousands)
Revenue:
Product, subscription and support $ 183,017 74 % $ 174,083 77 % $ 8,934 5 %
Professional services 63,331 26 50,639 23 12,692 25
Total revenue $ 246,348 100 % $ 224,722 100 % $ 21,626 10 %
Product, subscription and support by
type:
Product and related subscription and
support $ 97,155 39 % $ 105,688 47 % $ (8,533) (8) %
Platform, cloud subscription and
managed services 85,862 35 68,395 30 17,467 26
Total product, subscription and
support $ 183,017 74 % $ 174,083 77 % $ 8,934 5 %
Revenue by geographic region:
U.S. $ 150,482 61 % $ 140,573 62 % $ 9,909 7 %
EMEA 44,053 18 38,062 17 5,991 16
APAC 37,336 15 33,573 15 3,763 11
Other 14,477 6 12,514 6 1,963 16
Total revenue $ 246,348 100 % $ 224,722 100 % $ 21,626 10 %
Product, subscription and support revenue increased by $8.9 million , or 5%,
during the three months ended March 31, 2021 compared to the three months ended
March 31, 2020 . The increase was comprised of an increase in platform, cloud
subscription and managed services revenue of $17.5 million , which was partially
offset by a decrease in product and related subscription and support revenue of
$8.5 million . The increase in platform, cloud subscription and managed services
reflected increased recognition of deferred revenue associated with sales of our
threat intelligence subscriptions, our cloud-based email and endpoint security,
our validation platform solutions, our Helix platform, and our Managed Defense
managed security service. The decrease in product and related subscription and
support revenue was primarily due to a decrease in the product and related
subscription and support deferred revenue, from which revenue is recognized. The
decrease in deferred revenue reflected a decrease in sales of our on-premise
solutions as customers migrate to cloud-based solutions.
Professional services revenue increased by $12.7 million , or 25%, during the
three months ended March 31, 2021 compared to the three months ended March 31,
2020 . The increase was primarily driven by an increase in number of engagements
enabled by an increase in professional services personnel and an increase in mix
of incident response services with higher rates per hour as compared to the same
period in 2020.
Our international revenue increased $11.7 million , or 14%, during the three
months ended March 31, 2021 compared to the three months ended March 31, 2020 .
The increase reflects growth in sales from certain international regions
compared to prior periods as a result of an increase in revenue recognized from
a build-up of deferred revenue from prior periods.
42
--------------------------------------------------------------------------------Cost of Revenue and Gross Margin
Three Months Ended March 31,
2021 2020 Change
Gross Gross
Amount Margin Amount Margin Amount %
(Dollars in thousands)Cost of revenue: Product, subscription and support$ 51,968 $ 53,136 $ (1,168) (2) % Professional services 32,602 28,450 4,152 15 Total cost of revenue$ 84,570 $ 81,586 $ 2,984 4 % Gross margin: Product, subscription and support 72 % 69 % Professional services 49 % 44 % Total gross margin 66 % 64 % The cost of product, subscription and support revenue decreased by$1.2 million , or 2%, during the three months endedMarch 31, 2021 compared to the three months endedMarch 31, 2020 . The decrease in cost of product, subscription and support revenue was primarily due to a$0.5 million decrease in third-party cloud hosting costs, and a$0.4 million decrease in travel and entertainment costs which we attribute to the COVID-19 pandemic. The cost of professional services revenue increased by$4.2 million , or 15%, during the three months endedMarch 31, 2021 compared to the three months endedMarch 31, 2020 . The increase in cost of professional services revenue was primarily due to a$5.1 million increase in personnel costs due to increased headcount assigned to projects, and a$1.7 million increase in stock-based compensation partially offset by a$1.8 million decrease in travel and entertainment costs which we attribute to the COVID-19 pandemic. Gross margin percentage increased by 2% during the three months endedMarch 31, 2021 compared to the three months endedMarch 31, 2020 . The increase was primarily due to lower travel and expense costs which we attribute to the COVID-19 pandemic, efficiencies within our cloud hosting costs and a higher mix of incident response services which carry a higher rate per hour. Operating Expenses Three Months Ended March 31, 2021 2020 Change % of Total % of Total Amount Revenue Amount Revenue Amount % (Dollars in thousands) Operating expenses: Research and development$ 72,420 29 %$ 67,503 30 %$ 4,917 7 % Sales and marketing 99,601 40 100,200 45 (599) (1) General and administrative 26,489 11 27,429 12 (940) (3) Restructuring charges - - 10,974 5 (10,974) (100) Total operating expenses$ 198,510 81 %$ 206,106 92 %$ (7,596) (4) % Includes stock-based compensation expense of: Research and development$ 14,655 $ 11,545 Sales and marketing 13,982 11,486 General and administrative 7,088 5,505 Total$ 35,725 $ 28,536 Research and Development Research and development expense increased by$4.9 million , or 7%, during the three months endedMarch 31, 2021 compared to the three months endedMarch 31, 2020 . The increase was primarily due to an increase of$3.1 million in stock-based compensation expense, and an increase of$0.5 million in third-party consulting costs, offset by a decrease of$0.4 million in travel and entertainment expense which we attribute to the COVID-19 pandemic. 