Q2 2024 ZeroFox Holdings Inc Earnings Call

Participants

James C. Foster; Chairman & CEO; ZeroFox Holdings, Inc.

Timothy S. Bender; CFO; ZeroFox Holdings, Inc.

Todd Weller

Brad Robert Reback; MD & Senior Equity Research Analyst; Stifel, Nicolaus & Company, Incorporated, Research Division

Jonathan Blake Ruykhaver; Senior Research Analyst; Cantor Fitzgerald & Co., Research Division

Joseph Anthony Gallo; Equity Associate; Jefferies LLC, Research Division

Yi Fu Lee; Research Associate; Cantor Fitzgerald & Co., Research Division

Presentation

Operator

Thank you for standing by, and welcome to the ZeroFox Fiscal Second Quarter 2024 Results Conference Call. (Operator Instructions). As a reminder, today's call is being recorded. I would like to turn the conference call over to Todd Weller, Vice President of Investor Relations for ZeroFox.

Todd Weller

Thanks, operator. Good morning, and thank you for joining us today to review ZeroFox's fiscal Second Quarter 2024 financial results. With me on the call today are Foster, our Founder, Chief Executive Officer and Chairman; and Tim Bender, our CFO. By now, everyone should have access to our earnings press release. This press release as well as supplemental financial information can be found on our Investor Relations website.
During this call, we may make forward-looking statements, including statements related to our anticipated financial results, growth opportunities in external cybersecurity, our progress to achieving profitability and expected benefits from our acquisitions of IDX and LookingGlass. These statements are not guarantees of future performance, but rather are subject to a variety of risks and uncertainties. Actual results could differ materially from expectations reflected in any forward-looking statements. Please review our earnings press release and recent SEC filings, description of these material risks and uncertainties.
Forward-looking statements made today speak only to our expectations as of today. and we undertake no obligation to publicly update or revise them. Additionally, non-GAAP financial measures will be discussed on this conference call. Please refer to the tables in our earnings release and the Investor Relations portion of our website for a reconciliation of these measures to their most directly comparable GAAP financial measure. With that, I'd like to turn the call over to our CEO, Foster.

