U.S. markets closed

Edited Transcript of MIME earnings conference call or presentation 10-Feb-20 9:30pm GMT

Q3 2020 Mimecast Ltd Earnings Call

LONDON Feb 26, 2020 (Thomson StreetEvents) -- Edited Transcript of Mimecast Ltd earnings conference call or presentation Monday, February 10, 2020 at 9:30:00pm GMT

TEXT version of Transcript

================================================================================

Corporate Participants

================================================================================

* Peter C. Bauer

Mimecast Limited - Co-Founder, Chairman & CEO

* Rafeal E. Brown

Mimecast Limited - CFO

* Robert Sanders

Mimecast Limited - Director of IR

================================================================================

Conference Call Participants

================================================================================

* Daniel Robert Bergstrom

RBC Capital Markets, Research Division - Analyst

* Joseph Anthony Gallo

Jefferies LLC, Research Division - Equity Associate

* Keith Frances Bachman

BMO Capital Markets Equity Research - MD & Senior Research Analyst

* Matthew Melotto Parron

JP Morgan Chase & Co, Research Division - Analyst

* Nicholas Ivan Negulic

SunTrust Robinson Humphrey, Inc., Research Division - Associate

* Saket Kalia

Barclays Bank PLC, Research Division - Senior Analyst

* Shaul Eyal

Oppenheimer & Co. Inc., Research Division - MD & Senior Analyst

* Steven Richard Koenig

Wedbush Securities Inc., Research Division - MD

================================================================================

Presentation

--------------------------------------------------------------------------------

Operator [1]

--------------------------------------------------------------------------------

Ladies and gentlemen, thank you for standing by, and welcome to the Mimecast Third Quarter 2020 Earnings Conference Call. (Operator Instructions) Please be advised that today's conference call is being recorded. (Operator Instructions) I would now like to turn the conference over to your speaker today, Mr. Robert Sanders.

--------------------------------------------------------------------------------

Robert Sanders, Mimecast Limited - Director of IR [2]

--------------------------------------------------------------------------------

Good evening, and welcome to Mimecast's earnings call for the fiscal third quarter of 2020, ended December 31, 2019, I'm Robert Sanders, Director of Investor Relations. With me on the call tonight are Peter Bauer, our Co-Founder, Chairman and CEO; and Rafe Brown, our CFO. Tonight's conference call is being broadcast live. A replay of this call will be available after the live call has ended. Tonight, we will make forward-looking statements regarding future events and the future financial performance of the company. These forward-looking statements are subject to risks and uncertainties that could cause actual results to differ materially from those in the forward-looking statements. We caution you to consider the important risk factors that could cause results to differ from those in the forward-looking statements contained in today's press release and on this conference call. These risk factors are further defined in Mimecast's most recent Form 10-Q filed with the Securities and Exchange Commission.

During this call, we will present both GAAP and non-GAAP financial measures. These non-GAAP measures are not intended to be considered in isolation from, a substitute for or superior to our GAAP results. A reconciliation of GAAP to non-GAAP measures and the reasons for our representation of the non-GAAP information is included in today's press release, which can be found in the Investor Relations section of our website. The date of this call is February 10, 2020. Any forward-looking statements we make today are based on assumptions that we believe to be reasonable as of this date. We undertake no obligation to update these statements as a result of new information or future events.

Finally, I'd like to remind you that we are having a financial analyst and investor day on the 24th of this month in San Francisco, California and invite you to join us. Now I would like to turn the call over to Peter Bauer. Peter?

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [3]

--------------------------------------------------------------------------------

Good evening, and thank you for joining our earnings call for the third quarter of fiscal 2020. On tonight's call, I'll begin with an overview of our achievements this quarter. And next, I'll discuss our Email Security 3.0 strategy and how our recent acquisitions of DMARC Analyzer and Segasec support that framework. I'll talk about our ongoing success with Microsoft Office 365, and then I'll discuss the growth of our API integrations and how these partnerships are benefiting our customers. And finally, I'll share some examples of solutions Mimecast has delivered in our third quarter and why our integrated offerings were preferred over competitors.

Turning to the third quarter. We are delighted to once again be sharing with you results that exceed our guidance. Revenue of $110.2 million grew 26% year-over-year as reported and 27% in constant currency. This performance was the result of world-class customer retention, sales of additional services to our base of subscribers and the addition of 800 net new customers to our platform. The large account segment was notable for several high-profile wins against leading competitors. And these wins are elevating Mimecast's brand amongst enterprise customers and building further confidence in our technology and organization. This success upmarket continues to be validated by leading research and advisory providers as Mimecast was named a leader in the Gartner Magic Quadrant for enterprise information archiving for the fifth year in a row. Partners also recognize our improving market position and the opportunities available to them in partnership with us. For example, CDW named Mimecast their silver partner of the year for 2019. During the third quarter, we introduced Mimecast Email Security 3.0 strategy at our Cyber Resilience Summit. Email Security 3.0 outlined how attackers' strategies have evolved over time.

Today, the best cyber resilience moves beyond what we used to think of as the email gateway. Our solution for keeping organizations safe is both a sophisticated set of e-mail perimeter or gateway defenses that are focused on blocking the ever-evolving threats that attempt to deliver malware and scams directly to an organization's users or Zone One, as we call it, as well as 2 additional zones of attack that customers need to consider. Now Zone 2 looks at threats inside the perimeter when an attacker leverages the employees' credentials or systems inside the company to proliferate attacks and then Zone 3 where attackers simply rip off domains and brands in the wild, attacking an organization's customers, partners, or the public using e-mail impersonation and fake web properties to commit fraud.

