Mandiant (MNDT) 3 Feb 212020 Q4 Earnings call transcript

Ladies and gentlemen, thank you standing by, and welcome to the FireEye Q4 2020 Financial Results Conference Call. At this time, all participants are in a listen-only mode. After the speaker presentation there will be a question-and-answer session. [Operator Instructions] I would now like to turn the conference to your speaker today, Kate Patterson with FireEye Investor Relations. Please go ahead ma’am.

you. Thank full-year thanks discuss the the FireEye’s of and and us for fourth everyone XXXX to today financial the to afternoon call on joining quarter Good XXXX. results for live This call accessed the investors.fireeye.com. Relations Investor the at and of website can on FireEye’s over section is be Internet broadcast being Executive are Officer Financial Chief Officer Chief Accounting today’s With FireEye’s Executive President, me call on Officer; Vice Chief FireEye. of Mandia, Kevin and Frank Verdecanna, and the issued After the results the announcing today, press and for XXXX. FireEye quarter full-year a market XXXX of fourth release closed the

of them statements. let and no in apply you management statements call. and which opportunities for the relating expectations as begin, of and business growth market our rely drivers course FireEye’s availability the to these statements we of expectations capabilities update those these on me to make and forward-looking beyond for obligation expansion the by and guidance certain These Before future offerings, not FireEye’s and as forward-looking number should services, a results remind views are which and our priorities, uncertainties, involve control, new transformation, initiatives, expectations, undertake risks financial anticipated statements representing and cause you differ FireEye’s of subscriptions materially some actual during statements benefits, of today, FireEye’s to from strategies. products, and could the go-to-market we statements These after and will and results that this and enhanced including of plans call, forward-looking metrics, and investments,

Relations our Copies release filings, of uncertainties, documents our the please be of as obtained or the posted risks an website. detailed a well to refer and Investor ago. visiting For our by of these SEC from section may hour the SEC earnings as description

provide on call. we measures discussed that be this non-GAAP will certain financial Additionally,

section GAAP Investor measures We have the in most these comparable for Relations non-GAAP earnings of as release. in well provided measures as the directly financial the on reconciliations website, the financial

supplemental Finally, I’d the slides like the to the in point website. posted Relations call of I’ll over out Investor we that, turn With tables and have to Kevin. that section

and Thank and you the interest this were last in the appreciate few on joining We call. and customers, investors, partners a continued us pivotal employees, your support. Kate you, all cybersecurity thank The to months industry. time

Once XX,XXX threat These XXXX. December, During the in detected malicious back labeled detecting products our quickly discovered impact. compromised a backdoor implant, No agencies, we chain XX,XXX of Further our exposing customers it as we discovered or cycle. significant as organizations. the successfully we campaign which over scale original security until March products, implanted platform. FireEye and supply a to included SolarWinds SolarWinds thereby security a was and a the the of a of power the innovation built FireEye with capability espionage it and cyber demonstrating team several did the detect protecting victims fourth far actor quarter, backdoor, in companies investigation showed by delivered government had in SUNBURST that implant and

evading incident publicly We demonstrates incident of game. security strategic also providing attacker the details are this other our but the I'm meant investigators of shared the community proud attackers of the Mandiant organizations the community. for SUNBURST before safeguards, even to what all not it’s importance required SUNBURST the behavior team who FireEye threats. attacker security collective This help techniques identify providing the the and company, backdoor, security are only of the the about impact had for our knowledge the and our implant who to aware on the found knowledge Mandiant routinely how FireEye the responders

cash a revenue, quarter, over year. to to with time me revenue; record the We for billings flow record fourth the recurring growth posted both XXXX. the business billings double-digit full-year and of and annualized returned record first record the for We turn highlights. in the exiting quarter in year fourth income, financial and let non-GAAP Now operating growth

included million approximately billings percentage growth were proactive importantly, in responding We XXXX Mandiant our two-thirds I to of breaches are quarter, in are XX% now solutions. less expenses closed as Operating strong in while million expenses greater reduced We two cloud a of XX XXXX transactions these to services for XXXX. of vendor. operating revenue solutions. mix greater but XX% importantly, total we and two in services XXXX, million the in the now revenues financial operating the growing continue category our professional validation; Mandiant and our due performance improving platform than our more CEO our transactions of higher generating an and to our while Revenues results than operating three security have million business, company more our our from believe for functional offerings, our while of service ARR investments managed cloud the areas results illustrate million or categories. ever. half of done $X reorganized is to than transform in when transactions our we as faster a for of revenues our appliance to areas of to FireEye’s I compared detection our XXXX. a as of services More most spending these company results business products The XXXX. positive year. and XX% creating of In in our as vendor we strategic in in And work and and category XX% areas investments revenues our was more security continue of a security or represented our for shift our grew And XXX% XXXX. we our dollar expanded to $XX comprise revenues, fourth performance two-thirds became XXX in we over than and We services accelerating year-over-year. for our last, category record perhaps APT expenses growth our Today, a had Threat areas. XX% ARR billings revenues, more of growth. accelerated expense overall cloud our tailwind $XXX areas. percentage Intelligence in in believe ARR more we into and and a very for our differentiators essential combined post

attacks technologies that our and empower Products to our all from frontline offerings Our Solutions, best security FireEye in organizational can Mandiant customers of critical enable leverage will cyber the our I that to protect agnostic product the technologies best you control and highlights expertise. security was this year, alignment in through each and I area. intelligence believe progress take past our to and success

have our made Mandiant First, to Solutions. like progress discuss I'd we with the

security call data. In incident, Mandiant consulting wake several than ever, SolarWinds together now to subscription all software. We're awareness just includes operations than practice, customers that SaaS respond our bringing for we situational threat this of an Advantage. addition offerings, intelligence, security, offerings want as rather subscription now to of and ever validation, these defense, platform more In our organization alerts and a the managed aggregate a expanding

unique proprietary end, awareness Mandiant To Advantage. learning combination used machine automate intelligence, We advantage a to models with We gives to our are this us this rapidly data This of train the open Advantage security Mandiant and first expertise providing believe customer’s our launched we as release Advantage our to threat intelligence. module, well workflow. intelligence into security platform threat October, operationalize customers our Mandiant operations source enables in intelligence, as operations.