James C. Foster

Thanks, Todd. Good morning, everyone. Last month marked our 1-year anniversary as a public company and Q2 was another record quarter for ZeroFox, where we achieved several major milestones. We delivered strong revenue growth, record ARR, recognized an acceleration on our large customer adoption and generated positive free cash flow for the first time.
Furthermore, we announced that we beat our guidance, and we'll raise expectations for the second half of the year. Our ability to consistently deliver results is a direct reflection of our team's discipline, our relentless focus on the customer and our platform's ability to scale with the ever-growing external cybersecurity challenge.
I'm going to provide summaries on a few key areas of our performance and continuing progress on our vision. First, I'll review highlights from our Q2 results and the continued demand we see for our external cybersecurity platform. Then I'll spend a few minutes walking you through our growth model. And finally, I'll share key areas of focus for the second half of the year.
In Q2, we reported solid results across both top and bottom line metrics. We reported core revenue of $42 million, an increase of 78% year-over-year. We ended the quarter with ARR of $182 million, an increase of 22% year-over-year, and we saw continued momentum in large enterprise wins with a 35% year-over-year growth in subscription customers with ARR greater than $100,000.
The Q2 demand environment from both new and existing customers was consistent with prior quarters, except for 1 exception. We experienced stronger than forecasted demand for our new on-demand response capabilities, which was reflected in our services revenue outperformance. We believe this was driven in part by recent surge and move-in attacks, which have impacted hundreds of organizations to date, and that number is still growing.
Customers recognize us as an authoritative organization to help with external cyberattacks and these adversary campaigns are providing us with opportunities to highlight our platform's strengths. We helped one of our customers manage such an incident where over 10 million records were stolen in a brazen ransomware attack. We are operating at a scale that is far beyond most organizations in the cybersecurity industry. According to Mandiant's website, they conduct over 900 incident response engagements each year on behalf of their customers. Today, we have over 1,100 active response engagements with customers.
Our brand recognition, customer trust and proven execution, including our ability to deliver a large on-demand complex programs were factors in why enterprise customer deal size is accelerating.
Additionally, demand for our platform-based approach remains strong as more organizations look for continuous visibility into their external attack surface, intelligence on external threats and the ability to protect, disrupt and respond to those threats. The modern security Triple Crown includes endpoint security platforms like CrowdStrike, SentinelOne or Trellix combined with a robust perimeter provider like Palo Alto Networks, Zscaler or even Akamai and an external platform like ZeroFox. Nearly all of our customers have some sort of internal perimeter and external security combination protecting their organizations.
Simply said, our platform and positioning is increasingly resonating with our customers as they look to consolidate their security stacks with a few proven leaders.
Now I'd like to spend a few minutes taking a closer look at an area within our go-to-market model on how we land and expand within customer organizations. Typically, when customers engage with ZeroFox, they are looking to solve specific external cybersecurity problems or use cases. And this is especially true for reactive customers where there have been incidents in the recent past. Examples of common use cases for ZeroFox include protecting an organization's digital footprint with phishing, impersonation, or account takeovers, monitoring the dark web for compromised credentials, data leakage or early warning signs of an attack or leveraging threat intelligence data and experts to improve threat prevention, detection and response efforts.
ZeroFox addresses these use cases and more through a single unified platform. Our platform capabilities span 4 strategic pillars, including Protection, Intelligence, Disruption and Response and each of these pillars include multiple modules that are available for purchase.
Examples of our modules include brand protection and domain protection, intelligence search, takedowns and PI removal, digital [populous] protection and on-demand notifications. When customers purchase our platform, there are 2 primary factors that drive deal scope and size. The first is the number of digital assets they protect and the second is the number of modules they can purchase to protect those assets.
In new deals, it is increasingly common for customers to protect multiple assets and purchase multiple modules. For example, in Q2, the average number of modules purchased in new deals was just over 3. And while new deals frequently include multiple assets, the assets being protected typically only represent a small portion of their total digital assets. This white space provides us with future expansion opportunities.
In addition to increasing asset volumes, we also have the ability to cross-sell and upsell our customers additional modules. For customers that have found ZeroFox reactively or because they have experienced a security incident, we typically land with 1 or 2 modules within our Response pillar first as they become introduced to the organization.
To put this in perspective, let's walk through a couple of our Q2 deals. The first is a 6-figure new customer win with a Fortune 500 company that included several operating lines of business. This customer chose ZeroFox protect 40 brands 10,000-plus domains and hundreds of additional digital assets. The customer initially purchased 9 modules, including brand, domain, intelligent search, data feeds, takedowns and more. This is a big win for ZeroFox.
We also had another 6-figure new customer win with a Fortune 500 software company. This customer is also protecting their global footprint, and they purchased 8 modules out of the gate. This customer selected ZeroFox to consolidate several of their other external threat intelligence and digital risk protection services point solutions, validating our platform approach.
Due in part to the proliferation of ransomware campaigns, Q2, we saw a record number of large deals for our on-demand response services. This included 2 multi 7-figure deals with Fortune 1000 companies and a 7-figure deal with a new public sector customer.
Shifting gears, I'd like to focus on our goals for the second half of the year. We will continue to execute on our strategic plan to expand our platform capabilities, grow our customer base and increase adoption. And we will accomplish this while also further progressing on our path to profitability.
From a platform perspective, while we continuously innovate, there are 2 specific areas I'm going to highlight. Over the last quarter, we made significant progress completing the integration of LookingGlass and finalizing our plans for combining the prospective platform capabilities. We also launched a new free threat intelligence service that we call our daily intelligence brief and have seen some very nice pickup this summer.
The second area, and I'm sure you guessed it, is artificial intelligence. As I mentioned last quarter, we have nearly a decade of experience implementing various AI capabilities into our platform. As a reminder, we have over 54 patents issued in our name today, and our innovation program is mature. As adversaries increasingly leverage AI to automate the development of sophisticated attacks, we will continue to evolve the use of our AI to ensure that we can protect our customers. For ZeroFox, this is table stakes.
For example, spear phishing attacks via external platforms like social media and chat platforms are becoming exponentially better, and the success rates are rapidly increasing. Attackers that have English as a second language, for example, can now use ChatGPT to perfect a targeted attack against an individual. The days of receiving a poorly worded e-mail from a prince asking you to hold a $1 million for them are long gone.
Recent advancements in generative AI and large language models are creating new opportunities for us to increase value by more broadly infusing AI in a different manner across our platform. And we're going to leverage these large language models to provide more contextualized intelligence for our customers, making it easier for them to better assess and understand risk and threats.
Our customers will continue to receive the benefit of our innovation program in the quarters like they have over the past several years. While we continue to see a significant growth opportunity in front of us, we also understand the importance of balancing growth with profitability. We were very pleased with our Q2 cash flow performance and we'll continue to drive additional efficiency and leverage into the business in the coming quarters.
As Tim will discuss in more detail, we continue to expect that we'll be at or near breakeven in the second half of this year. With that, I want to thank all of our Foxes for their energy, passion and commitment as we continue to protect our customers around the world. Q2 was a record quarter for ZeroFox, and we are moving as fast as we ever have. I'd like to turn the call over to our CFO, Tim Bender.