Now Mimecast Email Security 3.0 services deliver an integrated solution across all 3 zones. Our TTP offering defends in Zone 1, IEP and awareness training delivery to Zone 2, and then it's in Zone 3 that we've recently made significant enhancements to our platform with the acquisitions of both DMARC Analyzer and Segasec. A DMARC Analyzer is a service that offers domain-based message authentication, reporting and conformance, the acronym DMARC. We offer setup management and analysis. And when combined with Mimecast Gateway Services, DMARC Analyzer provides customers an easier and more cost-effective solution for stopping domain spoofing attacks.

Segasec is a service that protect organization's digital footprint by extending detection and defenses beyond the perimeter to protect brands, customers and supply chains against the attacks spoofing a company's digital assets. Here, we are proactively finding and removing malicious domains and properties impersonating or replicating your legitimate digital assets before they do damage. As part of Mimecast now, we will call the Segasec offering Mimecast Brand Exploit Protection, or BEP. The availability of these new services on the Mimecast platform is already proving popular as we witnessed existing customers adopting these advanced technologies and in new customers being attracted to us for our comprehensive Email Security 3.0 framework.

Our deep and open API strategy, which we've discussed on prior calls continues to see rapid adoption across our customer base and has been a key differentiator in new sales engagements. Over the course of 2019, we've more than doubled the number of customers accessing services through our APIs to over 600 organizations. Our fast expanding ecosystem of integrations with leading technology vendors grew in the third quarter to include IBM resilient complementing Mimecast integration with IBM QRadar. Additionally, Demisto recently upgraded remediation capabilities enabling removal of e-mail from users' mailboxes directly from within Demisto. This further enhances the value customers can realize by adding Mimecast to their cyber resilience strategy.

Now our success with Microsoft Office 365 continues to be strong. More than half of our new customers in the third quarter came to us to help them to be more confident and secure with Microsoft Office 365. Today, over 19,000 organizations use Mimecast to enhance their cyber resilience with Office 365, meaning that for the first time, over half of our total customer base is now on Office 365. Now there are over 200 million business users active on Office 365 today. And we can easily imagine a world of near total Office 365 deployment and dependency.

Now this, of course, represents a huge concentration of risk on this critical business infrastructure. This tremendous scale can advantage the attacker as security homogeneity across a wide range of organizations means a single successful scam can be used to exploit multiple targets. Now Mimecast can help customers mitigate the risks they face in this new digital reality, characterized by new dependencies and interdependencies that pose different risks and require new plans and mitigations. Our Email Security 3.0 strategy emphasizes a more pervasive view of e-mail and security generally, expanding beyond the perimeter as well as inside the organization systems and linking to other vendors' products that are used by our customers through APIs as part of a broader and more connected security ecosystem. When combined with our suite of cybersecurity and resilience extensions such as archiving, continuity and web security, we see a continued and significant opportunity to grow our subscribers in an Office 365 ubiquitous world.

Now I'd like to share with you some of the reasons customers are choosing Mimecast and the types of solutions we're delivering to the market. So firstly, a U.S.-based health care technology company with a staff of about 600 moved to Office 365 and recognized the need for enhanced cyber resilience in addition to what Microsoft offered to protect users, customers and their brand, an RFP was commenced with Mimecast and another leading vendor. And after running live traffic for 30 days and evaluating the breadth of capabilities of both vendors, Mimecast was selected for our superior efficacy and ability to protect this organization at their perimeter or Zone 1. But in addition to Zone 1, our Zone 2 solutions were deployed to scan for Insider threats and to empower employee defenses. In Zone 3, they purchased both our DMARC and Brand Exploit Protect offerings. They understood the value of our integrated platform during their evaluation and they ultimately included continuity and archiving and web security in their subscription, too. Mimecast's unique ability to cover multiple customer needs across what used to be sort of a separate product categories differentiated our service and delighted this customer.

Secondly, a U.S. engineering firm with 25,000 employees was using several legacy technologies in an attempt to block dangerous e-mails. It was not proving to be as successful as they had intended. And so they looked for a solution with better efficacy. They did a side-by-side proof-of-concept between Mimecast and another leading vendor. And Mimecast was selected for our efficacy and our ability to integrate through our open APIs with other vendors in their network, including Splunk and Palo Alto Networks' Demisto. Additional consideration was given to Mimecast's integrated suite of services that provided a road map for future workload consolidation.

And then a U.S. health care organization with 30,000 employees experienced lower efficacy and rising costs from their existing e-mail security provider, and they sought a better solution and after completing a comprehensive proof-of-concept involving a side-by-side comparison versus the incumbent, Mimecast was selected. The customer also valued our recently acquired DMARC Analyzer service to bolster their Zone 3 defenses.

Then a children's health care organization with 6,000 employees was using legacy technology from multiple vendors for e-mail security and archiving. They simultaneously had projects looking for an e-mail security solution with better efficacy and a more streamlined archive and e-discovery offering. After a thorough POC involving other leading vendors, Mimecast was selected for our integrated platform, delivering to both of their needs in a cost-effective and easy to deploy platform and some of the added platform benefits this customer chose to take advantage of include Internal Email Protect and Mimecast Sync & Recover.