we have And of offerings strong customers We all we that Advantage. are to customers Mandiant in new free of intelligence nearly existing drive complete built through will believe our in strong growth pipeline XXXX. migrating a our

the of course offering we Over our Advantage. also into will XXXX, validation integrate Mandiant

from to their infrastructure security their is their our and about clear a in resilience our why ensure to a customers measure prioritize refine believe to from and customers solution growing I threat report attacks module fastest that validation protected both portfolio the that testing can It a XXXX. pivot Our in they validation security allows on is they will need learning spending. that was security solution are so to threat. effectiveness,

these of critical the the for increase lack primarily the cybersecurity added lack the I growing data of our expertise scale capabilities a resources, intelligence, And to two all machine organizations at as alluded to security machine speed. respond alerts today, that Mandiant allows facing platform the This The challenges and friendly our generated we Response, and allow talent, demand will channel be volume and and Services organizations capabilities to Where acquisition leverage from teams for module transformation. third managed to continued artificial of reasons. Advantage security biggest of will to Respond software. Mandiant of Intel earlier, our and by XDR address versions to teams two comes learning the customers will offer offering. their digital

remote we attacks; ransomware. introduced address and of cloud including security the escalation focused to new services, because strategic on security, workforce, new First, and cyber second, assessments

we we XXXX, revenue, As a in a future quarter Services up the have record XXX in in services XXXX will me, XX% result, the million, we quarter X organization and for the deferred excuse Mandiant had another exceeded enter Revenue in work and first time. in And than million our million fourth representing row, services year. in was as record XXth quarter, another revenue, XXX more record deliver XXXX. deferred

FireEye products their agnostic, hand-in-hand protect While are with Solutions our controlled Mandiant they work to customers. relentlessly

frontlines. the over updated trends the ensures products The quarter. have products our FireEye past seen cycle intelligence fourth from we quarters latest the with Our innovation few in continued in are the

a cloud the our network had also strong continued and strong Helix security and quarter, posted product quarter. Our fourth endpoint in results

with that in our day. increasing and organizations place Endpoint Naval We cyber by challenge barrage This our was across XXXX, Network of awards an December detection drive continue threaten ever Solution, Smartvision. for entire offer Warfare best for the to Security in March attacks breed Security Systems in Command of product our two Information Entering are innovation first operations validated facing and every portfolio.

security sustainable the our frontlines quality of Our position a advantage and represent the FireEye. of for intelligence on

breed focused Mandiant We we on security going Advantage operations beyond challenges our today's are best addressing Platform. protection. in controls control are leveraging deliver security providing to But of the of and products technology the by our advantage this

to First, easy it intelligence. our make threatens operationalize to

alert processed prioritized speed enable of analysis. for machine through are alerts and indicators at technologies, machine triage so high-risk human to are and Second, AI XXX% learning

managed the customer's our customers or latest their to as initiatives, that professional support Third, And has to looking on I'm our and forward against and test our effectiveness, revenue. to a FireEye who organization. through to for announce multiple transformations engagements, attacks. year demand software innovation. continue an pleased sales recurring with lastly, manage, marketing Bill lead Robbins to joined product our available is through our who to [Brian it scale depending on will our SaaS proactively lead led and to Palmer] Brian FireEye I'm including security technology partnering industry To managed go-to-market our expertise to resilience empower accelerate services has needs. veteran products FireEye Brian has products making their communicate and past service the towards organization, measure, growth programs.

Peter under of by COO, are the we Mandiant of this We leadership line aligning execution Bailey our the a I Advantage focus FireEye defense. defense that our XXXX to differentiate customers the and be on ensure best also will priority. to am showing of our Platform line FireEye appropriate year is confident continues have

have turn the will ensure implant. of are the and we believe and team's details continue today briefing to Now, its update SUNBURST our of our briefings, quarter. cyber our the came sat espionage we attack, of we fourth part community stronger FireEye during global of do the I before, teams, products I'd security proud the was than with a to threats. I'll XXXX. incident, impressed identify all the informed details and call thank for FireEye through Frank for never to Frank? more than I over investigate more hundreds, I tremendous thousands the countermeasures. investigator similar if and outlook very own on protected Mandiant our SolarWinds our and and emerging employees our to source to like not and are together against performance how With for FireEye financial of that, I'm

to on joining Thank everyone today. Thanks, for us Kevin the and hello you call.

you to operating flow. on QX be our remind move for metrics, me details the I'll revenue we and non-GAAP and that XXXX, our guidance except Before and for to and full-year XXXX of cash referring QX results full-year let

with amortization stock exclude Our debt and the on we great preferred equity, non-GAAP measures Consistent charges, non-recurring seen had expense a convertible finish our of we other compensation, have convertible the to restructuring throughout building XXXX. and non-cash items. year, intangibles, interest strength based