Timothy S. Bender

Thanks, Foster. As Foster mentioned, ZeroFox generated strong Q2 results across both top and bottom line metrics. With the exception of revenue and unless otherwise stated, all financial results we will discuss today are non-GAAP financial measures. Reconciliations between our GAAP and non-GAAP results can be found in our earnings release.
For Q2, ZeroFox reported revenue of $62.2 million, an increase of 42% year-over-year. Subscription revenue was $23.2 million, including $4.8 million from LookingGlass. Services revenue was $39 million, consisting of $20.7 million of recurring revenue from our strategic government customer and $18.3 million from our on-demand response services. While we expected an improved revenue performance in our services revenue for Q2, our success in capturing large deals with Fortune 500 customers was even stronger than anticipated.
Given our Q2 bookings performance, we expect continued strength in services revenue in Q3. Our services business continues to be less predictable when compared to our subscription business. As we look beyond Q3, we would expect services revenue to return to a more normalized historical level. Given the potential for short-term volatility, we would encourage investors to look at the performance of our services business on an annualized basis to assess our performance and growth potential.
As of July 31, annual recurring revenue was $182 million. ARR consists of platform subscriptions, a small amount of recurring on-demand services and $83 million from our strategic government contract. We ended the quarter with a record high 1,304 subscription customers. As Foster mentioned, in Q2, we saw continued success winning larger deals. We ended Q2 with 175 customers with ARR greater than $100,000. And which represented an increase of 35% year-over-year.
Turning to gross margin. For the second quarter, subscription gross margin was 72%, consistent with Q1 and for Q3, we expect subscription gross margin to be consistent with Q2 levels. Services gross margin was 18% compared to 24% in Q1. As we indicated on last quarter's call, we expected this margin to decline from Q1 due to a higher mix of notification services attributable to our Fortune 500 response engagements. The Q2 sequential decline was driven by an even higher-than-expected mix of large deals. Given the continued impact from large deals in Q3, we would expect services gross margin to be relatively consistent with Q2 levels, before returning to more normalized levels.
Total gross margin was 38% compared to 43% last quarter. The decline in gross margin was driven by the decrease in services gross margin and the higher mix of services revenue. As we look to Q3, we would expect gross margin to be consistent with Q2 levels with margin improving in subsequent quarters. We continue to see opportunities to improve our overall gross margin as we scale our business and our higher-margin subscription revenue becomes a greater portion of our overall revenue mix.
Turning to operating expenses. Total operating expenses were $28.6 million in the quarter. The increase in expenses versus last quarter was driven by continued investments in research and development, including expenses from our acquisition of LookingGlass. G&A expense declined sequentially as we did not incur professional fees for the annual audit, residual leaseback filing requirements and transaction costs in Q2. Our loss from operations was $4.8 million.
Looking at the balance sheet and cash flow. We ended the quarter with $29 million in cash, $36 million in accounts receivable, $67 million in total deferred revenue and $191 million in total outstanding debt. In Q2, we generated cash flow from operations of $600,000 and free cash flow of approximately $400,000. As expected, our Q2 cash flow performance was positively impacted by the timing of collections from our larger customers and lower professional fees and transaction costs.
Now to our outlook. Our outlook assumes no material changes in the macro environment, Demand for our external cybersecurity platform remains consistent and it anticipates continued near-term strength within our on-demand services business. For Q3 fiscal year '24, we currently expect revenue to be in the range of $55 million to $57 million and non-GAAP loss from operations to be in the range of $6.2 million to $5.4 million. For fiscal year '24, we currently expect revenue to be in the range of $214 million to $217 million and non-GAAP loss from operations to be in the range of $27 million to $25 million.
We continue to focus on profitability. Consistent with what we said last quarter, we expect free cash flow for the remainder of the fiscal year to be at or near breakeven. On a quarterly basis, our cash flow will be impacted by the timing of collections from our large customers. And therefore, we expect cash flow to be negative in Q3, followed by an offsetting positive amount in Q4. We continue to expect that we will achieve quarterly free cash flow on a sustained basis in the second half of fiscal year '25. With that, we'd like to take your questions. Operator?

Question and Answer Session

Operator

(Operator Instructions) Our first question comes from Joseph Gallo with Jefferies.

Joseph Anthony Gallo

Congrats on the strong results. Guidance for the year looks like it flows through a little bit more revenue than your 2Q beat. What are you seeing in the market or macro-wise that kind of lends confidence towards doing that?

James C. Foster

Joe, thanks for the question. I think we had a stronger than forecasted result in Q2, which we acknowledge and which we announced this morning. And I think what we're seeing here is maybe a slight easing of some of the macro pressures we saw in the beginning part of the year and continued demand for our platform.

Joseph Anthony Gallo

Awesome. And then, Tim, congrats on the free cash flow, profitability. How should we think about your profitability versus investments for growth or even acquisitions, and then ultimately, kind of combine that with how investors should think about your debt, the maturity or time line of that debt and how those repayments eventually play out?

James C. Foster

Thanks for a good question. Well, we acquired LookingGlass just a little over a quarter ago. I think we've got plenty of opportunity to continue to sell into our customer base and realize some upside there in the coming quarters from the expanded platform. So I don't think about our current cash position, our balance sheet strength as being leveraged for acquisitions in the very near term. Although I would say, in general, we have proven to be an acquisitive company acquiring 4 companies in the last 4 years.
I think maybe to go back to your other point on profitability, I think we said that we would be at or near breakeven for the rest of the year. So yes, we hit cash flow positive in Q2, and we see the opportunity to remain kind of right around cash flow positive for the next 2 quarters. And then we've also put that we'd be cash flow positive on a sustained basis next summer as well. So I think, all in all, we were doing all the things we said we were going to do on the cash flow front. And I think that balanced approach to growth and getting leverage back into our model is the right thing for the business.

Timothy S. Bender

Yes. And Joe, It's Tim, just to kind of clarify on the 1 question. We don't have to do anything different in our business model as far as our investments for growth, that's built into our cash flow assumptions. So we're going to continue to invest in sales and marketing in our go-to-market efforts to drive growth, and we think we can do that and manage our operating expenses to deliver the cash flow Foster just mentioned.
As it relates to the debt, the large convertible note is out about 2 years from today, August 2025 is the due date for that. We'll likely continue the same path that we're doing right now as far as the way we're treating the interest via the pick. And listen, we're looking -- as our performance continues to strengthen, we'll have conversations around how we want to deal with that as we get further down the road. But right now, 2025, August is when that matures.

Operator

Our next question comes from Brad Reback with Stifel.

Brad Robert Reback

A couple of quick ones. The on-demand response business, can you give us a sense of what the profitability on a gross margin perspective looks like there?

Timothy S. Bender

Sure. Thanks, Brad. This is Tim. Historically, we've seen the margins in kind of the mid-20s. This quarter was a little bit lower as we saw some very large deals. We had a couple of deals that were materially or substantively larger than what we've seen in the past or what we used to define as a large deal. We had 2 deals that were much larger and those compressed margins. So I think as we get back into what would be, what we call more normalized deal sizes, we would see those margins start working their way back up. But as we said in Q2 with the beat in the revenue and the large deals that had compression.