A global sustainable transportation company with 50,000 employees and a modern IT infrastructure looked to improve efficacy and integrate communication and data security with other vendors in their network. While the incumbent vendor offered freight sharing across vendors, their API platform was not as robust as Mimecast and not able to align with this customer's vision of integration. After a live bake-off versus other leading vendors, Mimecast was selected for our improved efficacy, administrative flexibility and our customer support services.

A higher education institution in Australia with over 80,000 faculty and students was using Mimecast to protect their staff of approximately 10,000, while relying on Microsoft Office 365 ATP standalone for student e-mail accounts. Over the course of 2019, this organization experienced repeated compromises of student accounts. In one incident, over 1,000 student accounts were compromised. And while this institution was able to contain the further spread of this attack, the sheer number of hours to remediate was unmanageable and costly, and they sought to implement a more effective solution. Mimecast's S2 bundle that combines TTP and IEP to guard both the perimeter, or Zone 1, and hunt for threats inside the network, or Zone 2, was selected for all 80,000 faculty and staff, reducing both cost and complexity for IT, improving end-user experience and safeguarding the organization with enhanced cyber resilience.

A beverage company with over 150,000 employees, operating in an Office 365 deployment that covered 9 geographic zones required a vendor that could support complex multi-zone policy configuration on a global scale. Additionally, this organization sought better protection from impersonation attacks that had alluded their incumbent vendor and look to add Zone 2 defenses to guide against careless and malicious insiders. After an evaluation alongside the incumbent vendor, Mimecast was found to have stronger efficacy and the ability to fulfill their complex global compliance requirements. So in summary, we continue to develop our technologies, partnerships and people to enhance Mimecast services and provide our customers with the best available solutions. In doing so, we remain mindful of our balanced operating model, driving top line growth while simultaneously delivering profits. Constant innovation ensures that we are defending against today's threats and staying abreast of new threats and risks as adversaries alter their tactics. This perpetual innovation and our focus on customer service underpins our growth as we look to 2021 and beyond.

Now I'd like to turn the call over to Rafe Brown, our CFO, to cover the financial detail further. Rafe?

--------------------------------------------------------------------------------

Rafeal E. Brown, Mimecast Limited - CFO [4]

--------------------------------------------------------------------------------

Thank you, Peter. As Peter mentioned, we had a very productive third quarter. I'm pleased to report that for the third quarter of fiscal 2020, we exceeded the high end of our guidance for both revenue and adjusted EBITDA, continuing to deliver a balanced scorecard of both growth and expanding leverage in the business. We closed the acquisition of DMARC Analyzer in the third quarter and as you are aware, shortly into the fourth quarter, announced the acquisition of Segasec. These 2 acquisitions further expand our product offerings in Zone 3 of our Email Security 3.0 strategy, which is particularly appealing to larger organizations. In the third quarter, we generated revenue of $110.2 million, which represents growth of 26% over the prior year in absolute dollar terms. Adjusting for the $700,000 of currency headwind we faced, our constant currency growth rate over the prior year stood at 27% for the quarter. Note that since providing guidance last quarter, foreign currency fluctuations positively impacted our third quarter results by $300,000. Adjusted EBITDA for the third quarter totaled $20.6 million, representing an adjusted EBITDA margin of 18.7% compared to $16 million or 18.2% in the same quarter of the prior year. On a net customer basis, we added 800 customers in the quarter.

Mimecast now services 36,900 customers worldwide. But please note this figure excludes acquired DMARC Analyzer customers at this time as we work to integrate the DMARC business. Our average order values continue to show improvement over the prior year. Currently, average order value for all customers stands at $12,100, up approximately 13% over the prior year in constant currency terms. Average services per customers across our customer base rose to 3.3 services per customer in the quarter, up from 3.1 services last year at this time. New products, such as the 2 acquisitions mentioned earlier continue to afford us the opportunity to expand our footprint within existing customer deployments and increased Mimecast's appeal with larger organizations. The proportion of customers using Mimecast in conjunction with Office 365 rose past 50% in the quarter for the first time. We see Office 365 expansion is helpful to our business as Office 365 customers continue to demonstrate an appetite for a greater number of our service offerings. As of the third quarter, Office 365 customers purchased on average 3.5 services per customer compared to 3 services for those customers not using Office 365.

Our trailing 12-month revenue retention rate stood at 109% compared to 110% in Q3 of the prior year. Our gross revenue retention numbers continue to be underpinned by solid upsell results as our existing customers continue to renew their subscriptions and purchase additional services. From a geographic perspective, North American growth in the quarter remained strong, with North American revenue up 28% over last year. Our business outside North America continued to grow in the third quarter, but performance outside North America remained below our expectations.

Turning to gross margin for the third quarter. We recognized the 75.6% non-GAAP gross margin up 100 basis points from Q3 of the prior year. Our non-GAAP operating profit for the third quarter was $12.7 million or 11.5% of revenue, an improvement of 50 basis points from the prior year driven by efficiencies of scale within our grid. In bottom line terms, our third quarter GAAP net income was $200,000 or breakeven on a per diluted share basis, based on 64 million fully diluted weighted average shares outstanding.

