News of the Week (February 19 - 23)

News of the Week (February 19 - 23)

31 min read

Table of Contents

1. Palo Alto (PANW) & CrowdStrike (CRWD) – PANW Earnings Review & CRWD/Cybersecurity Implications

Palo Alto is a cyber security company competing across endpoint, cloud and network use cases. Most of its platform is made up of integrated M&A while it competes with pretty much everyone besides identity brokers in the space. The network security suite is called Strata; the endpoint security suite is called Cortex; the cloud security suite is called Prisma.

a. Demand

Palo Alto missed billings guidance by 0.4%. It met revenue estimates and met its same revenue guidance.

b. Profitability

  • Beat EBIT (operating income) estimates by 10.6%.
  • Beat free cash flow (FCF) estimates by 3.7%.
  • Beat $1.30 earnings per share (EPS) estimates & beat its same guidance by $0.16 each.
    • GAAP net income for Q2 2024 excludes a one-time, $1.5 billion tax benefit. EPS rose 39% Y/Y without this tax help.

c. Balance Sheet

  • $3.3 billion in cash & equivalents.
  • $3.6 billion in long term investments.
  • $1.82 billion in convertible senior notes. No traditional debt.
  • Diluted share count rose by 8.9% Y/Y. This must slow down.

d. Annual Guidance & Valuation

For Palo Alto’s fiscal year (FY) 2024, it lowered billings guidance by 5.6%. I’ll explain the reasoning for this in the next section. It also lowered revenue guidance by 2.4%, which missed estimates by 2.6%. Conversely, it raised EBIT margin guidance by 50 bps, which beat estimates by 45 bps. Finally, it slightly raised EPS guidance to $5.50, which met estimates. 

Palo Alto now expects to fall short of the 3 year demand targets it set just 6 months ago. It still expects to meet the profit targets.

The firm trades for 47x FY 2024 EPS and 28x FY 2024 FCF. EPS is expected to grow by 24.2% Y/Y while FCF is expected to grow by 16.7% Y/Y.

e. Call & Release Highlights

Platformization:

The theme of 2023 software earnings was the power of the platform (i.e. multiple integrated services). As I’ve discussed repeatedly, software vendors able to displace more point solutions, drive better product cohesion, deliver superior efficacy and lower cost are standing out. ServiceNow was a great example from this current season. This quarter told us that Palo Alto has more work to do in its journey of turning Cortex + Prisma + Strata into a unified, interoperable platform. Palo Alto is changing its go-to-market approach to accelerate what it calls “platformization.” This simply refers to cross-selling more of its products to clients to displace other vendors. Customers of more than 1 of its 3 platforms deliver a a 5x value boost while users of all 3 generate a 40x value boost. Cross-selling is deeply positive for Palo Alto’s business, so it’s getting more intentional about driving that trend.

Up until this quarter, it had been assuming that customers will “platformize” at their own pace. It was basically waiting for competing contracts to expire before trying to cross-sell (why?). Now, Palo Alto will get more aggressive by pursuing those customers before expiration to tee them up for more expedient up-selling. As part of this, it will offer things like free trials to signed future customers until contracts with other vendors expire. That, it thinks, will allow it to deliver proof-of-concept and easier platformization upon contract extension. This also means Palto Alto will “share in the customer’s platformization risk” via forgoing revenue for a period of time. Ideally, this wouldn’t be necessary and it could deliver that proof of concept as part of its request for proposal (RFP) responses. I guess that’s not feasible. This change will lead to billings weakness over the next 12-18 months, with growth expected to accelerate afterwards as comps normalize.

Weakness in the product/hardware revenue bucket intensified the billings guidance weakness. Palo Alto cited “competitors rolling back price increases” and participating in “rogue pricing behavior.” I’m confident that leadership was talking about Fortinet, as it told us this behavior was coming mainly from legacy vendors on the product side (so probably firewalls). This “rogueness” is yet another reason why Palo Alto wants to drive platformization. It thinks cross-selling the rest of its product suite within network security separates it from Fortinet and others. 

Leadership talked about “spending fatigue” within cybersecurity as companies push back against adding more products without realizing a positive return on investment (ROI). Platform-powered vendor consolidation is how to deliver the positive ROI they’re increasingly demanding.

“Despite many demand drivers, we’re beginning to notice customers face spending fatigue in cybersecurity. This is new. Adding incremental point products is not driving better outcomes. There’s more focus on ROI from more clients.” – Founder/CEO Nikesh Arora

These were 2 of the 3 reasons why billings guidance was so disappointing.

