Eric Heath

Eric Heath asked about the F5 partnership, specifically whether it expands the endpoint Total Addressable Market (TAM), its potential significance, and if this model is applicable to other areas of the infrastructure stack.

Answer

CEO George Kurtz confirmed that the F5 partnership expands the TAM, as customers have long sought protection for appliances. He noted that certifying CrowdStrike's agents to run on F5's platform creates a working model for other appliance vendors. He shared an anecdote of a new customer acquired through F5, highlighting its potential to protect critical infrastructure often targeted by nation-state breaches.

Eric Heath asked about the F5 partnership, specifically if it expands the endpoint Total Addressable Market (TAM), its potential meaningfulness, and its applicability to other areas of the infrastructure stack.

Answer

CEO George Kurtz confirmed that the F5 partnership expands endpoint TAM by enabling protection of appliances previously unavailable. He noted that certifying agents to run on F5's platform creates a model for other appliance vendors and highlighted a non-customer's positive experience.

Eric Heath inquired whether the outperformance of Zero Trust Everywhere was due to a larger or earlier-than-anticipated firewall refresh cycle, or if Zscaler sees an even bigger pipeline of displacement opportunities for calendar 2026.

Answer

Chairman and CEO Jay Chaudhry attributed Zero Trust Branch interest to eliminating lateral movement (preventing ransomware), significant cost savings by consolidating multiple point products (firewall, SD-WAN, DHCP, NAC), and operational simplification. He emphasized a strong pipeline and millions of branches still available to pursue, indicating that deals are not solely dependent on refresh cycles.

Eric Heath inquired about the outperformance of Zero Trust Everywhere relative to expectations, asking if it's due to a larger or earlier firewall refresh cycle, or an even bigger pipeline of displacements for calendar year 2026.

Answer

Chairman and CEO Jay Chaudhry stated that customers are driven by the desire to save money, simplify operations, and enhance cyber protection. The primary driver for Zero Trust Branch is eliminating lateral movement to prevent ransomware attacks, coupled with significant cost reduction by consolidating multiple point products. While refresh cycles may contribute, deals are often initiated by the compelling ROI presented by Zscaler's solution. He noted tremendous interest and a strong pipeline, with only 450 customers adopted so far out of millions of potential branches.

Eric Heath asked about Zscaler's exposure to the retail sector and the opportunity for Zero Trust Branch within this segment, particularly considering the five-year depreciation lifecycle of branch firewalls.

Answer

Chairman and CEO Jay Chaudhry identified retail as a significant segment for Zero Trust Branch, noting its straightforward and simple deployment across numerous similar stores. He confirmed that Zscaler is counting on retail, among other areas, for business growth in Zero Trust Branch for fiscal 2026.

Eric Heath questioned whether consumption should be the primary metric for investors to focus on for future acceleration, rather than ARR and subscription revenue, and how logs contributed to million-dollar ACV deals in the quarter.

Answer

CFO Jim Benson clarified that while ARR remains important, consumption is the underpinning of growth and an important metric to track as it fuels expansions. He highlighted logs as the fastest-growing product category, rapidly approaching $100 million, and noted a doubling of customers spending over $1 million, with logs being a key driver for these large deals. CEO Rick McConnell emphasized logs' role in delivering better outcomes by unifying data.

Eric Heath asked if consumption should be considered the key metric for indicating future acceleration into fiscal 2027, rather than ARR and subscription revenue. He also inquired about the contribution of log management to the million-dollar ACV deals closed in the quarter.

Answer

Jim Benson, Chief Financial Officer, clarified that while consumption is a crucial underpinning of growth and an important metric to track, ARR remains very important, and it's not the only metric. He noted that logs are rapidly approaching $100 million in annualized consumption, growing over 100% year-over-year, and have contributed to a doubling of customers spending over $1 million and a nearly 4x increase in customers spending over $500,000 annually. Rick McConnell, Chief Executive Officer, emphasized that integrating logs into the overall observability mix delivers superior outcomes and cost savings.

