Elaborated email filtering is really what is done by Proofpoint (NASDAQ:PFPT). Coat it with the best bearnaise, throw in some truffles and it is still email filtering, highly elaborated. OK - no one really thinks that solving the problems of email is one equivalent to solving the problems of age. That is no one except current investors who are willing to value the shares at levels that seem beyond the prospects of the domain in which this company competes.
Of course, after Sunday night's debate, one has to wonder about what is really important. Certainly not the future. Maybe it might be the amount of pure nastiness and insolence that can be compressed into a short time frame. Maybe it is seeing who has the worst locker room stories to share. Political satire is not my thing as I am not politically correct. I would doubtless offend half of the potential readers here or elsewhere if I answered some of those so-called town hall questions and others of the readership community might describe my views as those of a wimp.
But this is an article about Proofpoint, the company, and the prospects for its shares. I was just struck that a company whose basic technology is that of an email filter has become such a significant enterprise software player. I really wouldn't have thought that would happen and I never thought something like that debate might happen either.
In taking a deeper look at what it means to sell email security solutions in this era, I was struck by some of the features and capabilities that users are seeking. Proofpoint does have a surprising level of product differentiation and perhaps a functioning product moat of some kind. But after considering the subject and reading further, my conclusion is that while the next several quarters are likely to be strong for the company, there are too many shoals and aquatic monsters for the captain to get to his $1 billion sales port. Yes, the shares can be traded to the upside in the short term although not by me at this valuation, but there are other names that have a better combination of risk and rewards.
During my residence in Texas, I was told in some seriousness that I was a moderate - a bad thing to be in the Memorial neighborhood on Houston's west side where I lived and even worse in Sugarland where I worked. As a Yankee interloper, I was told I ought to be ashamed of myself for not shooting Democrats out of season - that was surely a joke - I think. I confess, I have never shot a Democrat out of season and pledge never to do so. I have actually never shot a Democrat in season either and some of my best friends are Democrats - I think.
And of course I never even owned a firearm or any other weapon for that matter which is not considered to be quite respectable on the west side of Houston. But then again, even living in Texas for almost a dozen years, I managed to make do without a pick-up or a pair of boots - cowboy or any other kind. I did go to crayfish festivals and swilled JAX beer to the everlasting protest of my palate and I went to a honky tonk or two. But Houston is a more polyglot place than many northerners imagine and the cultural dissonance is less than might be anticipated.
What does any of that to do with the outlook for Proofpoint shares which is the subject of this article? Not much, really. The connection I might draw, and a tenuous one at that, is that I never anticipated that either email security could be the stuff with which to build a large enterprise software vendor or that the litany of the subjects discussed Sunday evening would be considered to be important subjects.
I confess that I have had a predisposition to think Proofpoint shares were overvalued. I can't quite support that contention after doing a deep dive into the matter. The company has had some luck, it has executed very well and it has made some wise choices. In addition, the company came up in a report I mentioned in a prior article regarding job postings.
As I wrote in that prior report, job postings are well perhaps sign-posts and nothing more, but they can be interesting signposts. As readers will see, this company has set itself a pair of very ambitious targets. It is worth noting that growing at 30%-plus for the next four years which is currently the corporate aspirational goal can be very difficult to accomplish if hiring is too constrained. And maybe this is a sign that hiring will not be all that constrained. Read further to see the details.
But that doesn't necessarily make it a superior investment. At this point, and with this valuation I think upside headroom is limited while the downside may not be huge because of numerous tailwinds. My recommendation to readers is that they find a different way to glory at this point. At some point, the shares may stumble or there may be a set of assumptions that causes the shares to compress in terms of volume and to suffer from execution issues.
That would be a far better entry pointy than currently exists. At some point as well, issues such as pricing, competition and the loss of current technology moats may become visible. But that hasn't happened yet and it would be conjuring to pretend that there is a sight of happening at this point.
The shares currently have ratings consisting of 10 strong buys and 15 buys out of 27 published opinions. That doesn't leave much of a margin for error and not having a great margin for error makes it hard to see where the positive alpha might come from. The current $84 consensus price target is going to need top line substantiation at levels probably greater than those embodied in the consensus.