Our GAAP tax charges totaled approximately $1 million in the quarter. Fourth quarter tax expense is expected to be approximately $1 million, in line with our prior communication regarding full year tax expense. Our non-GAAP net income for the quarter was $8.8 million or $0.14 per diluted share based again on 64 million fully diluted weighted average shares outstanding. Our non-GAAP tax rate was 28.4% for the quarter, and we continue to project a full year non-GAAP tax rate of approximately 31%.

Turning to cash flows. Our third quarter operating cash flows totaled $19.3 million or 17.5% of revenue. As noted on our prior earnings call, we made a payment in the third quarter pursuant to a patent litigation settlement for a total of $5.9 million, the impact of which was split between operating cash flow and Capex.

Free cash flow totaled $1.9 million for the quarter. With our new offices in both the U.K. and South Africa now complete, we expect full year capital expenditures to be approximately $53 million. I am pleased to say that even with the approximately $20 million of one-off cash expenditures expected to be incurred, we continue to anticipate that free cash flow for the full year will be in line with our FY '19 performance, or approximately $37 million for the year. After paying approximately $21 million for DMARC Analyzer as of December 31, Mimecast had $190 million of cash on the balance sheet. You should note that the Segasec acquisition that we announced last month and is thus a Q4 item, will reduce our cash balance by approximately $27 million.

Let me now turn to guidance for the remainder of fiscal '20. For the fourth quarter of 2020, revenues are expected to be in the range of $112.9 million to $114 million or 23% to 24% growth in constant currency terms. Our guidance is based on exchange rates as of January 31, 2020, and includes an estimated negative impact of $800,000 resulting from the strengthening of the U.S. dollar compared to the prior year. Adjusted EBITDA for the fourth quarter is expected to be in the range of $20.2 million to $21.2 million. Full year 2020 revenue is expected to be in the range of $425.6 million to $426.7 million or 27% to 28% growth in constant currency terms.

Foreign exchange rate fluctuations are negatively impacting this guidance by an estimated $8.4 million compared to the rates in effect in the prior year. Prior guidance for fiscal 2020 provided in November, was $423.1 million at the midpoint. Our overachievement in Q3, coupled with the strength we are seeing in our business is leading us to raise the midpoint of our full year guidance by $2.3 million in constant currency terms.

In addition, this raise of $2.3 million is being positively impacted by $800,000 of foreign exchange tailwind that has risen since the rates used in our November call, resulting in the midpoint of our full year guidance moving up by $3.1 million in absolute dollar terms. From $423.1 million to $426.2 million.

Please note that total acquired revenue from our 2 acquisitions, DMARC Analyzer announced in November and Segasec announced in January is expected to be approximately $200,000 for the year. Full year 2020 adjusted EBITDA expectations are being raised to a range of $74.3 million to $75.3 million. We are increasing our adjusted EBITDA guidance by $1.1 million at the midpoint, which at the midpoint would deliver a 160 basis point improvement over the prior year. It is worth pointing out that we are absorbing the operating cost impact of the 2 acquisitions, while increasing our full year adjusted EBITDA guidance. While we are still finalizing our planning, I would also like to take this time to set initial expectations for the year ending March 31, 2021. As we close fiscal '20 and conclude our planning process, we will refine these expectations, but believe this is a good starting point. And please note again that this guidance is based on foreign exchange rates as of January 31, 2020. Full year fiscal '21 revenue is expected to be in the range of $505 million to $515 million or 18% to 20% growth in constant currency terms when measured against the midpoint of our current fiscal '20 guidance. Full year fiscal '21 adjusted EBITDA is expected to be approximately $100 million, which at the midpoint of our revenue guide would be approximately a 200 basis point margin improvement over fiscal '20.

Free cash flow for the full year fiscal '21 is expected to be approximately $84 million after CapEx charges that we are now modeling at 7% of revenue. On an as-reported basis, that is a 780 basis point free cash flow margin improvement over our expected fiscal '20 free cash flow. Setting aside the onetime fiscal '20 CapEx items mentioned earlier, this is still an approximate 300 basis point margin improvement year-over-year based on the midpoint of our current guide. As a final comment, I would like to highlight that the guidance for fiscal '21 reflects our commitment to delivering both disciplined growth while expanding free cash flow margins. And with that, I'd like to thank you for your time and open the line to your questions. Operator, can you please poll for our first question?

================================================================================

Questions and Answers

--------------------------------------------------------------------------------

Operator [1]

--------------------------------------------------------------------------------

(Operator Instructions) Our first question or comment comes from the line of Saket Kalia from Barclays Capital.

--------------------------------------------------------------------------------

Saket Kalia, Barclays Bank PLC, Research Division - Senior Analyst [2]

--------------------------------------------------------------------------------

Peter, maybe just to start with you, just zooming out a little bit on the competitive environment a little bit, can you just talk a little bit about what you're hearing from Symantec MessageLabs customers? I guess, specifically, how do you think those customers are viewing the future of their e-mail security now that MessageLabs is part of Broadcom? And how do you think Mimecast is maybe going to go after that opportunity, understanding that it's probably more of a long-term item?

