F5 Networks Is Widening Its Competitive Advantage

| About: F5 Networks, (FFIV)

By Grady Burkett, CFA


F5 Networks (NASDAQ:FFIV) has effectively leveraged its first-mover advantage in server load balancing to build a business that possesses structural competitive advantages, primarily customer switching costs. Its financial performance rivals that of dominant software vendors. F5 generates very high returns on capital thanks to the significant amount of software content embedded in its appliances, its large base of high-margin maintenance service revenue streams, which are recurring in nature, and the relatively small amount of capital needed to run the business. F5's stable and strong market share, increasing customer penetration, and strong services revenue growth also point toward a narrow economic moat. Although we recently upgraded our moat rating to narrow from none and increased our fair value estimate to reflect our more optimistic long-run view of the business, we believe the shares are currently overvalued.

F5 is increasingly viewed as a strategic supplier. Historically, applications typically have resided on a specific server or group of servers and were built to work with a fairly small number of operating systems and computing devices. As smartphones, tablets, thin clients, and server virtualization gained adoption, network traffic patterns became more random and complex network security became increasingly challenging; we believe application developers are now finding it necessary to spend much more time thinking about network security and scalability issues than they did in the past. We expect virtualization and mobile computing to continue to gain adoption over the next several years, and the challenges associated with delivering secure, fast, reliable applications across long distances will grow.

Application scalability and security are issues that developers must now address throughout the software development lifecycle to ensure that their applications can be accessed effectively by potentially hundreds of thousands of users across diverse geographies via myriad devices. We believe we'll increasingly see tighter coordination and collaboration among application developers, server administrators, and network administrators to support the evolving challenges of application deployment. This trend bodes well for F5, as its devices sit in the middle of these three worlds, operating as simple traffic management devices at the network layer while serving as sophisticated application monitoring, optimization, and security devices at the application layer.

F5's top customers have rapidly increased their spending with the firm over the past seven years. As F5 gains mind and wallet share with its customers, it will find its customers more open to considering its adjacent technologies as suitable substitutes to more established vendors' equipment.

Adjacent Opportunities Offer Attractive Returns on Capital

F5 is well positioned to increase its presence in network security. Its deep expertise in application layer traffic management has allowed it to develop competitive network security products such as Web application firewalls and SSL virtual private networks. While traditional network firewalls offered by large firms like Cisco (NASDAQ:CSCO) and Juniper (NYSE:JNPR) provide basic network security by blocking traffic originating from unauthorized IP addresses, F5's Web application firewalls are more sophisticated. A WAF can look inside a data packet to determine whether the data being sent is benign or malicious.

Network security is a moaty business for three reasons. First, users become accustomed to a particular vendor's operating system and configuration tools and are reluctant to learn a new vendor's software. Second, the ever-present threat of a security breach typically makes IT managers less price sensitive when considering security vendors. Third, new and existing threats are constantly evolving, which limits the risk of commodification. Market share is relatively stable among the leading network security vendors.

F5 has a strong and growing position in WAFs and SSL VPNs, as Gartner estimates that 20% of the firm's ADC customers subscribe to its application security module and more than 1 million VPN seats are deployed using F5's technology. Management is now looking to leverage its foothold in application security to expand its presence in the broader network security market.

Given F5's strong reputation as a leader in layer 4-7 networking, its broad channel reach, and its increasing footprint within its customers' environments, we think the firm is well positioned to generate enough revenue from its network security tools to have a material impact on future revenue growth. Although barriers to entry are high, the sheer size of the network security market provides plenty of room for F5 to expand its security business without necessarily inciting strong competitive responses from the established vendors.

Traditional fixed-line and mobile carriers, cable companies, and Internet service providers are steadily converging their networks toward IP as they look to cost-effectively manage the rapid growth in data traffic due to mobile and cloud computing, Internet video, and other data-intensive applications.

At the same time, service providers, as well as Internet firms and large software firms like Google (NASDAQ:GOOG) and Microsoft (NASDAQ:MSFT) are looking to become larger players in cloud services by offering productivity applications, voice, video chat, instant messaging, and other services to consumers and businesses via the Internet. The data created by these services may initiate in or traverse private data centers that are hosted by the Internet firm delivering the services, but the data will eventually traverse IP-routed Internet backbones that are maintained by large service providers.

F5's ADCs and adjacent products give service providers and Internet firms effective tools to manage the growing complexity and security issues associated with data traffic growth. ADCs can be used to optimize traffic loads within data centers, secure applications and network segments from malicious attacks, provide granular visibility into network usage, and facilitate data center disaster recovery.

Still, we believe F5 may be nearing saturation with its Internet business, which has seen three sequential quarters of revenue declines. On the other hand, the service provider segment has fared relatively well over the past three quarters despite recent weakness in North American carrier capital spending. F5 recently demonstrated its continued commitment to the service provider segment by acquiring Traffix Systems, a software firm that specializes in providing optimization and networking tools that support the diameter protocol, which is primarily used in service provider environments.

We believe service providers are particularly finicky in vendor selection, and we think F5's historical success in this segment and continued investment in advanced technologies that support service providers bode well for the firm's long-run competitive position in the telecom equipment market.

F5 will face fierce competition from entrenched, well-capitalized incumbents as it pursues this market segment, and it is still too early to determine how successful the firm will be in its efforts to expand its footprint in service providers' networks. However, it is clear that the company is aggressively pursuing this large addressable market. Its expertise in application delivery controllers and Web security positions F5 to benefit from key long-term trends that are affecting service providers, including network convergence, mobile computing, and software applications delivered over the Internet.