Public Sector Weakness:

Public sector weakness was the 3rd material source of the billings guidance shortfall. Palo Alto is struggling to close important U.S. federal government contracts. This started in Q1 and worsened this quarter. It thinks this trend will continue in Q3 and Q4. CEO Nikesh Arora blamed this on a miscalculated revenue ramp from a large program. It fully staffed up for this business, which didn’t “materialize at the pace or spending levels expected.” Arora told us that updated guidance takes a “very cautious” approach to how this program will ramp going forward. Hopefully that means PANW is gearing up for an easy quarter of under promise, over deliver.

Billings for this current quarter were in line despite these headwinds. That was related to “having to make up the billings number with shipping some non-product backlog,” per the team.

Next-Gen Thriving:

Next-Gen Security (NGS) annual recurring revenue (ARR) was the standout for Palo Alto this quarter. It doesn’t expect the go-to-market change to impact growth here all that much. It reiterated the NGS portion of its 3 year targets offered last August and didn’t cite any macro or selling headwinds for this category. It also guided to annual NGS growth of 34.5% this year. It sees NGS growing significantly as a % of total revenue; that will boost recurring revenue above 90% of total over time.

Within Network, its secure access service edge (SASE) next-gen product grew by 50%+ for the 5th straight quarter. Next-gen cloud security also enjoyed its highest new contract volume in over a year with 3+ module customers rising 60% Y/Y. 30% of its new SASE customers are brand new to the company, which shows this product becoming a solid lead gen for new clients along with being a compelling up-sell candidate.

SASE combines network security tools (like URL filtering and data loss prevention) to prevent unauthorized access, network abuse and to promote broad hygiene visibility. It’s a large chunk of its “Zero Trust” offering. Zero Trust means requiring more consistent verification after a device or user enters an environment. This ensures a bad actor cannot breach the most vulnerable piece of a tech stack and move throughout it unchecked thereafter. Zero Trust is an imperative aspect of its platformization approach within network to win vs. legacy firewall players (who lack an effective Zero Trust approach). 

In endpoint, Extended Security Intelligence and Automation Management (XSIAM) was a large driver of the biggest contracts secured during the period. XSIAM users within Cortex deliver 5x higher lifetime value to PANW vs. non-users. XSIAM is similar to CrowdStrike’s and SentinelOne’s extended detection and response (XDR) products. It infuses 3rd party data sources (beyond the endpoint) into the endpoint protection process to uplevel security and aid remediation. XSIAM bookings overall again neared $100 million for the period.

NGS powered 36% spending growth Y/Y within its 10 largest customers. It also facilitated 22% Y/Y remaining performance obligation (RPO) growth. The legacy pieces of this model are struggling; the disruptive piece of this model is working.

AI:

Palo Alto is in alpha or beta testing for its planned GenAI products. When I heard that, all I could think was “what took you so long?” CrowdStrike is already gearing up to directly monetize its Charlotte AI security assistant. ServiceNow has already debuted assistants and its Vancouver platform. CloudFlare has already debuted compelling updates to its Workers AI platform. SentinelOne is already monetizing GenAI tools too. Palo Alto should be going faster here. It has the scaled 1st party data source, the talent and the balance sheet to carve its niche within this monstrous opportunity. So, go faster.

It sees a couple of opportunities in GenAI. All of them center around demand for cloud-based app, traffic and data security proliferating. This proliferation will naturally prop up demand for products like Palo Alto’s. It also has copilots in beta testing to automate mundane and tedious security tasks.

f. Take & Implications for CrowdStrike & Other Cybersecurity Disruptors

This was a good quarter and a poor guide. The excuses used to explain the shortfall create new and significant execution uncertainty for Palo Alto. The company has been a remarkably consistent performer for years, and this broke that trend. One quarter shouldn’t be enough to ruin an investment case for bulls, but if I were a shareholder, this would be on a somewhat tighter leash going forward.

With that said, I think these struggles are more specific to Palo Alto rather than evidence of broader sector weakness for the disruptors in the space. I’ll frame this conversation around CrowdStrike, but I think the same idea applies to SentinelOne and also Cloudflare and Zscaler despite those two being in network security where the aforementioned discounting is occurring. So why am I not yet concerned?

Subscribe now

First, the federal market weakness is specific to Palo Alto. The challenges that began to creep up last quarter were not at all felt by CrowdStrike. CrowdStrike, conversely, talked up robust public sector activity as contributing to its positive results. 

Next, the pricing pressures hurting Palo Alto are not within Next-Gen Security. NGS performed very well. The call made it clear that this is being felt within hardware and firewall-based revenue. Cloudflare told us nothing about pricing pressures hurting its network security business a couple of weeks ago. Fortinet has been the fundamental straggler talking about difficult market conditions. I’m confident that’s where the “rogue pricing” and competitive headwinds are coming from. That is irrelevant for CrowdStrike and the others I’ve mentioned.