We had which subscription, results which strong Our with of in companies category, very a is a strategic were see milestone into billings managed of XXXX, is which mid-point XX%. revenue guidance services growth the our $X reach. platform, billion, this few reflected momentum especially QX forward in cloud ever year-over-year and carrying

all our Turning record above more and non-GAAP million. to results, revenue guidance XXX We generated financial well metrics. we to $XX XXX million, record on almost XXX operating range operating QX than overachieved million We million. of income our of of delivered

average recurring early We our provides generated recurring in without of in million length, XX into mature line of cash increased services focused as the or remain than year-over-year on important revenue and contract and We refresh insight revenue X% annualized installed The and subscriptions our cash our free X% ARR, the also annualized more most hardware stabilized. the XX recurring renewals, revenue total operating to premise of solution and timing accelerated And indicators million regard on ARR and in expansion and sequentially, changes platform cloud subscription top flow, ARR metric the for managed flow. performance. as base cycles. growth and

As contract billings or billings we one and we know you factors see at leading growth many look ever, And all a cause we've in is quarterly months, by past that to weighted XX especially for the XX years. highest and categories. as months any growth more Total a indicator. volatility rates billings strongest billings, breakout I'm XX% the about the we've pleased of for in cloud services the billings We can within year-over-year in the these to still the managed growth subscriptions XX quarter year-over-year in recurring year. platform XX% the achieved report of year-over-year, of same was had led over range seen which category. average subscription The than months grew length three

and the XX% very security XX% million. XXX revenues million. Solutions for unfolded. of our momentum strong Revenue year-over-year Within QX on from quarter XX% year-over-year. in posted expertise follow-on Our at had discovered forward. We security increased demand, Professional of clearly defense in service cloud of for driving projects, with delivered and XX related of The up new This for and we from transformation and the when will and includes ARR our category the details a growth this revenue deferred is was of managed services near managed represents The and ARR services and managed to as to deferred contributor incident on all revenue now ARR little QX year platform Very ARR our which million services, category underlying customer to bookings an to XX represented most the increase we operating a XXXX. services retainers, performance up expanded also customer category QX red assessments, in platform revenue strategic ARR, a expertise which total and as strong Threat category did subscription XXXX. performances. this Cloud also a XX% XXX This our strategic, capacity see and teaming cloud million. in of subscription revenue managed show X% in be services the response breach. incident Verodin, increase SUNBURST offerings. Endpoint, growth to Intelligence already is of expanded XX% ago, record current Mandiant increased XX% mirrored for by standout growth XXXX, sequentially the sequentially for demand were [incident] service

ARR, declined mature threat and fourth as declined represents subscription cloud and and ARR cloud year-over-year Across headwind years moderate which offset this fully in in related see related as solutions was business, and our sequentially. continue product subscriptions based sold and subscription on-premise X% product ARR prior and now support the on-premise reflecting especially Appliance related feeds, to and XXX. current The in our based in to form amortized, see quarter. The factors, we product Revenue more our sequentially lower dynamic year-over-year. are should for growth flat the more and begin decline the all year-over-year, to XXXX Turning amortized revenue deferred increased subscription product for appliances XXXX. support to and sales from for product X% in stabilization was ARR as endpoint. by year-over-year fully are than we maintenance well balances intelligence the category, XXXX under

performance Our year a a primarily from strong margin was revenue of the year XX%, top XX%. Gross down higher a at ago, year margin revenue versus our to due resulted XX% in of gross XX% guidance a compared of slightly of revenue ago. of this profit services, to mix end

a sales commissions above count to for above operating range. share includes areas in addition higher our guidance per The resulted operating was the weighted share waited range stockholders strategic operating million and fully combination our the operating they margin quarter expense and cost respond positive transformation million expense. expenses growth reduced we X.X sales, lower in carry costs. factor work less XX% and fourth from XXXX the The higher shares of in guidance revenue and than partially first Overall, did of average require Earnings marketing X half of operating lower of reductions expenses this issued and was transformation margin through investments strong outstanding. the throughout were $X.XX, in facilities reductions higher about from services profit of increase time cost services year. to expected gross While The by and growth in the XX%, declined the driving expenses achieved also a lower diluted The in in business. record XX%. response levels the the they the on QX and of were COVID T&E XXXX, XXXX, of reflecting a from offset the

operations with million. digits XX and sheet, cash the to generate low we cash DSOs record record balance growth in flow billings and Turning from a XX a of double flow days, of

we in the shift XX the our facilities operating still expenditures towards quarter appliances of cloud-based XX million closed as million worldwide, fourth continue flow. cash as fewer demo resulting X.X record For year, flow generated our to free cash purchase as the of in million. a well most of With capital were we solutions,

fourth flow of Our strong the paid equivalents offset very investments healthy short-term ended partially the acquisition. the reflects ClearSky billion. the approximately balance in cash, and performance and the million, and cash Blackstone we increase and cash investment remains XXX year of respond by X.X sheet The with for our quarter, cash

turn let's Now, to and XXXX. current our first quarter for the outlook full-year

QX, at currently down to we pattern. and For reflects of million. range expect in million the of QX XXX typical revenue the mid-point seasonal from is This revenue XXX XXXX, our

and related, services product the growth rates managed to cloud QX. revenue we For categories, subscription with year-over-year consistent expect and platform

increases For by related services, revenue as QX services hiring to fewer revenue equal we to approximately capacity in billable to QX, compared to are expect days be in QX. offset

margin expect XX% We gross with and QX of of consistent between XX% XXXX.