F5 Is Essentially a Software Company

F5's products, services, and business model support industry-leading returns on invested capital. F5's core products are its application delivery controllers. ADCs can perform a variety of tasks related to delivering and securing software applications, but their core function is server load balancing. This process distributes traffic load more evenly across Web servers to ensure that the end user receives the best experience possible when visiting a website or using a software application.

F5's ADCs can also perform extremely complex tasks such as application health monitoring, data traffic management, Web application security, protocol optimization, and data center load balancing. They are widely recognized as being the most flexible, reliable, and capable in the industry, and F5 is currently the runaway leader in ADCs.

The firm installs its proprietary operating system, iRules extensible scripting language, and additional software modules onto hardware appliances composed of off-the-shelf components assembled by third-party contract manufacturers. F5 relies heavily on value-added resellers to distribute its appliances, while nearly 40% of revenue is derived from services that provide for software upgrades, hardware maintenance, and technical support.

A large portion of F5's expenses, such as software development, marketing, and channel support, can be leveraged, and the firm requires very little physical capital to support revenue growth. As a result, its returns on invested capital have expanded as revenue has grown over the past three years, and they are now among the highest in the data networking industry.

While F5 sells a broad array of hardware appliances and chassis/blade systems to accommodate different customers' IT environments and resources, all of its hardware runs its common operating system and supports its scripting language, iRules. Additionally, the firm sells software modules that run on its hardware platform to perform a variety of security and traffic optimization functions such as application security, secure sockets layer offload, and Web acceleration. As a result of the significant amount of software content embedded in its systems, the firm typically generates product gross margins around 80%. Although we expect competitive forces to put modest pressure on gross margins over time, we think F5 can continue to add software features to its platform to partially offset competition-based product gross margin pressure.

Additionally, F5's customers typically purchase high-margin services contracts that allow for software upgrades, patches, hardware maintenance, and technical support. Services have become an increasingly large portion of revenue over the past several quarters, which suggests to us that F5 is deepening its relationships with its current customers. F5 just recently reached scale, and its operating margins recently surpassed 30%. Given the firm's strong competitive position and growing revenue base, we expect operating margins to average roughly 30% over the course of the current business cycle.

As F5 has introduced more software features and deepened its penetration within its customer base, it has been able to build a strong services business. The firm's services include recurring items such as software upgrades, SSL VPN licensing, hardware maintenance, and ongoing technical support, as well as professional services such as network management, performance analysis, and capacity planning. Services are typically purchased as one- or multi-year contracts that provide the firm with a stream of high-margin recurring revenue.

F5's traditional services are complemented by the firm's user community portal, DevCentral, which provides customers access to a large database of custom configuration and scripting templates, best-practice guides, and real-time communications with the firm's large and growing customer base. We believe DevCentral creates a modest network effect for F5 and it would be difficult for a competitor to replicate the large and growing library of custom configuration and scripting templates available through this closed community.

F5's services business grew much faster than product revenue from 2004 through 2011 and now accounts for nearly 40% of revenue. We expect service revenue to grow slightly faster than product revenue over the next five years, as F5 continues to introduce new software modules for its appliances and expands its professional services business.

F5 Has Shifted Its Revenue Model Increasingly Toward Services


Click to enlarge
Source: Company filings, Morningstar.

Customer Switching Costs Are the Source of F5's Moat

F5 expends significant time and resources to provide configuration templates and best-practice guides that are specific to a particular software application deployment. These guides provide instructions for the entire ADC deployment process, which includes setting up application health monitors, establishing server pools, configuring optimal traffic management, and establishing appropriate security settings. F5 updates these guides at frequent intervals to support new software versions released by F5, the third-party software vendor, or both. In our view, customers who use these guides and other deployment services offered by F5 to configure, deploy, and manage its ADCs in support of a particular application will be reluctant to change vendors for future new deployments or capacity expansions.

Most large-scale deployments require additional customization to optimize application performance, and F5's iRules allows customers to develop traffic management scripts that best support their specific environments. Once a customer has created a library of scripts that is optimized for its particular organization, we think it is unlikely to change vendors and lose that built-up knowledge. F5's ability to maintain fairly stable market share near 50%, despite Cisco's ongoing efforts in this segment and Citrix's (NASDAQ:CTXS) strong product suite, supports our view. F5's market dominance creates a virtuous cycle, as the firm can economically invest more dollars in product development, channel support, and professional technical services than its competitors, which in turn allows it to provide its customers and resellers with a more compelling product and service than smaller or less-focused competitors.

F5 is increasingly viewed as a strategic supplier. Historically, applications typically have resided on a specific server or group of servers and were built to work with a fairly small number of operating systems and computing devices. As smartphones, tablets, thin clients, and server virtualization gained adoption, network traffic patterns became more random and complex network security became increasingly challenging; we believe application developers are now finding it necessary to spend much more time thinking about network security and scalability issues than they did in the past. We expect virtualization and mobile computing to continue to gain adoption over the next several years, and the challenges associated with delivering secure, fast, reliable applications across long distances will grow.

Application scalability and security are issues that developers must now address throughout the software development lifecycle to ensure that their applications can be accessed effectively by potentially hundreds of thousands of users across diverse geographies via myriad devices. We believe we'll increasingly see tighter coordination and collaboration among application developers, server administrators, and network administrators to support the evolving challenges of application deployment. This trend bodes well for F5, as its devices sit in the middle of these three worlds, operating as simple traffic management devices at the network layer while serving as sophisticated application monitoring, optimization, and security devices at the application layer.

F5's top customers have rapidly increased their spending with the firm over the past seven years. As F5 gains mind and wallet share with its customers, it will find its customers more open to considering its adjacent technologies as suitable substitutes to more established vendors' equipment.