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [3]

--------------------------------------------------------------------------------

Yes, I think that's right. And maybe just to start off, I mean, we've been servicing or migrating Symantec MessageLabs' customers very successfully for many years now, even prior to the Symantec acquisition of MessageLabs and now obviously with Broadcom coming in, it introduces a level of uncertainty and ambiguity for that customer base. So we're really focused on helping those customers understand that if they're feeling jumpy or uncertain about Broadcom's commitment to either them as a segment, in the case of the mid-market customers, or e-mail security as a category, which Broadcom has not shown that it's something that they're particularly interested in, it's one of the product lines that hasn't been spoken about as a future growth area in their plans, that there really is a good home for them with Mimecast and that they would be following a pretty well-trodden path of several thousand other companies that have very successfully migrated to Mimecast.

I think the opportunity is not just with the end user community, but also with partners who are perhaps under the previous Symantec ownership structure, you had a level of loyalty to Symantec, that was largely reciprocated. I think Broadcom's focus does not appear to be building long-term relationships, certainly with your typical mid-market reseller type organization. And so what may have previously been loyalty between that channel and Symantec, I think, is certainly open. And those partners are showing a greater interest in and willingness to introduce those accounts over to Mimecast that previously, they may not have. So we're doing things from an educational point of view and from a promotional point of view to help make it easier commercially for both customers and partners to migrate over to Mimecast.

--------------------------------------------------------------------------------

Saket Kalia, Barclays Bank PLC, Research Division - Senior Analyst [4]

--------------------------------------------------------------------------------

Got it. That's really helpful and makes a lot of sense, Peter. Maybe for you, Rafe, can you just talk a little bit about the net revenue retention metric a little bit. I guess the question is, how does that sort of maybe ebb and flow quarter-to-quarter? I think it came in at 109% this quarter. And maybe how do you think about that metric sort of qualitatively going forward, with some of the changes that are happening in the base? It sounds like there are more enterprise customers. It sounds like there are more products attached per customer. How do you think about that net revenue retention, sort of trending in the future as a result of some of those changes?

--------------------------------------------------------------------------------

Rafeal E. Brown, Mimecast Limited - CFO [5]

--------------------------------------------------------------------------------

Yes. Thank you. While there aren't -- where there is some variance in the number over time, really stepping back from it, our net revenue retention numbers are really quite good. One of the things we've just consistently been able to demonstrate its ability to sell additional products into our base as well as keep customers for quite a long time. When you dig into the math of how we calculate it, it is a trailing 4-quarter metric. So it's looking back over time. And so if you went back a year in time, TTP was really coming on strong and driving a lot of uptake. And that was a very attractive thing for us, of course, but now that it's penetrated over 70% of our base, it's natural to think, well, that's going to come off, and now we've got some new products coming up along the way to take its place. And I think that's what we're really excited about is making sure we have those new offerings. And Peter went through it kind of at some length, really talking about the Email Security 3.0 strategy and just the 2 acquisitions that we announced in Zone 3, which brand-new to us, great opportunity. But then on top of that, we're thinking about archive into our base further -- our web solution into our base further awareness training. Just across the board, we're really working to make sure that as one product seems to penetrate the base we've got other things coming up behind it.

--------------------------------------------------------------------------------

Operator [6]

--------------------------------------------------------------------------------

Our next question or comment comes from the line of Matt Hedberg from RBC Capital Markets.

--------------------------------------------------------------------------------

Daniel Robert Bergstrom, RBC Capital Markets, Research Division - Analyst [7]

--------------------------------------------------------------------------------

It's Dan Bergstrom for Matt Hedberg. So you pointed to some softening in EMEA last quarter, it sounds like it underperformed this quarter as well. Any change or is that just a continuation? And then probably too early, a few weeks old at this point, but any early signs of stability or more certainty following the Brexit vote here in January?

--------------------------------------------------------------------------------

Rafeal E. Brown, Mimecast Limited - CFO [8]

--------------------------------------------------------------------------------

So yes, that has been something that we've called out a couple of quarters in a row right on our calls. The first thing not to get lost in the discussion, our EMEA business is still growing. It's just not able to keep up with the North American growth that we've seen over the last couple quarters. One of the things when you step back and look at Mimecast, it's always important to remember that we are an international company. In fact, started outside the U.S. And I think right now, our North American revenue is just 51% of the total. So we have a very broad footprint across the world. And certainly, when you see issues like Brexit come up, which has had some very obvious impacts on the local GDP numbers or some of the challenges in South Africa on their economy, we are touched by those because we do -- our customer base reflects the local economy in that we have a lot of mid-customers, but also enterprise and some small customers as well. We're really looking at it as what can we do to make sure that we're in the best position for the market at hand. And that's something we take into account when we've done our planning, where we're deploying resources. We've moved some people around to make sure we have the right people in the right roles. We're doing our best to make sure that we're firing on all cylinders, even if there is a bit of headwind out there from the economy.

--------------------------------------------------------------------------------

Daniel Robert Bergstrom, RBC Capital Markets, Research Division - Analyst [9]

--------------------------------------------------------------------------------

Great. And then with the 3-zone approach to e-mail security. Just curious after a quarter or so with that, how is it resonating with customers, particularly, I guess, the inside and beyond the perimeter. Sounds like it's been branded now. You talked a little bit about the S2 bundle and the customer examples on the call here. Should we expect any additional changes to go-to-market here or bundling new SKUs, any thoughts there?