James C. Foster

I will double on 1 thing for you, Brad. I mean we saw some really interesting growth in our 6-figure ARR customers that were north of $100,000, which is actually an accelerant over Q1, right? And so I think when large customers call you to help out in their time of need, we're finding that as kind of an early indicator of trust. And that trust we think will continue to lead to larger ongoing relationships with those customers as well. So we like that business, and we like the fact that we are one of the few trusted providers to get those calls in their time of need.

Brad Robert Reback

That's great. And going back to the debt position, it'd be accurate to say that you have to address that before August of '24, right, before the convert becomes current?

Timothy S. Bender

I think that's a fair assessment. I mean, you don't have to, but I think it's the best interest of all parties that we do that, and we're -- that's something we're actively looking at. I think we have plenty of options there, too.

Brad Robert Reback

You do think you'll have plenty of options?

James C. Foster

I think this is a really tough debt market, Brad, in general. I mean if you look at the macro, I think anybody would say it'd be foolish to say anything, but that -- we've seen some of the highest interest rates that are out there. But I think as long as we continue to perform, we'll have options prior to next August. Yes.

Operator

Our next question comes from Yi Fu Lee with Cantor Fitzgerald.

Yi Fu Lee

Congrats on another strong consistent execution quarter and great upside on the free cash flow positive about 1 year ahead of schedule. Two quick ones for Foster and one quick one for Tim. So Foster, you talked about the [Fox] principle at the beginning of this fiscal year, standing full focused, after migration on the platform and expect in cross-selling. And obviously, we've seen that at play this quarter. I was wondering, like because we hit the half year mark already, if you were to judge on the execution of ZeroFox so far this year, what are some of the things that you think is beyond your expectation and things that ZeroFox needs to focus on going forward?

James C. Foster

I think the will power and fortitude of our employees has just been unbelievable year-to-date. This is not an easy time to be an employee, particularly at a tech company, going through changes and back to offices and the types of things that are happening in kind of the overall economic situation that we're in around the world. And so I'm really proud of what our Foxes have been able to do here.
I mean when I think about the O in Fox scene and that O in optimization is really just making everything that we do here at ZeroFox better on behalf of our customers. I mean that's our North Star that is what we talk about as a company. And I think the Q2 results show that we are getting better and stronger as a company, and it's because of the effort of our employees.

Yi Fu Lee

To follow up on that, on the growth opportunities, right, obviously, you guys have done a lot of stuff, right? You announced GenAI, deploying these enhancements to bridge response platform to monitor dark web, your Google cloud partnership about 2 quarters ago, LookingGlass integration, it sounds like it's looking good. How would you rank these opportunities like the most impactful upside in the near-term versus in the long-term, what do you think is the most (inaudible) in the near-term versus long term of all these opportunities or other opportunities I might have missed?

James C. Foster

We appreciate the contextual question. Maybe I will answer slightly differently. One of the things you heard in our earnings call today is kind of maybe a renewed focus or a first time disclosed focused around our modules, and we said that in general, new customers that signed up with ZeroFox in Q2 averaged about 3 modules. And then we spend a little bit of time talking about a couple of customer purchases that had 8 or 9 modules. So I think there's a really interesting opportunity for us, continue to make sure that our customers adopt the full breadth and capability set of our platform, and we'll spend time there in the second half of this year, really making sure that customers adopt the platform because ultimately, we fundamentally believe and we've got the metrics to back it up that when you adopt more of our platform, you are better protected and the results are improved.

Yi Fu Lee

Okay. And then the last one is for Tim. Although, on the financial side, obviously, you guys reached free cash flow positive about a year ahead of my schedule. In terms of like the puts and takes to make this sustainable, what are they like? Like can you give us -- is it better cash collection? What's driving this upside we're seeing about a year earlier than expected. And for fiscal '25, it did you little kicks in that like fiscal second half you are free cash flow positive, but first half is more on the negative side.