In fact, a few years ago, I would never have thought that there would be much of an independent solution set for email security or that one of the hotter companies in the enterprise software space would be a provider of email security solutions. Not my proudest assumption. I kept thinking that the requisite functionality would be built in as part of office type suites such as Microsoft (NASDAQ:MSFT) 365. I'm still waiting.
Apparently after all these years and all of this expense in terms of losses to cyber criminals and the expenses of buying and managing protective technology, keeping one's email safe and secure from spammers, phishers and spoofers remains a serious problem. With compliance mandates multiplying, with end-points increasing at rates equivalent to the natural increase of a pair of rabbits of breeding age, with social platforms proliferating and with advanced threats compounding, saving the world from cyber intrusion remains like the common cold - there is no completely effective cure.
A little tongue in cheek. Perhaps. But the shrillness of claims made for this space make it seem as though the cyber criminals are about to overrun email servers and bring down the universe. Of course, the old saying that even paranoids have enemies is particularly pertinent. Earlier this year, Seagate (NASDAQ:STX) and Snapchat sent out thousands of W-2 forms that were precipitated by phishing and spoofing attacks. What's worse, the attacks were apparently successful in whole or in part before they were stopped
Protecting email is really not cutting edge technology although to read some claims it is allegedly changing the universe - or is that just the threat universe? The idea that Proofpoint and its sometime competitor Mimecast (NASDAQ:MIME) are the only companies with anti-spoofing solutions is surprising, but so it is. Proofpoint and others in this space talk endlessly about Targeted Account Prevention (TAP).
Again, I might have thought that this was a function that turns out to be quite such a differentiator - but again, there it is. Before readers dismiss the company, they have to at least try to understand what it does and why it is a differentiator. TAP is this company's secret sauce and its DNA. If it works, the future the CEO Gary Steele forecasts is one that can be possibly achieved. On the other hand, his recent sales of shares may be an acknowledgement that the aspirational goal is a bit over the rainbow.
About one year ago, Intel's (NASDAQ:INTC) McAfee Security announced that it was putting its email security solutions into end of life status. McAfee was one of the largest companies in the space and its exit has created a scramble among the survivors to absorb those customers and to create some kind a competitive moat in order to develop a profitable businesses. Just exactly how much growth that PFPT is enjoying this year with results the prior quarter showing re-accelerating percentage growth relates to the exit of McAfee from the market is basically indeterminate.
Intel Security has now been purchased by TPG in one of those spin-merger transactions but I doubt that it will return to the market and it continues to recommend to its clients that they migrate to Proofpoint's solutions. Proofpoint is the leader in the Gartner MQ analysis and is so by a very wide margin indeed. Its closest independent competitor in the survey or in revenue terms, Mimecast, is about half of its size.
The email security space is, not terribly surprisingly, more or less saturated. Gartner says the market, as they define it, is growing at 2% a year. Gartner's market definition which yields an annual revenue total of $1.4 billion is obviously very crabbed and excludes many other pieces of functionality that are sold together with email security solutions.
Proofpoint is growing at rates in the mid 30% range and is forecast to continue to enjoy both rapid growth and non-GAAP profitability as well as free cash flow.
There's always a bit of cognitive dissonance involved when a company is able to grow in the mid 30% range and its market is growing in the 2% range. Whether the necessary growth can continue through 2020 or any other fixed point in time in order to support the current valuation - well I am the one who thought there would have basically ceased to be an independent space at some point so I have had to re-orient my thinking. There are readily knowable reasons for what is happening - the real question isn't that but whether or not the trend can continue.
Racehorses and Tortoises: What happens when they compete on the same track
One key factor in the rise of PFPT relates to the rise of communication via social media, which as an end-point, needs its own set of security services. The rise of social media has created a plethora of non-standard end-points that need to be protected that go far beyond email. As yet, this is a small revenue source but again, it is part of the solution that makes it easier to sell the entire package to enterprise class clients. It may be hard to believe, but at this writing, Proofpoint is the only vendor offering protection that encompasses all of the end points and all of the platforms - it is a big selling point for an enterprise.