between expect a of reflects expenses $X.XX count the and of XXX share mid-point. sequential $X.XX. earnings a in weighted million Using X.X%, between increase increase X increase fully per about at normal well diluted and The a operating average expenses. in of QX margin share as million, of implying we and X.X% quarter a of expect operating as We respond full fully employee-related operating costs in diluted

growth X For midpoint, the XXXX, approximately year. billion approximately of at of revenue for X% we representing the expect

and one our deferred by as will increase rate expect quarter managed subscription of point increases revenue category the services the sales that cloud and revenue in each ARR. we We see platform momentum about growth

our consistent We of throughout and between XXXX. expect XX.X% XX.X% gross margin with results

on earnings guidance to to per XX%. million several outstanding average We a diluted based Embedded X% shares of expect assumptions. on XXX are of to weighted These margin in a results of basis. $X.XX ranges our million share XXX $X.XX a non-GAAP operating within

average Our XX length for following our rate results, X consistent of approximately contract subscriptions. revenue growth with months billion and assumes pattern of billings historical seasonal our approximately a

managed XX% and annual growth Our subscription XX% XX%, related cloud services. from of platform for XX%to subscriptions and our product about by rate assumes and revenue to decline revenue also revenue growth to support

annual We growth subscription Please growth we balances through model. XX% Mandiant that can of of consistent increase growth year-over-year expect XX% are both to while the this to category vary. quarterly billings revenue rate for the talking revenue expect as rates for each deferred Services. growth rates these with a about for increase And and year for categories, we note the

year. range second assumes gradual operating more heavily to half the weighted the improvement margin the Our throughout year, of

assumed This absolute trend an as lower facilities our second have but half T&E in to T&E the level second in offsets the down dollars year. We they caused in that compared half, reduced pre-pandemic a has overall taxes at to the payroll in in levels. expense increase expenses of OpEx historically

expense flow an of year. margin Finally, levels, for XX% these about cash at the we expect operating

services QX, And half the great that in greater operating realize strategic growth part in in we QX about we QX but in of here, our category a impact almost we there lower did in summarize, a lot to balance increasing collections, of milestone performance billion, the enter I the of cloud Revenue the revenue detail generated managed platform than given major expect receivables the growth ago. be second waited becomes QX. as to all of a Given cash subscription X expect our a flow year on mix. a the evolution. with of overall is collections our we to year at seasonality QX is

growth, ability and execute on while leverage. line We managing our have our proven the operating top increasing to expenses

operating investing strategic Our operational and continued on emphasis efficiency. balance a and margin reflects outlook initiatives in growth

our operational four challenges our areas the and made in over momentum with business. focus the strategic financial years. investments, strong resulted the last have We discipline in growth of growing Even advantage, effect the cumulative tremendous XXXX, performance the our competitive and of of progress

intelligence questions. than operator execute. the now and but than yet not ability over turn and been confident at the more our Our advantages transformation in I've years FireEye, never on after call for complete, I expertise, eight to to more a back market opportunity, will is competitive our

[Operator you. JPMorgan. question Sterling first with Our comes Auty Instructions] from Thank

open. now is line Your

finding to thanks. a Kevin, the country about for Yeah, the team you want to private the of questions, kind Shifting whole of can to, think saw demand? to obviously, in you just demand, over sense? give guys. terms you seen our sense. have for services you perfect you you start it. product a as a breach the the thank you in us team Hi, FireEye whole, any managed So, the government, companies, when know, of you actually impact makes or uptick that know, and it services, thank you uptick What you know, big with in the for, know, follow-on, finding and you for to

it's Yeah, relation our say a I Managed that Defense X. went quarter. because great I public had that quarter. happened the on December the SolarWinds We so can't incident in you can to late tell in

on cloud I any we Defense Managed went impact quarter from December quarter. the late something on They have kind Protection. the have working public the XX. a direct think And had on real But implant need home. quarter. to endpoint was a late Endpoint And in to everybody's distributed is that great of where

our at to incident. SolarWinds incident that SolarWinds think after was I Services acting prior capacity the and the Sterling

measure there. there continue when to capacity really, hire they're difference to it's just So at perform and continue to hard we and

you. Thank sounds Alright, good.

you. Thank

with Moskowitz Gregg comes Our next question from Mizuho.

line is now Your open.

way. very thank like thank to much And very echo I that heartfelt you, for question. a Okay, you taking in Sterling's

up to was a asking. a Sterling some what double on to bit click perspective, Kevin, of just maybe So, follow

to, forward do expect as business; what a, to you going know, you b, and impact prospectively, it your then business? So, your products services see relates

know, we quarter services I the class. every same on can this almost the the build strategically is have we our the and side best Advantage make that services detection that sure Mandiant think in I XXth you, the record and tell saying mentioned is products you anticipate thing, to quarter, platform straight important but

observed services for So, whenever And levels nice a services. quarter, there’s I've is do [bake-off] you the past a not about services thing we you in what rise. powerful the see know, [indiscernible] have

that's the out respond know, you is when us lot is to of what very You with to The a breaches, we to do people they about that which is, and it, you of very figure figure response out work kind happened, strategic. just you reality for do, capability feel what incident tactical. don't also have know

sell we've done I on you creating to programs a Advantage. proactively breach look taking their that A we're at well, consulting top point folks, one practices the strategic of So, seeing a lot from without is where work products, advanced priority B Mandiant point know, have as that intake that, when know, security a and grow and I we you the