Furthermore, if PANW is skating to where the puck is going by pushing to build a more cohesive platform, it’s skating to CrowdStrike. CrowdStrike routinely displaces 10+ point solutions thanks to its end-to-end cloud and endpoint security platform (called Falcon). Macro headwinds have been a tailwind for CrowdStrike’s market share gains. Why? Because of the superior value that it provides and the heightened need to seek out strong investment returns when the backdrop sours. Hints can be frequently found in the long list of Microsoft, SentinelOne and Palo Alto displacements it secures year after year and its soaring market share. 

Falcon operates under one interface, one light-weight agent and with all-but-endless 3rd party integrations. This means customers can basically have whatever they want in the Falcon ecosystem. CrowdStrike IS the overarching platform in these categories outside of network security. It then frequently works with Zscaler on the network security side to conjoin product suites in big deals and emulate Palo Alto’s 3-pronged platform.

But wait, there’s more. Palo Alto cited a pressing need to improve managed breach remediation for customers. CrowdStrike’s aggregate product bucket enjoys what most see as a material tech lead vs. the field in remediation. That lead is perhaps the largest in managed detection and response (MDR) where CrowdStrike meshes its massive data set, Falcon Threat Graph and world-class threat hunters to remove the headache from client cleanups. That’s an important pillar in Palo Alto’s platformization push, and CrowdStrike is (in my view) well ahead there.

All of the cited factors result in CrowdStrike’s unmatched recipe for growth, scale, margin, leverage and market opportunity. That’s the financial byproduct of its product suite. CrowdStrike the company is a gem and the Palo Alto report does nothing to change my subjective view there. Still, CRWD expensive! Some would say very expensive. The numbers should be very good when it reports next month. The stock could easily shrug off the positive data and healthily digest recently explosive gains. Regardless, I do not expect the results to change anything about my point of view.

2. Latin American Earnings Season – Mercado Libre & NuBank

Subscribe now

a. Mercado Libre (MELI)

Demand:

Mercado Libre beat consensus revenue estimates by 3.1%. Foreign exchange neutral (FXN) revenue growth was 83% Y/Y and constant currency revenue was its fastest in over a year. FXN gross merchandise value (GMV) rose by 79% Y/Y.

Profitability:

The firm sharply missed GAAP EBIT expectations by about 60% and GAAP net income expectations by about 50%. More context is needed here. The GAAP “misses” include $351 million in charges related to legal proceedings and tax disputes. It thinks it will lose the related hearings, so the company incurred the provision charges. Despite this being tax related, the costs were incurred in the cost of revenue and OpEx buckets. That is why it impacted GAAP EBIT so heavily and not just GAAP net income (because GAAP net income is after tax and GAAP EBIT is pre-tax).

Excluding this one time hit, EBIT missed by 12.1% and rose by 78% Y/Y for a 13.4% margin. Net income of $165 million would have been $383 million for a 12.1% margin. That represents GAAP EPS of $7.56 vs. expectations of $6.96. Excluding the one-time hits, margin expansion was despite higher rates of free shipping (discussed below), capacity expansion investments, more first party selling (lower margin but strategic) and postponed price hikes in Brazil.

Balance Sheet:

  • $6 billion in cash & equivalents.
  • $5.3 billion in debt.
  • Share count fell slightly Y/Y.

Valuation:

MELI trades for 57x expected 2024 earnings and 34x expected 2024 FCF. EPS is expected to grow by 46% Y/Y and FCF is expected to shrink by 20% Y/Y.

Call & Release Highlights:

Commerce for Consumers:

MELI delivered its fastest FXN commerce revenue growth rate in over a year as it continues to rapidly take share in all markets. Unique buyer growth rose to its fastest clip since the pandemic; items sold growth accelerated to 29% in Q4 for the fastest rate of growth since 2021. I guess you might say it was a good quarter… and you’d be right. Acceleration across key performance indicators and key geographies was enjoyed across the board. 

To leadership, this illustrates their strategy working and the several years of investments leading to improving user value. It’s the continued formation of a deepening competitive moat. Most of those improvements on the customer side are small & subtle in nature, but aggregate to form something truly unique to the region. As part of its Meli+ loyalty program, for example, it recently added a new option to schedule shipments on a set day each week for free fulfillment. This led to free shipping proportions setting new records in Brazil and Mexico as traction for the program and perk builds. As an aside, this led to the small Q/Q decline in take rate, which is a trade-off that leadership is happy to make. The effect of these tweaks working can be seen in orders per unique buyer, which rose from 7 to 7.6 Y/Y.

Interestingly, MELI is greatly leaning into 1st party GMV. It wants to vertically integrate more of its marketplace and more of its supply chain. It thinks this will allow it to offer better service and unleash more flexibility to enhance consumer value as it rounds out a superapp. Improved pricing, selection and inventory picking algorithms are resolving previous internal bottlenecks that prevented 1st party proliferation. And? 1st party GMV rose by 85% FXN Y/Y.  As part of this evolution, Meli is finding growing success within consumer electronics – the largest e-commerce category in Latin America. The 1st party algorithm investments and better supplier relationships led to 140% FXN growth for the category in Brazil this quarter. That’s despite consumer electronics growth in that market for Q4 being negative overall.