Eric Heath asked if the strong quarter for large expansion deals was above the typical trend and how much was driven by go-to-market changes versus customers consuming beyond their commitments.

Answer

CFO Jim Benson attributed the performance more to the go-to-market changes made last year, which focused resources on high-propensity-to-spend customers, rather than a change in sales compensation. CEO Rick McConnell added that a concerted effort across sales, marketing, and customer success is driving consumption and building the strategic pipeline.

Eric Heath with KeyBanc Capital Markets questioned the rationale behind increased investments despite a modest growth raise and a larger margin reduction, and later asked if the competitive landscape is intensifying due to shrinking legacy displacement opportunities.

Answer

Jen DiRico, CFO, justified investments by citing continued market share gains, increased customer volume, improved rep productivity, and growing contributions from new offerings, aligning with the planned investment year for fiscal 2026. Sanjay Mirchandani, CEO, added that investments are vital for staying competitive and sustainable. Mirchandani also acknowledged the intensifying competitive landscape driven by cyber visibility and AI, but affirmed Commvault's winning strategy through innovation and meeting customers across hybrid environments, seeing ample consolidation opportunities.

Eric Heath asked about the confidence behind increased investments, given a 50 basis point raise in growth guidance but a 150 basis point reduction in margin, and whether the competitive landscape is intensifying with shrinking legacy displacement opportunities.

Answer

Jen DiRico (CFO, Commvault) stated that operating expenses remained consistent at 61% of revenue, with margin pressure primarily from the accelerating SaaS business (which has a different margin profile) and the shift in term duration. She affirmed continued investment as market signals indicate sustained opportunity, with investments paying off as evidenced by increased ARR guidance. Sanjay Mirchandani (CEO, Commvault) added that the competitive landscape is always intense and now more visible due to cyber relevance and AI. He emphasized Commvault's strategy of out-innovating competitors and meeting customers where they are to win, believing ample opportunity remains for consolidation and enhancing customer resilience.

Eric Heath inquired about the assumptions for the Federal business embedded in the Q2 guidance and asked for more detail on operating margins, specifically why more profit wasn't dropping to the bottom line.

Answer

CFO Jen DiRico stated the Federal business is performing well and expects similar seasonality with a strong first half, aided by its FedRAMP High certification. Regarding margins, she and CEO Sanjay Mirchandani noted that OpEx was impacted by higher bonuses on record sales and planned investments. They highlighted the strong Rule of 40 performance (47) and the different margin profile of the fast-growing SaaS business as key factors.

Eric Heath inquired about the current macroeconomic environment, customer sentiment on cyber resilience, and any changes to sales cycles or close rates, asking how these factors influenced the fiscal '26 guidance. He also sought clarity on the flat year-over-year operating margin guidance and the company's investment philosophy.

Answer

CEO Sanjay Mirchandani stated that cyber resilience remains a top customer priority with no significant changes observed heading into Q1, though the company remains watchful. CFO Jennifer DiRico explained that the guidance balances prudence with the strong demand for their products and confidence in their execution. Regarding margins, DiRico noted the company is investing to capture a large market opportunity, building on its 'Rule of 41' performance in FY25, while Mirchandani added that the growing mix of SaaS revenue has a different margin profile.

Eric Heath inquired about the primary drivers of the business's acceleration, asking to distinguish between external market factors and internal execution. He also questioned the seasonality of net new ARR, noting that Q3's organic growth and Q4's implied guidance appeared similar to previous quarters, contrary to typical second-half strength.

Answer

CEO Sanjay Mirchandani attributed the growth to a combination of strong market demand for cyber resilience and improved internal go-to-market execution. CFO Jennifer DiRico addressed seasonality by explaining that while the second half is typically stronger and Q3 had a high renewal base, the Q4 guidance reflects a strong pipeline and momentum in security offerings. She suggested that looking at ARR growth helps neutralize revenue seasonality.