When Technology. And you over speak what with we scalable intelligence, we year, besides languages, X,XXX threat networks differentiated FireEye’s attackers over a that's about you have that in way respond XX more we're doing it We to technologies have absolutely a can something matters. know teams XXX how into break something just breaches Mandiant year, than XX you anybody. And Advantage. you countries, need in analysts red to a get do

endpoint then doing us. So, opportunity growth very and And of I great well. think as well the for a that's cloud Helix versions are

it's Mandiant Advantage great endpoint, over Advantage, with it the the we're year always now because does, it validation say for cloud going services when that what together Mandiant have calendar So, managed think as defense, you hear our software, drivers and me that response Intel, put to and XXXX, we'll for acquisition that of our and year. when the all of combined doing keep a will growth I year look for at great

been up, maybe that very have a may. That's just mentioned Frank, lines you follow appliance amortized. fully I helpful. right, the quick terrific. All And XXXX if now XXXX and

the if think now from you you know, a grow, forward? do can even position point perhaps we're this at So, ARR and you very product related where just modestly,

customer's that Yeah, a obviously, as cloud far the of stabilization ARR, growing on I you preferences product related think for and and on-premise. we've as depends know, the on that, versus seen kind

quarters I we've of know, had fact ultimately, definitely on But think, you by cloud to see ARR. of So, we're a are the pretty more the we encouraged in subscription now going growth and couple platform a product the side. that stabilization related strong lot

so on becoming not now that huge a is drag ARR. And

you. Thank terrific. Alright,

you. Thank

Our Brian Sachs. with comes next Goldman question from Essex

Your line is now open.

Great. operationally and taking Thank the on and congratulations the financially. results, you for question both

the Kevin, I down break Advantage, roll incremental the functionality and spend how And features platform, or can platform? of you rollouts be intelligence like guess growth a translate out does kind are I know Mandiant of you terms these, the impact time, across over threat to in substantially side by you respond, know, of going So, that Solutions way guess, as we the in more and gradual terms that adoption Mandiant into little meaningful of bit the customers? they

comments couple this, a Well, on Brian.

you know, there's works. at speeds have, we which different an First, organization

Key, we're this best investigations. we that's the bought have firms have And cloud what know. the Why validation Chris CISOs a question looking on with for that whole and you people. foremost, or responding number backstop know moving CEO great one the They the the to sense we've experienced cloud. we're have thousand inexperienced we if know well, year we'll Mandiant do it not over Verodin be was every all Mandiant technology We are great great product the the single that then is your I they're and to threat at get component. running our request there, whether talk a guys second all these careers at do to Advantage. get best you how And team, capability doing and can we the Wouldn't planet? me. expert had we want Well speed, can I intelligence when we've do if makes And it's buy. alert you got. our who And that first this So lived that development with and the works, stuff

why there still So, are breaches.

with test to the in And got putting real have know, know done. in They factor we've platform and we use the people which it modernized form time. We they offering validation, it want. ourselves. You what giving Intel Intel, that's virtually already our that's

we're responding breach we're So, Mandiant seeing to into is if a the Advantage. now, going everything right

that we validation, getting of that's how can there's security? anything moment boardroom. the question, in that aware answer one our good it and are at that done. Combining that the new, if metric number So, with the are customers And now works the we we're is my same

get truth doing You by validation. unvarnished

real it It's because ransomware we tested all login And then you about got real or used never methodologies with validation minutes really of run and We which getting folks what's be called could that's and an a use their an we whether who on-demand through, as under validation our would that those, can And what [actor value. against to validation. account, one it's be attack the to a Maze]. they or known this integration. learn liked response tremendous maze, know, outcome. So, going bad did to XX the neither under on-demand minutes agent, cloud-based. had the to stop from before detect a all them, with attack infrastructure And download I deciding XX

take that software XX-year them So, we it. because thinks that tremendous they out things because the will And of and technology. automate within months. be that and to that value lot hired prop, on to those do about we've person bought together then And analyst, you a a do we been do few Mandiant is we the want We what learns. believe respond can figure quest, happened when through next two automate what the putting in and fantastic things we're

not it. the do respond but aspect we the of I do, And of just what So, detection want aspect that. we can we to believe automate,

in and the XXX and tests have can the of relevant better We thousands that think with in we So, feed consultants data, better. it our we just train doing. security we're we automate so managed it can many of bought defense have, the we we can Mandiant a capability respond, customers I

winded than that's proposition long didn’t know probably a and powerful Intel, do in answer, Brian a to other the is and we're answer experts question, your bringing going thinking I that process to software So, validation, Mandiant XXXX.

Blackstone Maybe a helpful. and pipeline, I this quarter? investment by know, you M&A super in that's right, shift given if last any sneak can follow-up, in ClearSky, All you strategic quick know, your,

to You know, that absolute we to conviction our did get strategy.

darn and Advantage on just Mandiant of portfolio to the making broad. bets what what plan, that's we gave with we're and And is a the strategy portions really our here Blackstone, us portfolio and know, endorsed You have doing. pretty that we're conviction it

pretty So, partnership. that pleased with

you I big a like there, this platform. you lot But we out know, any there's the we're that for feel would fill close very that of to, benefit technologies we Brian, at something the don't staying know, point, the in looking think always holes need to term. near

Okay, helpful color. Thank much. you very

Thank you.

from question with Boolani comes UBS. next Our the Fatima

now Your open. line is

maybe Thank I'll afternoon. with for questions. start you Good Kevin, you. the taking

the you own as triaging maybe I to incredibly have franchise in, implications follow tools have about how your of has in mentioned “had about implications process. a in personnel of, of incredibly community you used and have translated of I emerged terms some know, you that then so frank of your And details is into that for your you the a experience happened, revenue your and security own you internally, And to Team the candid the know, much Red that the or things victimized of literature know, You I'm some your has Mandiant think aftermath burn” some what up. incident one in curious Mandiant this blogging the result tools, assess, customers? of been to

Yeah.

from us by a us. So that they've any our that were quarter. Fatima third during just fourth been evidence first, no in no Team used tools the Red party, there's breach evidence There's stolen

to we Second, there's breaches. no living impact. is know, It's, a do you for respond what

to. of almost Team, the all that Red adversaries it our done the respond R&D all we for is So by

actor wow, been things or we did might what have wild, always out in see it we observe So, repurpose some the more and threat that harder hour done this and that is we've effective. will to say, detect the the

by is North cyber always and Russia, So, you're and criminals. our Red cyber locations espionage China, And augmented campaigns any other from by Iran, R&D Korea, Team's advancing way. in

you defend there's to security past, So, the had we'll And the a use it. upping these From assessment with respond that able all to be we as to a still tail. capabilities method in our the always community's Red we first, we I have because big that by know, the to tools ability we anticipate, the see Teams. breaches, an keep moment against attacker used first we

real at more simulating recent all. to and using off attacks. And no impact we're already So,

essentially appreciate $XXX prior is periods even Thank from clarification. that give it SUNBURST? your period, deferred And you. has that you, magnitude sitting for a I sense the in, you that prior compared revenue can have me. maybe Thank we Mandiant to fourth us Services Frank, now, how you is larger you in what know, that's and a backlog Kevin. that's of, million sense post, how much quarter so of

absolute Yeah. It’s an record.

actually, quarter XX XXX million, we did but at also fourth at million So, we ended year increase sequentially. A were million. XX the ago, we

did professional to building for like revenue the completely services of time because like And the capacity you know, don't from for SUNBURST a lot as you a that we some during had on-demand it our boost But to revenue because have Kevin QX well. nice on current know, expertise a side. a impact, remarks But, the of lot new offerings, know, so, that a on current did impact that I that, already. an expertise bit differed impact a prepared yeah, operating deferred little have we've a, was probably demand mentioned you incident. our of have been of But area, the quite team didn't because of give really at somewhat know, results,

you much Thank so helpful. Frank. Very

you. Thank

BMO. from Keith comes question next with Our Bachman

is open. now line Your

want two. to Hi, thank you very ask much. I

on Kevin, ARR of you flatten I XXXX? for other comments First for wanted products any parameters provide to XXXX? for any kind there or make could takes know out direction, without that here but you you any ARR growth want is and to puts mentioned for you, for

getting we're but really think platform year to see the ARR accelerated what growth expect we'd Yeah, specific year think the throughout a I the is Hi, stabilization Frank. cloud number, Keith. but ending think on and to This I product the for XXXX, and is not subscription related, on I ARR.

that service about the it's about from that all the we’re platform driving you think we're managed growth a business, opportunity ARR. subscription, the excited making perspective, and and areas in cloud If really investments

ARR XXXX those ARR two growth then? I putting mean, then XXXX should, versus growth Okay, just in improve should together,

Correct.

Okay.

guiding in the people? the just bit it there, than that for services but to of I growth that year enough that is of happened than back incidents wondered little just maybe XX% and XXXX, turning in services of because second, during help this growth, have been constraining the you and you'd would well end flush variable, up that you're find XXXX us. little but terms higher growth could can't may year that would growth, would last I towards a Because capacity, seem end candidly you know, current it the that key a just for XX%, higher higher fiscal have reach Thank like, all that given out fact, thought just it's frame Just you linear and to year, being bit to if would you. kind be a the

Yes. faster? and come where there this Yeah. XX capability. our always we're And But we foremost, does is, doing now, what services for and I've first years, and had, a could our about grow growth foremost, Keith, been intend we've rate first and right also there's quality

Yes.

a timeframe, take services want at we we same to platform do So our have faster, probably lot think it humans you'll don't scale. replace capability. I to ever easier even I but And But we're that own the it that think completely trying can a to in folks makes for grow of security.

seven at do responding more to at could believe one services. to respond time. only in put time. breaches, today to Mandiant intrusions computer to eight We've different So, one I we that And folks regards responding than I perspective, I in a can when yesterday at got to to now deliver was

now. out that's right technology job adding, also go can would We gives a expenses already frontline we a hope the we consultants that it while. doesn't – me, our is So, the being the and my Frank but could more technology A, by half for a enabled. rate to tell like and hiring scale meet it demand double he

that way like the So, Mandiant to on a consultants, there's teach go just When them a fine time. And to I talk back. can assimilate a new you got the a from we winded to takes in long wheels growth and And way wobbly XX% standpoint. best I’m XX, you you I to XX% call rate. get when quality offline

it's where So, we at. like it

just while, enough, I you on doing a this then. and think fair deck, guys I to very for you wanted helpful. compliment have Yeah, been it's the slide

much you. Thank So, appreciated.

Thank you.

you. Thank

from Pritchard Our Walter comes next question with Citi.

line Your now is open.

services historically round thanks. side. of at services and attack given see the seen, the pipeline What just all engagements? of the and more Kevin, nature wondering the of to you've with and offerings attach services this the know, what do just recurring you there recent type compared engagements Hi, that on you differently on revenue is in

are to tell can attacks But I know Defense that I I I doing you to anticipate stronger grow. you, don't if the it's services Advantage a our with. to continue and [indiscernible]. related Managed Yeah, And dealt behind relationship see Mandiant between

on point incident with a a our get the it's get a the because quickly. dependent the With of incident But there's logical with the had strategic think it. then our folks Verodin, that and customers years when platforms, a to Because is, up been And red our of shield running show way, from pretty our it own validation relationships and I immediately engagement, ups always security relationship since A services we more consulting bought our our a for profile those behind bought well, B stronger. up, own enabled, we whether getting our capability technology or point ever strong lead to are things. it's response, as does with lead between doing teaming response. but take while software we XDR folks behind folks

stronger manage services lead for in we Defense, between a whether our customers. lead that not Managed capability or behind Mandiant a correlation there be behind that So, Advantage will or and a short,

percentage three three you Could products. see more the sort of Got through that it. are of you those And you lay that [indiscernible]? then the of high it is mentioned what include common that us more products out dollar maybe the just most help on or are sets deals, when products million

Frank. do review Frank. and ahead ahead Yeah, them quarter, go Go we every

the about talked but than XX% greater transaction. the million basically a that for Kevin year, quarter, of fourth for the dollar

them actually XX% and services, know them products. XX% So, more of of of included the four you XX%, included

might So them as what threat endpoint, we're Managed there email is then and network be of intelligence well. there and a seeing component what a component, is a in services then product Defense is most for in a

products solutions. think So deals that we're some lot customer's But each deal platform different of well the thing of detection a where little a is we're on really need. these as it, the happy bit platform I depending on about of is, the our are seeing as our part

really detection our it's advantage and taking So, of intelligence product. best-in-class our expertise and

Great, thank you.

you, Walter. Thank

you. Thank

Erik comes Suppiger with question next JMP Securities. from Our

Your line is now open.

much thanks Can the you question. for your coming incident Forensics Yeah, remind how taking response? professional us is services from and

and something always and always about folks is, it training What consulting be the that's can tell we're other almost about XX% for but can great. If I not repurposed doing service those to the they're mix. there of lines. they're folks, or doing of always regardless up utilization that in if anywhere Forensics, is strategic just You our most from There can you varies, know, upwards it at the it jumps be XX%, same down.

across the XXXX great a Erik, And year on in proactive strategic obviously But across really and services, growth side. was looked strong IR all the we you had if investigative.

strategic really well. So and had record it is that as wasn't a IR it just the year, proactive

Okay.

changing the it you're time though you sound all hiring at capacity Now, light of it pretty as rate most like much the SUNBURST. of in sounds doesn't and operate

Mandiant You've most little you which an but from like that, helped incident product or by this like that about bit get out streams is another can to area maybe and things affected Advantage SUNBURST? particularly discuss arising is revenue that? a opportunities talked Is reactive there how

expertise, during you did company you expertise bring the as the for this breach than nine wild XX,XXX the the we to think if that that I companies, was the it a the one discover the validate lot fact companies able what intelligence almost that of how that table. know after really out months to FireEye Yeah, really in of being only was intelligence and things look of our at and important validated out we incident,

our And intelligence across we expertise, that a our cycle are that with innovation and and have have products positive that it of portfolio. impact so level updated the does know really fact that you

is to So, products of going also strong have a our but intelligence smarter obviously every intelligence getting and expertise our that, really expertise. because of because day, tailwind the and because are products

contribution intelligence? you get us And can the you what remind from

in expect a is really component Mandiant area, intelligence XXXX. growth probably most it's one Advantage of and we'd the significant the So, the

Great. very you much. Thank

mean not and there product a a and without Well, an direct Intel is product cycle, valuable. then learning indirect, without a capability of is there literally result innovation I that is

the something every So, to that we go look minutes new powerful. very is few have fact for

single every product of have, So that to Intel it we all contributes is, kind of, pervades them.

very you Thank much. Great.

Thank you.

Our from comes with next Shaul question Eyal Oppenheimer.

line open. now is Your

afternoon, back you. on Congrats potential GDPR transparency healthy everybody. Thank Good My in implications. regarding actually performance, on the the the kudos December on again SUNBURST hack. question is

You lines. obviously guys at the front are

of of it or are any with now? potential is began talking so with some guys them at You associated discussing you this right could preliminary implications, to that stage many customers. Have be hack your SUNBURST the finds

and of in this risk shocked Yeah, be occur. area astonished I'm I'd if unaware at And juncture. that would that any

Got you it. Thank I much for that. so it. appreciate

you. Thank

Thank you.

with Morgan from comes question next Fodderwala Hamza Stanley. Our

is line Your open. now

a I'm of wondering echo bit transparency. for you for I'd you And my talk little also my about growing taking if Thank question. your gratitude to like guys. can Hey, the SUNBURST for COVID, area, you lot attack obviously about come more have as well. right, that's I and mean, security complexity even priority demand surface a to an plus expanding had prior sort

speak to around that thoughts COVID. overall security any it architectures specifically relates you thoughts have changing early to pipeline that your you can sort of So, more as and or then post-SUNBURST – perhaps

of So, the both general commentary aspects. on just sort

everybody's working from that and is come protection remote better protection remotely. things Yeah, cloud. authentication identity, and clearly movement the to workforce Remote post-COVID, workforce better

everybody to on So of single effectiveness to an we what think, security it In their They everybody that infrastructure, and their IT goes by, got trends. those programs definitely every something pandemic. knew organization like the our accelerated everybody's – have that's gets regards that you about whenever how and a by the quarter is attack SolarWinds, would more every infrastructure nest depends to fair profile to a where we've if their got and detect risk how sophisticated there's we such couple got we especially the this, would have of awareness. we supply companies think I an of these don't big is sure we'll So, have secure that, going hey, deal we've chain, to be things? outcomes make from or do, with sort from our attacks to