43 -------------------------------------------------------------------------------- Sales and Marketing Sales and marketing expense decreased by$0.6 million , or 1%, during the three months endedMarch 31, 2021 compared to the three months endedMarch 31, 2020 . The decrease was primarily due to a decrease of$4.2 million in travel and entertainment expense which we attribute to the COVID-19 pandemic, and a decrease of$1.5 million in marketing program costs. These decreases were partially offset by increases of$2.5 million in stock-based compensation expense,$1.7 million in commissions expense and$0.5 million in consulting costs. General and Administrative General and administrative expense decreased by$0.9 million , or 3%, during the three months endedMarch 31, 2021 compared to the three months endedMarch 31, 2020 . The decrease was primarily due to a decrease of$4.1 million in payroll related costs primarily driven by lower headcount as a result of the restructuring plans implemented in 2020, and a decrease of$0.3 million in travel and entertainment expense which we attribute to the COVID-19 pandemic, partially offset by an increase of$1.6 million in stock-based compensation expense and an increase of$2.3 million in professional services costs. Restructuring Charges No restructuring charges were incurred during the three months endedMarch 31, 2021 . During the three months endedMarch 31, 2020 , we incurred restructuring charges of approximately$11.0 million , which primarily related to employee severance charges and other termination benefits as well as certain facilities exit costs under ourJanuary 2020 restructuring plan. Interest Income Three Months Ended March 31, Change 2021 2020 Amount % (Dollars in thousands) Interest income$ 1,644 $ 4,424 $ (2,780) (63) % Interest income decreased for the three months endedMarch 31, 2021 compared to the three months endedMarch 31, 2020 , due primarily to a lower rate of return on balances in our cash and cash equivalents and investments. Interest Expense Three Months Ended March 31, Change 2021 2020 Amount % (Dollars in thousands) Interest expense$ (14,624) $ (15,846) $ 1,222 (8) % Interest expense decreased for the three months endedMarch 31, 2021 compared to the three months endedMarch 31, 2020 primarily due to the repurchase of a portion of our convertible notes inJune 2020 . Interest expense pertains primarily to the amortization of discount and issuance costs related to our convertible notes. Other Income (Expense), Net Three Months Ended March 31, Change 2021 2020 Amount % (Dollars in thousands) Other income (expense), net $ 571$ (989)
Other income (expense), net, increased for the three months endedMarch 31, 2021 compared to the three months endedMarch 31, 2020 primarily due to a$1.1 million release of interest related to payroll tax liability in the three months endedMarch 31, 2021 . 44 --------------------------------------------------------------------------------
Provision for Income Taxes
Three Months Ended March 31,
2021 2020
(Dollars in thousands)
Provision for income taxes $ 1,503 $ 925
Effective tax rate (3.1) % (1.2) %
The provision for income taxes increased for the three months ended March 31,
2021 compared to the three months ended March 31, 2020 . The increase in the
provision for income taxes was primarily due to a tax benefit from our
acquisition of Verodin, Inc. included in the three months ended March 31, 2020
but was not in the three months ended March 31, 2021 .
Liquidity and Capital Resources
As of March 31, 2021 As of December 31, 2020
(In thousands)
Cash and cash equivalents $ 516,972 $ 676,454
Short-term investments $ 783,689 $ 624,824
Three Months Ended March 31,
2021 2020
(In thousands)
Cash provided by (used in) operating activities $ 20,860 $ (24,456)
Cash used in investing activities (172,559) (20,230)
Cash used in financing activities (7,783) (6,051)
Net decrease in cash and cash equivalents $
(159,482)
As ofMarch 31, 2021 , our cash and cash equivalents of$517.0 million were held for working capital, capital expenditures, investment in technology, debt servicing and business acquisition purposes, of which approximately$86.1 million was held outside ofthe United States . We consider the undistributed earnings of our foreign subsidiaries as ofMarch 31, 2021 to be indefinitely reinvested outsidethe United States on the basis of estimates that future domestic cash generation will be sufficient to meet future domestic cash needs and our plan for reinvestment of our foreign subsidiaries' undistributed earnings. InDecember 2020 , we issued and sold 400,000 shares of a newly designated 4.5% Series A Convertible Preferred Stock, par value$0.0001 per share, at a price of$1,000 per share, for an aggregate purchase price of$400.0 million . InNovember 2020 , we acquiredRespond Software , a cybersecurity investigation automation company. In connection with this acquisition, we paid cash consideration of$116.1 million and assumed$5.0 million in net tangible liabilities. InJanuary 2020 , we acquired Cloudvisory, a provider of cloud visibility and control solutions. Total consideration for the acquisition was$13.2 million in cash. We also assumed$0.3 million in net tangible liabilities. Our principal sources of liquidity are existing cash and cash equivalents and short-term investments and any cash inflow from operations, which we believe will be sufficient to meet our anticipated cash needs for at least the next 12 months. While we have experienced delays in collections which we attribute to the COVID-19 pandemic, we believe we will be able to manage liquidity to meet our anticipated cash needs for at least the next 12 months. Our future capital requirements will depend on many factors, including our growth rate, the timing and extent of spending to support development efforts, the efficiency of our marketing and sales activities, the introduction of new and enhanced product and service offerings, the cost of any future acquisitions of technology or businesses, and the continuing market acceptance of our products. In the event that additional financing is required from outside sources, we may not be able to raise such financing on terms acceptable to us or at all. If we are unable to raise additional capital when desired, our business, operating results and financial condition would be adversely affected. 