Gartner in its latest analysis maintained that the cyber crooks were lazier last year with some modest decline seen in the number of attacks. Some people correlate the number of publicized attacks with the growth of the security software space and perhaps such a correlation exists. But if there is one, I haven't seen it in operation. I think that it is more a convenient excuse that is used by many cyber security firms to justify issues with competitive and sales execution factors.
What I have seen is that there is an incredible need for enterprises to become compliant in terms of their security portfolio lest they get sued by their own users for negligence. Thus the fact that this company offers spoofing defenses, regardless of how serious a threat spoofing breaches might be, has been a significant factor in the company's competitive success. This company offers specific compliance solutions but I think beyond the compliance/audit solutions is the drag along effect of buying software that can be used to demonstrate commitment to a high security enterprise.
In addition, again as might be anticipated, the market is shifting to cloud-delivered solutions which is apparently motivating some users to procure new software security solutions that include more functionality. Part of user requirements involve dissatisfaction with the what are called "bulk" filters which can be clumsy and not particularly selective. Encryption is also becoming a significant factor in an overall solution and more than 60% of users looking to incorporate that capability in their workflow. All of these trends play to Proofpoint's strength and are probably factors in their competitive success.
Again, needless to say, one trend in email security will be to get it from the cloud providers such as Microsoft and Google (NASDAQ:GOOG) (NASDAQ:GOOGL). But users are willing to pay and to pay substantial prices to get best of breed in this space and the fact is that the costs associated with a successful breach far outweigh the cost of paying Proofpoint.
An interesting analysis that perhaps explains the performance and the outlook for Proofpoint relates to the win/loss statistics as compiled by a market research firm called "BuiltWith." Most of the data relates to the US and indeed is representative of the fact that this company has more untouched opportunity in Europe than in North America. Overall, the statistics are compelling.
Proofpoint gained 1,200 customers from Symantec and lost 74 to that competitor. It took 690 customers from McAfee and lost 40. It took 245 customers from Websense and lost 42. In fact, all of the competitors in the survey donated share to Proofpoint - the basic answer as to how a vendor can achieve 30% growth in a market growing only 2%. In aggregate, out of a survey sample that included about 37,000 sites, Proofpoint replaced its competitors at 2,200 sites on a net basis. Those are telling statistics in my opinion.
The partnership the company has with McAfee is working at the SMB level currently and is likely to net some large users over time. I think the survey work of BuiltWith will continue to show significant market share gains based on takeaways for this vendor over the coming years.
Another survey of resellers indicated that in new deployments Proofpoint is most often beating Cisco and Symantec. It rarely competes with Mimecast which typically markets to smaller enterprises. FireEye (NASDAQ:FEYE) is also looked on as a competitor but that is an odd match-up to say the least.
Finally, this company has a relationship with a variety of cyber security firms that offer their product and Proofpoint's on a combined basis. The first sales have come from Palo Alto (NYSE:PANW) and there are similar partnerships with Splunk (NASDAQ:SPLK), Imperva (NYSE:IMPV) and CyberArk (NASDAQ:CYBR). Needless to say, not all of these partnerships will produce significant revenues and some of them will hardly be worth the cost of the press releases - but it is good way for a smaller vendor to leverage a rather constrained sales and marketing budget.
Last quarter, as many readers realize, the company had a substantial beat and it raised its outlook as well. The beat was large enough that the shares appreciated by 10% the following day despite the fact that many observers thought the valuation was high already. The shares have been modest performers this year achieving returns of 10% and comparable to the appreciation of the IGV. Who says that markets aren't rational? It may take some time for the realization to hit that there is a rational price for everything based on definable metrics - it can just take a long time.
Since the company raised its guidance, so too did analysts whose estimates are standing right at the center point of the expectations forecast by CFO Paul Auvil. I thought it was interesting and perhaps a bit mechanical that the CFO commented that because PFPT would grow by 37% this year, growth next year would be only 28%. I think it's maddening in the extreme to believe that company managements can forecast that far ahead when most sales people are hard pressed to fill out a Salesforce commitment form that is valid for more than 90 days.
I think that the only objective thing to consider is that it is unlikely for the beer to get any colder than it was in Q2 - the trick will be keeping the beer at a similar temperature for a few more years.