attack, I it's that's I why you've to think did we it gives do. bought as how validation truth, very think, you simulated important, going unvarnished you be

something we that's engineers something audit their develop where so code, is check do obviously engineers, us supply is increase. that supply no all in, are that security consider that software you There into, everybody are that folks and none chain looking their that a code how to is how of risk serve. the and question, how chain, is will they to companies then going So do

a with probably It’s a this happen there recognize answer. and but that a just quick some that discussion, way XX-minute a an alarm the of breach it is desire planet awareness organizations to And the secure that's people. compromise and So comes to to everybody a surreptitious alarm way not most for again. on got in

best a the defense? that's national government of pretty Right. large and degree has being the And cyber sort the I'm top just around involved the practices obviously in vertical. of of footprint to me. sort advising taking also company, priority now is administration, wondering is in security federal follow-up, federal role a and sort improving Maybe a obviously Biden FireEye for it one for what quick

Well, I appreciate that question.

red do line have doctrine the of something the what, what you any one not you and stand into repercussions and to the cyber. And you after impose doing government best that the of define biggest we for administration in that and that then device the face what expect I for that's with attack folks can will our is a think I look American do are know would that. companies the think behaviors for we issue and doctrine cyberspace. risks things they is of and Starts to

thing next to violate are And make sure those those few those the who to to to things come The are I second bear, risks think repercussions those over rules. is years. going

much. very you Thank

Thank you.

Next question please.

Thank you.

question with comes of Tal Liani America. next from Our Bank

Yes. Hi.

Hi, Tal.

and the and – the Mandiant it doing any focus services but compete services of company it's Is consideration to more Your is bad, is part, continues to great, less there product legacy just decline. the company? your some not in the struggling I'm on in where into the complete that the you're you about to areas mind what strategy? a through the products long-term exit related trying turn think service areas when or to company goes understand of

Yeah, absolutely, Tal, you. I tell can

off, cloud-based have what ability our world's frontline just of differentiators thinks, Intel, automate the one with analytic validation. brain brings Mandiant we The you that skills at that. most not timeframe know our best we but Mandiant, Advantage to fact automate over what fast, same are. take have threat intelligence know, a all that we the we portfolio do our we in First to our And the market those learns, is share and that the for move that that incredible we we with to and the to our and and leverage want expertise think I ways advantage prioritize

Tal, always that's single our Let's company. who can their to put this at looking and that bring into software been want We way, a Mandiant goal. every alert coming bear it through wouldn't expert

focus going have most and portfolio based on we're and and we're differentiated we're we it at. to that at in So the that's long-winded world our best doing a the prioritized saying of – we're what on prioritizing way

we're – exceeded if the you at the solution at look But pure products the growth area, on that's if product strategic side. Tal, the investing cloud the side, solution. where the decline look growth putting we're And areas on the we're dollars, investment the on-premise you

in the did fourth side, the the area, mature third one invested areas. that and then is flow So, important actually really the on growth back product generating significant company business and high the cash more flow point quarters but see we put also and growth is is the cash in in

two-thirds the speak. and of you billings transformation I So, came quarter, managed cloud growth In that can of high think as services. platform subscription our from we services see the happening areas and fourth

are I helping that mature making fund think we're areas So, The more that. transformation.

Got Great Thank you. answer. it.

Thank you.

question with Our from next Kalia Barclays. comes Saket

Your line is now open.

closed in revenue, an so maybe you, for wasn't perspective, ARR probably housekeeping, a ARR for thanks one Hey, I just you kind was big perspective. there realize of business from fitting acquiring book guys, Hey I of can us here. of and ton Respond intra-quarter, Frank, it a would me from just imagine but how an first remind we're

rails the us you So, guard how in contributed might much could platform that and the any quarter? give have ARR

didn't a year-end. were because than little $X much of quarter revenue, less at Yeah, end perspective from January it they January It actually million – the contribution a fiscal added have bookings, in fourth ARR. billings of

lot a of were there closed the deals XXXX. that fourth in of in actually So, quarter January

been part So, wouldn't of our QX results.

sort and it years when could you of the years you there. a FireEye offering I Mandiant follow that pricing mean brushes quick is, threat, sort on of comes threat. is here premium Got a the obviously threat any to Kevin, right focus broad of mean Intel it. Mandiant great That's point of FireEye from Intel talk Mandiant threat a you know had now, perspective that Advantage Intel helpful. sort about starting Advantage Advantage then, takes Intel before? up step-up, for for And lot versus has I

Threat all so addition, where only that we platform and to existing connected basically of through now So benefit we've threat when converted Advantage. is customers to to the Mandiant have modules Advantage, the way our Mandiant intelligence Mandiant with see Advantage we'll consume multiple most the really feed Intelligence respect it's

all synergies add we in respond, from can the one one dashboard through that you mean when will the capabilities add in think and and XDR come place all validation I really of So, in in having to we bear.

Got it. again the for Thanks guys. time

I Thanks. it. appreciate

questions not any this for further now to remarks. you. closing I'm like Mandia at would turn the call Thank Kevin over back showing time. I to

the XXXX you that on that are of cyber are of XXXX. our now of month you done the which security We we've for mind. at faster of to great us growing job transformation relevant a important. cyber growth enter half like higher than to larger our our business portions all joining today. We've very in The thank I'd is business, with tailwinds ever. more espionage top that's last has two, look campaigns portfolio, the or that When and we’re responded everybody in to

very XXXX Thank all excited you. at our I forward first of to you on the the look you updating progress. end about we're quarter and So, of to

Ladies and call. gentlemen, participating. concludes for conference today's Thank this you

now You may disconnect.