Commerce for Merchants:

MELI continues to roll out 3rd party seller tools as it pursues both 1st and 3rd party GMV growth. It launched a new affiliate program and short-form video clips to juice seller traffic and conversion. Both debuts are working as expected. Furthermore, improved delivery timeline accuracy is boosting 3rd party merchant conversion further. That means more revenue and profit for MELI. Win, win.

Meli added 50,000 new advertisers to its network in 2023. Most are self-service, but it recently debuted new tech to manage more of the targeting and reporting for larger buyers. Advertising revenue was above 70% FXN for the 7th straight quarter.

Logistics/Fulfillment:

MELI is now delivering 52% of orders same or next day vs. 54% Q/Q & 51% Y/Y. The sequential decline was due to consumers choosing slower, cheaper options and more deliveries to regions further away from its fulfillment centers.

It continues to build out new capacity in Brazil and Mexico. In Brazil, this led to its internally serviced fulfillment rate rising from almost 40% to almost 50% Y/Y. Mexico capacity additions helped ease fulfillment bottlenecks that it had been dealing with there.

Total Payment Volume (TPV):

MELI splits TPV into three buckets. Acquiring TPV is payments processed for merchants; Digital Account TPV is payment volume within MELI’s mobile wallets (bill pay, peer-to-peer etc.); Off-platform TPV is volume from other merchant sites utilizing Mercado Pago as the checkout gateway. There is overlap between off-platform and acquiring TPV. Acquiring TPV rose 104% Y/Y FXN while digital account TPV rose 259% Y/Y FXN and off-platform TPV accelerated across every single market. 

  • MELI thinks it’s one of the largest acquirers in LatAm today. 
  • QR processing is thriving in Argentina; point of sale (POS) processing is thriving in Mexico.
  • In Brazil, it’s seeing greenshoots from its previous reorganization of its POS go-to-market. Investment payback periods are shrinking, which should let it get aggressive with nurturing Brazilian POS volume.

Financial Services:

MercadoLibre’s interest earning consumer accounts doubled Y/Y to reach 30 million. Growth was rapid in all regions. It sees this as a wonderful top-of-funnel for future cross-selling. MELi can offer a compelling savings yield to delight customers, get them into the ecosystem and then monetize with all of the other products the firm provides. It’s willing to use this high-yield savings account as a lower margin lead generator to boost highly engaged new accounts. This is clearly playing out in every market as it enjoys a TPV uplift that directly correlates with account growth. It just launched this high yield savings product in Chile. All in all, MELI has 53.1 million fintech active users vs. 43.7 million Y/Y and 30 million wallet payers vs. 23.3 million Y/Y.

Credit/Lending:

As described last quarter, the company entered 2023 “cautiously optimistic that problems with Brazilian credit when first launching the card in 2021” were resolved. It wrapped up 2023 with “hard data to support that optimism.” It has extensive customer data profiles to know its base better than others can. It’s beginning to prove that it has the tech to effectively flex this advantage. Despite the acceptance rate boost following fine tuning its underwriting, delinquencies are stable and its newest cohorts are performing very well. In Mexico, where it debuted the card this year, credit performance is good early on. Overall TPV growth for this product bucket accelerated throughout the year as it got more aggressive in Brazil and enjoyed the Mexico launch. Its overall credit portfolio rose from $2.8 billion to $3.8 billion Y/Y while credit card users rose 95% Y/Y to 20 million. It continues to underwrite better than others and continues to be among the low cost providers as well. This is how its net interest margin after losses sits at a lofty 39.8% vs. 39.0% Y/Y.

“We are confident that our proprietary data will be a major competitive advantage as we build this product over the coming years… 2023 is a testament to our ecosystemic competitive advantage in distribution and underwriting, our cautious risk management and geographic diversification.” – Shareholder letter

  • 15-90 day non-performing loan (NPL) rate was 8.2% vs. 7.6% Q/Q & 8.4% Y/Y. Lower is better.
  • 90+ day NPL rate was 18.7% vs. 20.3% Q/Q & 29.6% Y/Y. The Y/Y fall was helped by shedding a large chunk of 270+ day non-performing loans.
    • Provision coverage (percent allowance for doubtful accounts / NPL rate) for 15+ day NPL loans rose from 102% to 107% Y/Y and from 131% to 153% for 90+ day NPL loans (helped by shedding 270+ day delinquent loans).
  • $3.63 billion in credit card receivables vs. $2.95 billion Y/Y.
  • $2.63 billion in loans receivable vs. $1.70 billion Y/Y.

Argentina: