Q3 2020
My thoughts
I thought this was a strong quarter for ESTC. They’re an under-loved (IMO) company, both on this board and by the market in general. I think the main reason is that the investment horizon is longer-term than most here. Also you had a good chance of losing money if you invested since they opened at about $70 on IPO-day, and are now at $74.
However, I think they have shown strength in a competitive market, and have a reasonably unique moat (deploy anywhere, not just cloud), as well as an aggressive pricing model.
I purchased some DDOG because I can see the advantage of “just get it going” deployment (2% position). However, ESTC (8% position) is approaching that ease (I think?) with their SaaS offering, and I believe a much stronger security proposition. Ultimately I think both companies will be successful, but I don’t believe that DDOG should be 2.5x the price of ESTC (at 2x EV/S), and I believe ESTC actually has the stronger portfolio with a larger TAM.
On the sort of downside, ESTC is still a company “for the future”. For example, we get anecdotes of security wins but no figures.
I like this quote from Shay - “Data has gravity”. What that means is it actually matters where the data goes. It’s heavy to move. Theres cost in moving it to another service, outside of your datacenter. It needs to be in as few places as possible, not endlessly replicated to additional SaaS providers.
cheers
Greg
Checklist
Q: What is revenue doing yoy?
A: +70% +63% +58% +59% +61% - Q3 back above 60% - very pleasing.
Q: What are customers doing q-1?
A: 5000 5500 6300 7200 8100 8800 9700 10500 {10% +15% +14% +13% +9% +10% +8%} - little drop since last? To be watched, but maybe just seasonal.
Q: DBNER?
A: >130% again
Q: Revenue per customer up or down (either revenue/customers or ARR)?
A: Q1:18 9914 Q218:10299 Q318:10091 Q418:9838 Q1:9950 Q2: 10194 Q319: 10423 Q419 10779 - general trend upwards.
Q: Expenses as percent of revenue going up or down (ie, any sign of leverage)?
A: Expenses as percent of revenue:
| | Q3 | Q4 18 | Q1 | Q2 | Q3 | Q4 19 | Q1 | Q2 | Q3 20 |
|:----|:-------|:-------|:-------|:-------|:-------|:-------|:-------|:-------|:-------|
| R&D | 15,092 | 17,543 | 18,981 | 25,332 | 25,850 | 31,004 | 35,182 | 38,478 | 46,119 |
| | 36% | 35% | 34% | 40% | 36% | 38% | 39% | 38% | 41% |
| S&M | 20,727 | 27,927 | 30,422 | 34,634 | 37,196 | 45,044 | 52,011 | 54,020 | 54,829 |
| | 50% | 56% | 54% | 54% | 53% | 56% | 58% | 53% | 48% |
| G&A | 7,555 | 9,737 | 10,099 | 12,092 | 11,151 | 13,194 | 18,568 | 31,808 | 21,096 |
| | 18% | 20% | 18% | 19% | 16% | 16% | 21% | 31% | 19% |
R&D is pretty flat, but a large chunk of revenue compared to DDOG <30% [GD: note that DDOG is cloud-only, whereas ESTC will run anywhere. I think this is a big competitive advantage to ESTC, and that would/has probably taken a chunk of R&D. Also DDOG are only just getting into Security]
S&M dropped this quarter, DDOG 35%-40%. Again, be good to see that come down while maintaining revenue growth, but with a DBNER >130% it makes sense to spend to get people into the product.
G&A dropped considerably because of EndGame acquisition expense in Q2.
Berts Analysis
Sauls Board
CC Discussion
“building enterprise search, observability and security solutions on a single technology stack that can be deployed anywhere.”
[GD: Deploying anywhere is the key differentiator to DDOG etc]
Enterprise Search - “we engineer a search box you can put on just about anything”
Meta engine for app search [GD: what is this? suggests people are using app search for multiple searches]
“Vision of ElasticCloud being the single SaaS solution that customers can deploy all of our solutions”
“When data lives in one place under one UI, it’s easy to go from analysing infrastructure to server logs, … why stop there, why not protect?”
[GD: this is true, but the jump … actually, on reflection, this makes a lot of sense. I’m a bit slow. Essentially, all the SIEM (Security Information and Event Management) stuff is analysing the log, APM data collated in ElasticSearch. The point is, the data all needs to be in one place for analysis, thats unavoidable, and Elastic provides that as a matter of course.
Turning this into a longer discussion, this is really what people talk about when they say “the silos are collapsing”. There are basically multiple sources of data that feed into “observability”. You have server level + app-level (APM), logging (from apps), customer behaviour (not sure ESTC does this other than log management), etc. The data-storage layer is the integration point for all of this observability, which makes it a natural choice for analysis and security. You may need some more data (eg: network), but you already have a flexible search+storage solution.
SIEM detection engine - 100 prepackaged rules that automate threat detection. Users can add community rules.
GD: FMI - How this works is event management. You set up a event data forwarder (eg: winlogbeat which sends Windows events to ElasticSearch) and then these rules analyse the event data in the Windows events. For example, a rule that detects DNS activity from internal networks uses ‘PacketBeat’ (and others) to get the event/network data to work out if internal network servers are contacting the internet directly.
GD: check out Elastic beats here. These are the lightweight data pushers that send data to ElasticSearch.
“(Enterprise users) ‘weary’ of unintegrated tooling, restrictive pricing models…”
“Data has gravity” [GD: This is the key concept for Elastic. Imagine Elastic as the data attractor/black hole, where all data ends up and analysis takes place]
Anecdotes
Re/Max, Dow - using enterprise search. ReMax “moved from monthly Elastic cloud to annual subs” [GD: annual cheaper, interesting to consider ramifications for RPO, deferred revenue]
Continue to make investments to help customers orchestrate Elastic deployments.
SwissCom - grown to 40 instances of Elastic Cloud Enterprise “on-demand loggin”.
ElasticCloud on Kubernetes - GA and “driving more adoption”
Board members
Alison Gleeson - From Cisco
Sally Jenkins - CMO (Informatic, VMWare, Symantec)
“see an opportunity to bring in a seasoned go-to-market leader” - Aaron Katz stepping down as CRO.
Finances
| | | |
|:--------------------------|:----------|:-------------------------------------------------------------------------------------------|
| Revenue | $113.2m | +61% yoy CC |
| --- International | 44% | |
| **Subs revenue** | $104.2m | +63% yoy CC (92% of revenue) |
| --- SaaS | $25.1m | +118% yoy CC |
| --- Prof Services | $9m | vs $6,249 yoy [GD: note prof services cost > revenue] |
| Billings | $122.9m | +56% yoy CC |
| Deferred revenue | $209.8m | +52% yoy CC |
| RPO | $426m | +40% [GD: SaaS will constrain this since monthly contracts don't have RPO or deferred rev |
| Av. Contract length | 1.5 years | "slightly shorter than a year ago" |
| Customers | 10500 | +800 q-1 |
| --- Customers > $100k | 570 | +45 q-1 |
| --- NER | >130% | |
| Non-GAAP gross profit | $84.7m | |
| Non-GAAP gross margin | 74.8% | |
| Non-GAAP operating loss | -$20.2m | |
| Non-GAAP operating margin | -17.8% | "Better than expected" - Insignificat FX impact |
| Shares outstanding | 80.7m | |
| Net loss / share | $0.28 | vs $0.16 yoy |
| Operating cash flow | -$23.2m | |
| Free cash flow | -$24.2m | vs -$9.9m yoy - "timing differences - look at FCF annual basis" |
| Cash and equivs | $294.1m | |
| Guidance Q4 | | |
|:----------------------------|:-----------------|:---------|
| Q4 revenue | $119m to $120m | +48% yoy |
| Non-GAAP operating margin | -20.5% to -19.5% | |
| Non-GAAP net loss per share | 0.32 to 0.30 | |
| Shares | 82-83m | |
| | | |
| FY 20 revenue | $423m to $424m | +56% yoy |
| Non-GAAP Operating margin | -20.5% | |
| Non-GAAP net loss/share | -1.13 to 1.12 | |
| Shares | 79m | |
“Executed well according to plan. Yet another strong quarter.”
Q and A
- Federal deals from last quarter - pleased, strong performance across many different fronts. Portion of fed deals did close, many successes more broadly. Remaining deals, Q2 slipped some, a few deals in the pipeline but unpredictable timing, no risk or upside. Q4 seasonally largest quarter.
- Microsoft negative on Corona Virus - exposure to China very small. ROW - very distributed company. “Close attention”
- Congrats. 10% new cloud budgets - logging, monitoring, observability etc. Large percentage? Not familiar with this number. Opportunity in observability bigger than sum of other spaces combined. Data has gravity, ability to deploy our solutions next to the data wherever it lives.
- Anything holding back RPO growth other than contract duration? Whats normal? Primary factor contract duration 1.5 year mark. Can bounce around up or down. RPO billings, less meaningful for us. Manage primarily on ACV. Try not to provide concessions for long-term contracts. No big changes. Quite happy with Q3.
- Percent of contracts < 1 year? Current balance of unearned revenue as expected. Primary piece is monthly saas. Roughly 10% total revenue, growing rapidly. Monthly SaaS includes on-demand usage. Grew at healthy pace consistent with overall SaaS. Hard to predict, customers might move to annual contracts, or other options.
- Endpoint - who are competition? Advantages? Closed in Q2. EndGame - impressed with team. Just GA’d SIEM this quarter. Delivered detection engine. Making significant investment to fold EndPoint into Elastic stack → Vision single tech stack.
Competition - EndGame one of the best Endpoint solutions today. Competition varies, McAffee, Symantec to newer ones like Carbon Black, CrowdStrike and others.
7. Cloud business doing well, 4 Qs of accelerating growth. How is that impacting customer addition? SaaS - Q3 large number of net new customers and significant expansion. Expanded geographically and across hosting. Added more SaaS marketing resources. A lot of net news are ramped on Cloud. Averages can be misleading - some started to a few hundred $$$ now multi-million, some few hundred $$$ still.
8. Observability - having it all in one place. What is customer thinking re: best of breed vs “one platform”? One of the most popular logging solutions for many years. Invested lots in the “single platform” concept. Strong tech stack and single experience triumph. Don’t have different SKUs, which really resonates with customers. Observability > sum of parts (logging, infra, APM) because more [GD: paraphrasing - because observability is really about getting any interesting data into a central space and looking at it, analysing it]
9. Single platform - great for grassroots. But as go upwards, danger of being ahead of the curve? [GD: great question]. Single platform allows us to leverage investment, eg: Drag and drop visuals (Kibana lens) can be used across everything. Don’t want to force org lines to break. eg: Logging vs APM. Encouraged by 2 promising factors - any logging users get exposed to rest of observability, as go up to CIO, CISO, pricing, ease of use, single product resonates.
10. What does new CRO need? Sally as CMO - advantage of someone who has seen scale already. How do we get to multi-billion in revenue, want a CRO like Sally.
11. Security - customer perception - what do you need to do? Spent day at RSA, 2 booths, EndGame and Elastic. Full capacity in every single demo. Excitement from practitioners. Detection engine, SIEM improvements. Meetings with CISOs, CIOs. Buying decisions - which techs? convergence of SIEM and EndPoint, resource based pricing = “Resonates” [GD: Shay’s word of the day… although “resonates” doesn’t equal “buy!”.
12. Beta - Kibana Lens - big step forward. Trying to think about first priciples, how low to implement so can be used across the stack. Lens reaction amazing. Can apply Lens across all data. Other usecases, fraud detection, matching rides on Uber - hard to bucket into the 3 major categories (Enterprise Search, Observability, Security). {REPHRASE} - very focussed on these 3 solutions [GD: but lots of use-cases outside those]
13. 1-year anniversary Amazon OpenDistro - see very little adoption. We’re differentiated through our free but proprietary. Differentiated features increasing exponentially with every release. Vast majority of downloads includes default distribution.
SaaS - driving for proprietary. So features available on our cloud. “best product possible”
- OpExp growth faster than revenue. $400m +. Philosophy about trying to show leverage. Continue to see rich market opportunity. In the near term spending against opportunity. Accelerate hiring in first half. Significant investment with EndGame. Raised outlook every quarter. Managed dilution. Raised op margin outlook for F2020. Continue to invest in a disciplined way. “Good stewards of capital”. Think we need to invest to grow [GD: DBNER +130% makes sense?]
- Enterprise search, competitive displacements? Observability biggest of 3 solutions. But excited about ES, established as a leader. One of the most popular search engines. ES team - how to take it forward? Take product to workplace, connect to all SaaS (Zoom, Slack, Salesforce, ServiceNow …) search across everything. In beta now.
- SaaS - cautioned on modelling on going up to the right. How to think about sustainability? Growing double rate of overall. Couple of dimensions. Significant part of growth because of investments, customer acquisition. Longer term hard to sustain triple digit, will reflect where the data resides and customer growth.
- Corona virus - assumptions built in? no. Guidance reflects all the things we know about the business. Q4 is a large quarter for us.
- Fed Deals - lost any of them, timeframes for remaining? Didn’t lose any competitively. Pleased about Fed, public sector world wide. Several strong security deals in the space. Remaining deals unpredictable - not meaningful in Q4. Just like any other deals.