Proofpoint is not the cheapest equity I have ever considered. Currently, the company has an EV/S of over 8X. And while company management is excited about the fact that it is generating a bit of cash flow and the fact that it is making non-GAAP profits, there is no one who is buying these shares because of current levels of profitability or cash flow. And whatever else is true, the market for email security solutions has microscopic growth and loads of competitors.
There are some higher valuations to be seen amongst software companies whose revenues come exclusively through cloud delivery. Not that the two are comparable, really, but T. Rowe Price and others think the 9+X revenue Oracle (NYSE:ORCL) has offered for NetSuite (NYSE:N) is a huge bargain and want more because they say other cloud software firms command such prices. I'm fascinated to see how intrinsically intelligent people can come up with these kinds of valuations in markets with such modest organic growth whether they are in email security or in ERP.
Like many of its valuation brethren, the story here rests on what the CAGR might be for the next several years and having said that the level of complexity in the story gets lots more complicated. Company CEO Gary Steele likes to talk about the company reaching $1 billion in revenues by 2020 which would be no mean accomplishment when revenues this year, self-proclaimed to be a positive outlier in terms of growth, are forecast to be $363 million.
To get to $1 billion of revenues by 2020 would require a CAGR of just less than 30% in a space that is growing at 2% and isn't all that enormous to start with. And with that kind of revenue growth investors also expect some reasonable level of profitability and cash generation as well.
I won't try to go through the exercise of calculating what investors might actually expect free cash growth to be as that metric is hard enough to forecast a year out, but certainly suggesting that a free cash flow yield of 4%-5% might be considered acceptable suggests that there needs to be lots of heavy lifting to come. In short, expectations are about the same as asking the New York Jets to play turn-over free football for the balance of the season. Yes, it happened last Sunday but the result was the same.
I think one thing to note as the CFO suggested in a telling comment during the last conference call is that sometimes everything aligns in a particular quarter and results get skewed because expenses are more or less set before final revenues are realized. That happened this past quarter and it would be an error to think that the required CAGR ought to be a function of the performance in Q2 - it just doesn't go that way.
And yet current valuation more or less implies that the market expects just that kind of result. I will cut to the chase directly - this is a company that can do everything perfectly and still is unlikely to achieve what it needs to achieve to satisfy the ambitions of the CEO who is selling shares and more importantly the expectations of current shareholders.
The company has loads going for it as outlined above and some of that is going to drive revenue growth in the 30% over the next 12-18 months and that is perhaps enough to keep the path to profitability open a few more miles or meters or whatever unit of length one likes best. This is no lay-down short as has been suggested by some authors on the Pro part of this site. But a revenue CAGR of 30% through 2020 is just a bridge to far.
For one thing, at the moment there is a pretty decent tailwind coming from the migration of Intel security customers to PFPT. That will continue at some elevated rate until most of the low hanging fruit has been picked and the balance remaining will not be disproportionately inclined to use the Proofpoint s0lution, even with the custom built migration tools.
Then there is the matter of saturation. Gartner says the email protection market is saturated. CEO Steele respectfully disagrees, even in North America. I have no independent data to contribute to the debate - but logic suggests that there is a relatively high level of saturation for the core capability and not all organizations need to protect themselves from every cyber security issue imaginable both now and in the hereafter.
I do not have either the resources or the data to build a model as to what kind of upsell might be necessary for this company to achieve its 30% growth rate. Mathematically, it is going to have to be a significant number if the number of new users for Proofpoint starts to diminish due to saturation in terms of the core capability of email protection as the years march on.
Interestingly, on the last call, the company said that its threat protection business, the company's historic core, had 50% growth, the greatest in two years. Slower growth was seen from some of the newer areas such as archiving. I tend to think that the extra growth in the core business really had to do with unsustainable factors like the migration of users from Intel Security, a higher than normal renewal rate and some headwinds from a few initiatives that came together in the quarter while the relatively slower uptake of the archiving solution in particular might be a bit… well it is certainly a risk along the way to a 30% CAGR over the next four-plus years.
Some financial considerations
Last quarter not only saw growth beyond forecast levels, it also was a quarter in which almost all of the revenue upside dropped to the bottom line. Was it hiring discipline or was it scale economies or what was it that led to the company's margin inflection? Here are the raw numbers with the expense ratios calculated at GAAP for a better comparative analysis. If Q2 results were a harbinger of the company's path to profitability, then some but not all of my objections to the shares would melt away. It was that good.