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [10]

--------------------------------------------------------------------------------

Yes. So Email Security 3.0, I think intuitively is making a lot of sense to prospects that we talked to, to customers as well as our channel partners. And it is certainly providing that context that we look for to help them understand the offerings, contextualize the problems that they face and understand the offerings fitting into that framework. So we've seen strong adoption of both IEP and awareness training, the Zone 2 plays during this last quarter. Obviously, the DMARC and the Brand Exploit Protect are brand-new offerings. So we have some good anecdotal evidence to suggest that, that's going to be popular with customers too.

--------------------------------------------------------------------------------

Operator [11]

--------------------------------------------------------------------------------

Our next question or comment comes from the line of Shaul Eyal from Oppenheimer.

--------------------------------------------------------------------------------

Shaul Eyal, Oppenheimer & Co. Inc., Research Division - MD & Senior Analyst [12]

--------------------------------------------------------------------------------

Quick question. On your Germany operations that you had invested in throughout the prior year. Peter, can you talk to us about the update and how that has been progressing over the course of the past -- or like, a few quarters now?

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [13]

--------------------------------------------------------------------------------

Sure. Thanks, Shaul. So obviously, we implemented our local data centers in the German market about 18 months ago. And we built out a local team with local in-country language support to service, not just Germany, but that sort of broader central European market opportunity. Thanks to the sort of ratable nature of our business and the tremendous growth of our North American and the size and scale of our others, it will take a while before that shows up meaningfully in any revenue distribution pie chart, but we continue to sign on new customers and partners into that region. And we think, among other things, that the Symantec opportunity extends over into Europe as well, and that our Email Security 3.0 framework will continue to help us drive growth into that market opportunity as well.

--------------------------------------------------------------------------------

Shaul Eyal, Oppenheimer & Co. Inc., Research Division - MD & Senior Analyst [14]

--------------------------------------------------------------------------------

Got it, got it. And if I may, Peter, as we think about the Office 365 opportunity, and without a doubt, it has played out extremely well over the course over the past few years. As we think about probably the next 2, 3 years or so and we in a way try to break it out in between EMEA and in America, where do you see probably the main upside as it relates to Office 365? I'm not asking about the entire business. But Office 365, will it be more Europe? Or will it be more North America?

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [15]

--------------------------------------------------------------------------------

Yes, I think that's an interesting one because, I mean, we classically are sourcing business out of 3 categories of prospect. The one is pertaining to the corporate e-mail arrangements. There's still a contingent that has on-premise, and they're looking maybe to offload security and archiving and some of those things to a cloud provider, but they have no immediate plans to ditch the on-premise technology. Then you've got a cohort that are either busy or planning their migration. And they're talking to us, so that we can help underwrite the success of that migration, and they can disband some of the on-premise equipment that they had to avoid backhauling data on to their own networks. And then the third bucket is those that are already on Office 365, either with a competitive solution or with nothing in place and they're now looking to add better security or layering, and they talk to us about that.

I think what we're seeing across those different markets, is that in the U.S. and in the U.K., we have quite advanced penetration of Office 365. And so most of the business that we're deriving is actually coming out of that third bucket. What's interesting is if you go to markets like Central Europe and Germany, in particular, you have many more in that sort of first and second bucket. And so that represents an interesting opportunity for us as well. And we're excited to be there sort of early in that cycle of migration as well.

--------------------------------------------------------------------------------

Operator [16]

--------------------------------------------------------------------------------

Our next question or comment comes from the line of Brent Thill from Jefferies.

--------------------------------------------------------------------------------

Joseph Anthony Gallo, Jefferies LLC, Research Division - Equity Associate [17]

--------------------------------------------------------------------------------

This is Joe on for Brent. Thanks for the question. I appreciate the color on revenue from acquisitions and assuming that $200,000 is mostly in the fiscal fourth quarter. So if I annualize it, it's about $1 million. When should we expect Email Security 3.0 to more meaningfully contribute to revenue?

--------------------------------------------------------------------------------

Rafeal E. Brown, Mimecast Limited - CFO [18]

--------------------------------------------------------------------------------

Well, I think the -- keep in mind the Email Security 3.0 is a very big contribution to revenue in that -- the 2 acquisitions are just Zone 3. So just to make sure, like our primary product is a Zone 1 product and some very good products for us are in Zone 2. So just to make sure we're on the same page, the Zone 3, is that really where your question is around the acquisitions? Is that what you're thinking?

--------------------------------------------------------------------------------

Joseph Anthony Gallo, Jefferies LLC, Research Division - Equity Associate [19]

--------------------------------------------------------------------------------

Yes, Zone 3, I'm sorry.

--------------------------------------------------------------------------------

Rafeal E. Brown, Mimecast Limited - CFO [20]

--------------------------------------------------------------------------------

Yes. And so those products, they're, obviously -- were small companies with great products, great technologists and we're integrating them into our solution. The nice thing, though, I think, with them that we don't want to lose sight of is that we already have partnerships in place with both DMARC and Segasec. So it's a great opportunity for us to really -- we had a running start, if you will, and are working together. And I think that's going to be quite helpful. That said, they are working off a small base just into this much bigger organization. So it's going to take a bit of time for that to really ramp up. In the kind of mid-term, what you would look to in terms of the strategy or some products like the awareness training product, which we're seeing very nice growth in it, that began with an acquisition last fiscal year. We've now fully integrated it into our platform. We're seeing good customer adoption. Those are the products that we'll start to see things coming along much -- more quickly and driving more of a revenue impact.