Eric Heath asked about the 'easy wins' and learnings from Flink customers that are being applied to scale Flink adoption. He also sought feedback on how Confluent views competition with Databricks' Structured Streaming product.

Answer

CEO Jay Kreps identified broad Flink use cases, including real-time data pipelines for AI/analytics and acting on data for fraud prediction or personalization. He noted that larger customers are converting existing batch processes, indicating Flink's maturity. Regarding Databricks, Jay emphasized Confluent's complementary partnership, serving different constituencies (real-time operational vs. data engineers/scientists), despite some overlapping capabilities.

Eric Heath asked about the easy wins and learnings Confluent is observing with Flink customers to scale its adoption across the customer base. He also sought Confluent's perspective on competition with Databricks' Structured Streaming product, which was announced this quarter.

Answer

CEO Jay Kreps identified broad Flink use cases, including real-time data pipelines for AI and analytics, and acting on data for fraud prediction and personalization. He noted that larger customers are successfully converting existing batch processes. Regarding Databricks, Jay emphasized Confluent's complementary role as a real-time hub for operational applications, while Databricks serves data engineers and scientists for historical analysis, despite some overlapping features.

Eric Heath posed three questions to the CFO: what drove the early renewal activity despite sales comp changes, what's driving the decline in non-cloud ARR quarter-over-quarter, and what's behind the higher-than-expected material rights activity.

Answer

CFO Kiran Choudary clarified that early renewals were primarily tied to expansion deals co-terming with renewals, some of which were multi-year, and not related to sales comp changes. For non-cloud ARR, Kiran Choudary explained that as cloud ARR constitutes 85% and is growing, the remaining non-cloud portion sees some decline due to migrations, but is nearing a steady rate. Regarding material rights, Kiran Choudary stated these relate to credits given to qualified customers during cloud transformation, which are now expiring or being used for new/expanded products, leading to timing-related outperformance.

Eric Heath questioned the drivers behind early renewal activity, the decline in non-cloud ARR, and the reasons for higher-than-expected material rights activity.

Answer

Rubrik CFO Kiran Choudary clarified that early renewals were primarily linked to expansion deals and multi-year contracts, not sales compensation changes. He attributed the non-cloud ARR decline to ongoing migrations to cloud and explained that higher material rights activity stemmed from the expiration and usage of credits related to cloud transformation.

Eric Heath posed several questions regarding the model, including the drivers of early renewal activity, the decline in non-cloud ARR quarter-over-quarter, and the reasons behind higher-than-expected material rights activity.

Answer

CFO Kiran Choudary clarified that early renewals were primarily tied to customer expansion deals co-terming with renewals, some being multi-year, impacting cash flow and billings, and not related to sales comp changes. He explained the non-cloud ARR decline is due to 85% of net new ARR being cloud-based, with a small element of migrations from non-cloud, expecting it to stabilize. Material rights activity was higher due to qualified customers' cloud transformation credits expiring, with accounting treatment varying based on whether credits are used for new products or simply expire, driving Q2 outperformance.

Eric Heath from KeyBanc Capital Markets asked for help contextualizing the size of the identity resilience opportunity relative to other workloads like Microsoft 365, and inquired about its current contribution to results.

Answer

Co-Founder, CEO & Chairman Bipul Sinha described identity as being at the heart of every business's cyber strategy and a top attack vector. He positioned Rubrik's opportunity in bringing modern cyber attack principles to identity resilience, combining it with data context. Chief Financial Officer Kiran Choudary added that while there is strong initial interest and demand for the identity solution, it is still very early days and its contribution is not yet material.

Eric Heath asked about the expected benefits of integrating Data Security Posture Management (DSPM) natively into the Rubrik Security Cloud (RSC) console and how this might accelerate customer adoption.