Timothy S. Bender

Listen, I think the basic answer is not so -- maybe exactly. It's just really the model is working as we scale. Certainly, acquisition of LookingGlass has helped as we picked up some solid revenue with that. But I think it's really a scale factor as you start to see our ARR is right about $100 million and we'll cross that in Q3. So it's model scale in that regard. And then I think as far as '25, you're spot on. We do think, and you see in our script, and that there is maybe a little bit of volatility in our working capital throughout the rest of this year. But once we get into the second half of the year, I think some of the timing of working capital between our ARR collections mitigates and we're into a steady free cash flow position.

Operator

Our next question comes from Jonathan Ruykhaver with Cantor Fitzgerald.

Jonathan Blake Ruykhaver

Yes, thank you. So Foster, those deals that you cited with 8 to 9 modules out of the gate, were those deals that had been in the pipe for 6 to 9 months or so? Or were they more reactive responses to a breach of an external nature? And maybe broadly, you can just talk about how you think these external issues could impact sales cycles looking out through the fiscal year?

James C. Foster

Yes, I heard a couple of things. So Jonathan, a couple of examples I gave, what I call broad adoption of the platform, multiple pillars, multiple modules per pillar and what I call long-term relationship, right? Not a near-term reactive response only for those 8 or 9 modules. Like in general, we've got about a few modules per pillar of our platform. So when I look at customers that are adopting 6, 7, 8, 9 modules, that tells me right off the bat that they've adopted the platform, right? They've adopted multiple pillars. They understand the consolidated vision and approach that we have and they've gone all in on ZeroFox.
When I see a customer in general that's bought 1 or 2 modules, that means 1 or 2 things quickly. It means that they've got a particular use case that's causing them some pain and they want to alleviate that pain as fast as possible. That could be because they've had an incident. That's because they maybe had an issue inside. Maybe they wanted to replace a niche provider, but there's opportunity for us to then sell the platform vision and maybe earn our seat at the table when someone starts off with just a couple of modules before they move into a full platform.
So that's -- maybe that answers part of the question. I heard kind of how we're thinking about the growth in the second half of the year. I think it's what (inaudible) I mean we're seeing an adoption acceleration for large 6-figure ARR customers. And I think that just proves that our -- the problems that we're working on continues to grow. I'm a firm believer in cyber. If your ASP is going up and your adoption and your large customers is going up, you're working on a problem that matters. And I'll tell you, external cyber matters.
Every [CECO] continues to be worried about getting attacked halfway around the world by nation state actors by cybercriminal groups, they're less worried about an insider threat issue. I remember, 15 years ago, that was kind of top worry, that's not the number 1 worry any more. And external attack is what's keeping these guys up at night, and we think we're in the right place at the right time.

Jonathan Blake Ruykhaver

Yes, it sounds like what you're saying is the demand trends are pretty strong across the entire platform. And so I guess, along those lines, how do you -- how do you see the sales organization equipped to sell across Protection, Intelligence, Disruption? Are they fully up to speed on handling each one of those pillars? Or is there work that you need to do there to kind of drive that execution of a more platform sale?

James C. Foster

I don't think we've ever done, Jonathan. I mean I'm a believer in consistent training and consistent enablement. I mean, the analogy here we used some of the best athletes or the best performers of all time, still train daily. And so even if you reach the peak and what you do, you're the best [court of act] to ever play, you're the best that ever play your sport in Tennis, you still practice daily to get better. And I think our team on our go-to-market side of the house, we think is best-in-class for our space, but that's because we're relentlessly focused on continuing to improve them.
I would say, though, our efforts in the channel always lag our internal sales team. So there is certainly more we can do there. We're still the baby on the block, right? We're still the smallest cyber company out there. We're still the last one to go public. And so we don't have the footprint of some of the other peers that we have out there, that's envious to us right now. And so we've got to continue to build brand awareness and our channel -- continue to enable the channel and make sure they understand our differentiated platform and approach.

Jonathan Blake Ruykhaver

Makes a ton of sense.

Operator

There are no further questions at this time. I'd like to turn the call back over to Foster for any closing remarks.

James C. Foster

Thank you, operator. And as you can tell, we had a record Q2. We remain excited about the opportunities in front of us for the second half of the year. So again, thank you for joining us on the call this morning, and have a wonderful Wednesday. Cheers.

Operator

Thank you for your participation. This does conclude the program, and you may now disconnect. Everyone, have a great day.