--------------------------------------------------------------------------------

Joseph Anthony Gallo, Jefferies LLC, Research Division - Equity Associate [21]

--------------------------------------------------------------------------------

Okay. And then just in regards to your fiscal '21 guidance, you guys have sustained high-growth in the high 20s constant currency for a while now, it implies a steepish decel. I'm assuming there's some prudent conservatism in there. But then also on the adjusted EBITDA, it's above The Street, and it's a 200 basis point improvement, but it's a little bit below what you guys have laid out in the long-term model in your investor presentation. So just how should we think about growth versus profitability going forward?

--------------------------------------------------------------------------------

Rafeal E. Brown, Mimecast Limited - CFO [22]

--------------------------------------------------------------------------------

Yes, this will be a significant topic at our Analyst Day that's coming up in just a couple of weeks here. So we'll dive into that a lot more. Our focus is to make sure we're balancing both growth and building profitability. And I think one of the things you're seeing, at least in our guidance, and as we execute on it, is that exercise of both levers, where we're focused on growth, but we are consistently focused on how can we deliver bottom line value as well, hitting $100 million adjusted EBITDA in terms of guidance, of course, we stopped to execute on that, but that's a big milestone for us and shows a nice improvement. And likewise, one of the things that you probably noticed in the call is an emphasis around free cash flow, which, again, that's just, as a metric for us, something we feel is very important to demonstrate in an unambiguous fashion the bottom line value we're delivering.

--------------------------------------------------------------------------------

Operator [23]

--------------------------------------------------------------------------------

Our next question or comment from the line of Terry Tillman from SunTrust.

--------------------------------------------------------------------------------

Nicholas Ivan Negulic, SunTrust Robinson Humphrey, Inc., Research Division - Associate [24]

--------------------------------------------------------------------------------

This is actually Nick on for Terry. So first one I had was, I guess, what benefits are you guys seeing so far from your sales teams as a result of the Segasec and DMARC Analyzer acquisitions? I guess, anything in particular that's resonating with end-market enterprise in terms of how customers are receiving both these acquisitions?

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [25]

--------------------------------------------------------------------------------

Yes, great question. So it's early days. Obviously, these are fairly new acquisitions and this Email Security 3.0 framework is, while we've been talking through our megaphone about it, it's a process to get that story out into the market. The early evidence is that it's extremely well received. It makes a lot of sense to customers. And there's a lot of interest, I think, particularly upmarket around the 2 problem sets that both DMARC and the Brand Exploit Protect offerings cater for. These are pretty tricky, complex issues that customers have to deal with, and they really like the fact that they can rely on their Secure Email Gateway provider to be able to take care of these issues as well. So they're really responding well to us casting a kind of a broader frame around the e-mail security issues holistically and having native offerings that we can bring to the table. And certainly, with some of the wins that we've seen, it's been influential in us winning the Zone 1 and the Zone 2 plays, specifically because we have Zone 3 as well.

--------------------------------------------------------------------------------

Nicholas Ivan Negulic, SunTrust Robinson Humphrey, Inc., Research Division - Associate [26]

--------------------------------------------------------------------------------

Got it. Okay. That's helpful. And I guess, you guys mentioned in the prepared remarks, but you said that larger companies typically benefit the most from your Zone 3 products. So I guess, should we expect continued focus on Zone 3 moving forward? And if so, is that more, I guess, how should we think about that in terms of buy versus build?

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [27]

--------------------------------------------------------------------------------

Yes, that's a great question. So we will continue to innovate, obviously, Segasec and DMARC Analyzer, both fairly young companies with great technology, but with road maps, too. So there are organic opportunities to continue to extend their capabilities, both within the context of their products, but also some of the intersections between what they offer and what is in the rest of the Mimecast platform. So there will be solid organic innovation that continues there. It is an interesting area. Beyond the perimeter, there are a lot of challenges and threats that present themselves. So we're certainly going to keep our eyes open for opportunities -- inorganic opportunities that could help us innovate further there. But I think it's important just to recognize our style of organic, and it's largely focused on technology and talent that we can bring into the company that can help capitalize and accelerate our ability to add additional monetizable use cases on the same platform. And so a very disciplined and steady approach to M&A that will continue to play out, but certainly nothing imminent in the pipeline. We've got enough work to do to digest and onboard and enable across these new Zone 3 plays.

--------------------------------------------------------------------------------

Operator [28]

--------------------------------------------------------------------------------

Our next question or comment comes from the line of Keith Bachman from BMO.

--------------------------------------------------------------------------------

Keith Frances Bachman, BMO Capital Markets Equity Research - MD & Senior Research Analyst [29]

--------------------------------------------------------------------------------

Two things. One, if you could just clarify what is the organic growth guidance for '21. In other words, how much is the M&A contributing? And then secondarily, could you just talk about your win rates. And what I mean by that in 2 dimensions is, number one, is there any change in your win rates in aggregate? But then more specifically, are you -- and more specifically, I should say, are you also seeing a broader field? And what I mean by that is, is Microsoft getting more at-bats here for their security story? And it sounds like you're probably seeing Palo Alto and Splunk more than you had previously. So just, a, clarification on organic and then, b, win rates, both in terms of the numerical, but also what's the field look like?