Answer

CEO Bipul Sinha stated that this integration is central to Rubrik's single-platform strategy, allowing customers to easily enable DSPM on their existing RSC instance. He emphasized that the combination of DSPM and cyber recovery creates a unique and complete cyber resilience offering. Sinha highlighted that this is particularly critical for enterprises adopting GenAI, as it helps secure data before it's used in AI models, citing a financial services customer who used DSPM to securely adopt Microsoft Copilot.

Eric Heath inquired about how the Data Security Posture Management (DSPM) offering is changing customer engagement, particularly with CISOs, and asked about the financial uplift from the enterprise tier.

Answer

CEO Bipul Sinha shared anecdotes of CISO conversations where Rubrik's ability to combine data risk understanding (DSPM) with recovery is seen as a key differentiator. He confirmed that DSPM is driving more engagement with security leaders and that there is strong traction in attaching DSPM with the Enterprise Edition, which now has over 50 customers.

Eric Heath from KeyBanc Capital Markets posed two questions: one for Todd McKinnon on why it is critical for identity to be an independent, standalone platform, and one for Brett Tighe on how to model the impact of the large Department of Defense (DOD) deal on RPO and CRPO.

Answer

CEO Todd McKinnon argued that identity's complexity requires consolidation on an independent and neutral platform like Okta to preserve customer choice across all other technologies. CFO Brett Tighe clarified that for the DOD deal, as with most public sector contracts, the value for total RPO and current RPO (CRPO) will be the same because it is a one-year agreement.

Eric Heath of KeyBanc Capital Markets inquired about potential business softness during the quarter, particularly in April, noting that other security companies had reported challenges and that Okta's international segment had decelerated.

Answer

CEO Todd McKinnon stated definitively that there was "no softness in April" and that the quarter's performance was predictable and solid, especially following a very strong Q4. He reiterated that any conservatism added to the guidance is a forward-looking measure and not a reflection of Q1 performance.

Eric Heath inquired about the sequential decline in the Q1 cRPO growth guidance and asked for more detail on the data points supporting the new specialized sales model.

Answer

CFO Brett Tighe explained that the Q1 cRPO guidance reflects typical seasonality, as Q1 is historically their lowest quarter. CEO Todd McKinnon elaborated on sales specialization, citing positive results from the hunter-farmer model implemented in FY25. He emphasized that the expanding, complex product portfolio (including Governance, PAM, and Auth for GenAI) necessitates specialized sellers who can deeply understand customer needs in distinct IT/security and developer markets, which ultimately improves win rates.

Eric Heath asked if Okta is observing an increase in RFPs for consolidated identity platforms, a trend he has heard about from GSI partners.

Answer

CEO Todd McKinnon confirmed significant progress with partners, noting all top 10 deals in Q3 involved them. He highlighted a nearly $5 million ARR deal with a major tech company, driven by a Zero Trust initiative, as an example of a multi-phase, GSI-involved project. CFO Brett Tighe added that partner engagement in top deals was diverse, including GSIs, ISVs, marketplaces, and traditional VARs.

Eric Heath inquired about the near-term priorities for accelerating growth and the key metrics for tracking progress. He also asked for details on what is incrementally new with the Incident Command platform and if a customer migration is required.

Answer

CEO Corey Thomas identified two key priorities: operationalizing the customer expansion motion and better educating the market on Rapid7's D&R capabilities. He explained that Incident Command is a significant upgrade that simplifies data ingestion, includes a built-in threat intelligence platform, and embeds expert-trained AI to automate SOC workflows. He assured that the upgrade path for existing customers is straightforward.

Eric Heath asked if the success of the Detection and Response (D&R) business is dependent on the VM installed base and if D&R can maintain double-digit growth as VM declines. He also requested guidance for Q2 ARR.