45 -------------------------------------------------------------------------------- Operating Activities During the three months endedMarch 31, 2021 , our operating activities provided cash of$20.9 million . We incurred a net loss of$50.6 million , which included net non-cash expenses of$86.6 million , primarily consisting of stock-based compensation charges, depreciation and amortization expense and non-cash interest expense related to our convertible notes. Our net change in operating assets and liabilities used cash of$15.1 million , primarily related to cash sourced from a reduction in accounts receivable of$44.5 million due to increased collections, a decrease in prepaid expenses and other assets of$5.5 million primarily due to receipt of other receivables, an increase in accounts payable of$8.1 million , an increase in accrued liabilities of$5.4 million . offset by a decrease in accrued compensation of$25.3 million , a decrease in deferred revenue of$45.8 million , and a decrease in other long-term liabilities of$7.3 million . During the three months endedMarch 31, 2020 , our operating activities used cash of$24.5 million . We incurred a net loss of$76.3 million , which included net non-cash expenses of$79.2 million , primarily consisting of stock-based compensation charges, depreciation and amortization expense and non-cash interest expense related to our convertible notes. Our net change in operating assets and liabilities used cash of$27.3 million , primarily due to a decrease in accounts receivable of$30.3 million which we attribute to the COVID-19 pandemic, a decrease in prepaid expenses and other current assets of$2.8 million , an increase in accounts payable of$1.7 million , partially offset by decrease in accrued compensation of$1.6 million , a decrease in other long-term liabilities of$3.6 million , and a decrease in deferred revenue of$54.7 million . Investing Activities Cash used in investing activities during the three months endedMarch 31, 2021 was$172.6 million . This was primarily due to$163.0 million provided by net maturities of short-term investments, offset by$10.0 million used for capital expenditures to purchase property and equipment and demonstration units. Cash used in investing activities during the three months endedMarch 31, 2020 was$20.2 million . This was primarily due to$12.6 million used to acquire Cloudvisory, net of cash acquired, and$11.7 million used for capital expenditures to purchase property and equipment and demonstration units,$5.3 million provided by net maturities of short-term investments and$1.0 million used for an investment in a privately held company. Financing Activities During the three months endedMarch 31, 2021 , financing activities used$7.8 million in cash, primarily for payment related to shares withheld for taxes of$8.8 million offset by$1.1 million received from exercises of employee stock options. During the three months endedMarch 31, 2020 , financing activities used$6.1 million in cash, primarily for payments related to shares withheld for taxes of$7.4 million offset by exercises of employee stock options for$1.3 million . Contractual Obligations and Commitments There have been no significant changes to our contractual obligations and commitments discussed in our Annual Report on Form 10-K for the year endedDecember 31, 2020 except for those disclosed in Note 9 Convertible Senior Notes and Note 10 Commitments and Contingencies contained in the "Notes to Condensed Consolidated Financial Statements" in Part I, Item I of this Quarterly Report on Form 10-Q. Off-Balance Sheet Arrangements As ofMarch 31, 2021 , we did not have any relationships with unconsolidated entities or financial partnerships, such as structured finance or special purpose entities, which were established for the purpose of facilitating off-balance sheet arrangements or other purposes. Use of Estimates Our condensed consolidated financial statements have been prepared in accordance withU.S. generally accepted accounting principles. The preparation of these condensed consolidated financial statements requires us to make estimates and assumptions that affect the reported amounts of assets, liabilities, revenue, expenses, and related disclosures. We base our estimates on historical experience and on various other assumptions that we believe are reasonable under the circumstances. We evaluate our estimates and assumptions on an ongoing basis. Actual results may differ from these estimates. To the extent that there are material differences between these estimates and our actual results, our future financial statements will be affected. Summary of Significant Accounting Policies There have been no significant changes to our significant accounting policies as of and for the three months endedMarch 31, 2021 , as compared to the significant accounting policies described in our Annual Report on Form 10-K for the year endedDecember 31, 2020 . 46 -------------------------------------------------------------------------------- Recent Accounting Pronouncements See Note 1 Description of Business and Summary of Significant Accounting Policies contained in the "Notes to Condensed Consolidated Financial Statements" in Part I, Item I of this Quarterly Report on Form 10-Q for a full description of the recent accounting pronouncements and our expectation of their impact, if any, on our results of operations and financial conditions.
--------------------------------------------------------------------------------
© Edgar Online, source