I just don't think the rate of ascent is sustainable and I think the "proof" of the conjecture is the noticeable acceleration in job postings to which I alluded earlier. I admire the results the company achieved in Q2 including both revenue and bookings growth coupled with strong expense management. I just do not think that stars align every quarter and I do not think investors have considered what happens when a couple of the stars go awry.
The company achieved a gross margin of 70% last quarter which compares to 69% in the prior year and to 68% in the prior quarter. I think there is more potential opportunity in gross margins than there is elsewhere on the income statement in the shorter term.
Research and development spend is high at 26% but building moats is expensive work and danger abounds in under-investing in that expense category for a company such as this. Research and development expense was 29% of revenues in the prior year and almost 29% of revenues in the prior sequential quarter. Research and development expense grew by 4.4% sequentially. That isn't a sustainable rate of increase and will have to increase - one of my guesses as to the why of the significantly greater job postings.
Sales and marketing is still very elevated at 54% of revenues although that compares to 56% of revenues in the prior year period. It should be noted that this expense metric is benefiting from the company changing an accounting standard in terms of accruing commissions which will have some modest benefit going forward (it actually was a negative last quarter). Sales and marketing expense had been almost 59% in the first quarter but again, the sequential increase in the spend rate of 4.7% is almost certainly not sustainable.
Commission expense given the company's 11% increase in sequential revenues must have far outstripped expense growth. Again, it is not surprising that the company is ramping its job postings with that kind of expense performance.
Reported general and administrative costs were 26% of revenue, up very sharply from the 13% level from the prior year. Some of that has to do with stock-based comp which was $4 million in just the general and administrative line alone but even a non-GAAP expense of 20% of revenues is out of bounds. The major factor in general and administrative expense last quarter was the settlement of litigation items that impacted that expense bucket by 1440 bps.
Absent the litigation settlement, GAAP general and administrative costs ran at 10.5% last quarter compared to 12.2% during the prior year and 13.4% the prior quarter. General and administrative costs actually fell a bit sequentially which is strong expense discipline indeed. For a company at this scale, it would be hard to imagine general and administrative costs continuing to decline as a percentage of revenue - this is about as good as it gets.
Overall, excluding the costs of litigation, on a GAAP basis, operating losses were 20.5% of revenues last quarter compared to 30% of revenues the prior year and to 32% of revenues the prior quarter. This is exceptional progress, and really progress at levels that suggest that coming quarters are unlikely to reprise this level of margin improvement.
Most of the improvement was from better expense management, stock-based comp, while substantial, grew by only a bit more than 20% year on year and was flat sequentially.
One can surely do more with less for a finite period. On the other hand, trying to do too much more while doing so with far less resources can be a risky strategy. I think the sharp increase in the company's job postings suggest that the path to profitability will flatten out for a while.
The company is managing to generate some cash flow from operations. Of that amount, $18 million was a product of stock-based comp but the litigation settlement cost $13.5 million. Removing the cost of the litigation yields a CFFO margin of 24% which is quite a bit stronger than is typical for many other companies with a SaaS model at this scale. The company is forecasting that it will achieve free cash flow this year of $34-$38 million which includes the litigation settlement costs. Overall, $50 million of free cash flow absent the litigation expense seems a reasonable estimate. Unfortunately, it only provides a free cash flow yield of 1.7%.
In many ways, Proofpoint has done many things right in its recent evolution. Revenue growth has accelerated, the competitive moat has widened and expense management has been at unusual levels for this kind of company. The weather looks benign for the next few quarters - but the shares are priced for that and more. I still think the weather is going to turn stormy over the next couple of years and even if it doesn't, the shares are already discounting better performance than seems likely. A trading vehicle - yes. A long investment producing lots of positive alpha - I doubt it.
Disclosure: I/we have no positions in any stocks mentioned, and no plans to initiate any positions within the next 72 hours.
I wrote this article myself, and it expresses my own opinions. I am not receiving compensation for it (other than from Seeking Alpha). I have no business relationship with any company whose stock is mentioned in this article.