Answer

CEO Corey Thomas asserted that D&R's growth is not solely dependent on the VM base, as it has a strong new customer land motion, with nearly half its business coming from new logos. He also highlighted a massive untapped upgrade opportunity within the entire installed base. CFO Tim Adams added that for Q2, they anticipate a modest ARR increase from Q1, with the full-year performance expected to be more second-half weighted.

Eric Heath from KeyBanc Capital Markets asked about the SIEM market, noting recent M&A activity, and questioned if Rapid7 is successfully capitalizing on displacement opportunities and if this is a factor in longer deal cycles.

Answer

CEO Corey Thomas stated they are performing 'great' in capitalizing on SIEM market disruption and are 'scoring a lot of points.' CFO Tim Adams added that the Detection & Response (D&R) business, which includes their SIEM, is very healthy, constitutes half of the company's ARR, and has an exciting growth rate, indicating their competitive position remains strong.

Eric Heath of KeyBanc Capital Markets asked why underlying firewall demand appears soft, suggesting that excluding the refresh benefit, product revenue might be flat to negative.

Answer

CEO Ken Xie refuted the idea of negative underlying growth, emphasizing that the refresh cycle represents a very small percentage of the overall business. He stated that the company raised its billings guidance based on broad market and solution strength, not a reliance on the refresh. The refresh is primarily a tool to incentivize customer upgrades to the new SASE firewall platform.

An associate for Eric Heath asked for quantification of the potential margin impact from U.S. tariffs on hardware sales and inquired about the steps Fortinet is taking to mitigate these impacts through its supply chain.

Answer

CAO and incoming CFO Christiane Ohlgart stated that Fortinet does not expect a meaningful impact from tariffs in Q1 or Q2, as very few products are subject to them and only a small portion is imported into the U.S. Founder, Chairman, and CEO Ken Xie added that the company's in-house design of ASICs and systems allows for manufacturing flexibility, and healthy inventory levels provide an additional buffer.

Eric Heath asked about the company's strategy for inventory levels in anticipation of the hardware refresh cycle and what portion of the refresh opportunity is embedded in the 2025 product guidance.

Answer

CFO Keith Jensen stated that a healthy inventory turn target is around 2x, and the company would aim to manage its inventory balances to that level quarterly. CAO Christiane Ohlgart added that while there's a compelling reason for customers to refresh in the second half of the year, the company has already seen refresh activity from large customers and will try to accelerate the cycle. Therefore, the guidance assumes a more gradual upgrade path rather than a sudden spike.

Eric Heath asked about the displacement activity Datadog is seeing with log management and SIEM vendors following recent M&A in the space, and whether customers typically adopt both logs and security use cases together.

Answer

CEO Olivier Pomel confirmed seeing significant success and migration opportunities, particularly for FlexLogs in operational use cases. He explained that log and SIEM use cases are typically adopted separately because they are purchased by different teams at different times. The common pattern is for a customer to start with ops logs and then expand the relationship to include SIEM conversations later, a process Datadog is working to accelerate.

Eric Heath asked if the increased focus on the EA business suggests it should be viewed as a sustainable double-digit growth segment and inquired if the fiscal '25 new workload cohort appears to be of higher quality than the '24 cohort.

Answer

CEO Dev Ittycheria reaffirmed commitment to the EA business as part of the 'run anywhere' strategy but emphasized that Atlas remains the primary growth engine where new features launch first. CFO Michael Gordon stated it is still too early to judge the quality of the fiscal '25 workload cohort but noted the company has been pleased with its new business wins.

Eric Heath asked for the reasoning behind expecting a slower-than-typical seasonal rebound in Q3 and inquired about expectations for the federal vertical, given the government's fiscal year-end.

Answer

CFO Michael Gordon explained that the Q3 assumption is based on the recent experience of a slower seasonal rebound in Q1. CEO Dev Ittycheria stated that the company is well-positioned for the federal vertical with its FedRAMP Moderate certification and that the opportunity is factored into the guidance, while work on FedRAMP High continues.