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [30]

--------------------------------------------------------------------------------

Yes. So I'll let Ray jump in with the growth rate thing in a second. But I think our win rates continue to be strong and consistently good. We are being pulled into more of these larger opportunities, which is very exciting for us, and we're having good success in those. You can probably tell from some of the examples that I called out in the prepared remarks, we're delighted with those logos. And we think it's very good validation of both our sales process that's improved over time as well as our technology and our brand as well. Your question about Microsoft getting more at-bats. I mean, I think by default, Microsoft gets to bat no matter who's playing as the incumbent sort of Office 365 providers. So I think it's always been a game of why not them and then who else. If we're going to layer on additional technology, let's assume there'll be Microsoft in the frame at some point. So I wouldn't say that's changed. Palo Alto and Splunk, those are not sort of competitive solutions. Those would be other things that the customer is using that we would integrate with. So I think the example we used is Palo Alto Demisto, which is the SOAR 2 or Splunk which is the SIEM product. Our integrations with those. And so it's really about helping particularly larger organizations to build an integrated and coherent overall security system where Mimecast is the e-mail component in that system, is a very well integrated and highly contributing service component. So that's where we see players like that fitting in.

--------------------------------------------------------------------------------

Keith Frances Bachman, BMO Capital Markets Equity Research - MD & Senior Research Analyst [31]

--------------------------------------------------------------------------------

Okay. If you're going up markets just to be clear, are you seeing proof -- proof more -- proof point more in these larger deals?

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [32]

--------------------------------------------------------------------------------

Absolutely. So I think what most larger organizations, particularly in North America, they would consider is Microsoft going to be good enough standalone for them? Do they need to be talking to proof points. And then increasingly, which is very exciting for us is Mimecast is the sort of second contender in that race. And I think that's exciting for us because that's a fairly new, fairly recent phenomenon. And I think that between ourselves and proof points and Microsoft, that's really where I think the lion's share of consideration is going for how these problems should be solved.

--------------------------------------------------------------------------------

Rafeal E. Brown, Mimecast Limited - CFO [33]

--------------------------------------------------------------------------------

Just to close off on your question about the impact. The impact of DMARC and Segasec on our revenue guidance for FY '21 is really quite small. We are in the part where we're still doing the accounting for the acquisition. And as you're aware, with the deferred revenue, it's a bit involved. But I think a great benchmark here is in the FY '20 guidance, I noted that we'll have about less than $200,000 from both acquisitions, and that's a quarter and a half roughly speaking of DMARC and a full quarter of Segasec. So it's relatively small impact on the total. And certainly, we'll be working to finish up the accounting impact and the integration of those customers in the coming period, but it's not going to move the needle very much from the acquirer. We're just hoping we can go and share with a lot of new customers.

--------------------------------------------------------------------------------

Operator [34]

--------------------------------------------------------------------------------

Our next question or comment comes from the line of Sterling Auty from JP Morgan.

--------------------------------------------------------------------------------

Matthew Melotto Parron, JP Morgan Chase & Co, Research Division - Analyst [35]

--------------------------------------------------------------------------------

This is Matt on for Sterling. I just was wondering what areas in the international markets are still lagging? And what are some of the main reasons at this point that you guys can point to?

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [36]

--------------------------------------------------------------------------------

So Matt, what do you mean by areas of the international markets that are lagging?

--------------------------------------------------------------------------------

Matthew Melotto Parron, JP Morgan Chase & Co, Research Division - Analyst [37]

--------------------------------------------------------------------------------

So in terms of the product adoption as well as any specific geographies?

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [38]

--------------------------------------------------------------------------------

Okay. Yes, great question. So I think we -- as Ray mentioned earlier, we were born as an international company, and the U.S. is -- has been an expansion market for us, but obviously, our biggest basin today. But we are deployed in many international markets. We have favored English-speaking just because as a company, we're doing many hard things and doing many hard things in many different languages is potentially unnecessary for us in terms of our current growth, but also would defocus us from certain of the things that we've really sought to do in the English-speaking markets. Having said that, the European expansion was our first non-English-speaking expansion. And so we feel good that we have access to that market. But beyond that, we have very good access across South Africa and the African market, Australia, New Zealand, U.K., North America and Canada. So we feel we have good market access. Obviously, what's not on that list is some of the other parts of Asia Pacific, which we're certainly not ruling out as market opportunities but they're not in our very immediate plans.

--------------------------------------------------------------------------------

Matthew Melotto Parron, JP Morgan Chase & Co, Research Division - Analyst [39]

--------------------------------------------------------------------------------

Great. That's very helpful. And then just one quick follow-up. You guys talked about growth from new customers and existing, what portion of the growth is coming from existing customers? And is that coming more from customers buying more products or covering more users?

--------------------------------------------------------------------------------

Rafeal E. Brown, Mimecast Limited - CFO [40]

--------------------------------------------------------------------------------

Yes. And our up-sell numbers have remained really quite steady in the mid-teens, and that's up-sell off our base measured in dollars, and that's been trending for quite some time. When you take that apart, it is a blend, we obviously benefit if our customers grow and they need more seeds, they buy more seeds from us, but there's a strong mix in there of new products. And that's really a big focus for us, making sure we're able to take new products and sell them to our base as well as attract new customers and that kind of bears out. You see that both in the AOV, which was up quite nicely, 13% in constant currency terms. And in that metric that we give out about average services per customers, which that also has had a nice rise on a year-over-year basis. So when you take that apart, you do see that gross revenue retention number that I quoted at 109%, that's a big contribution to our growth on a year-over-year basis.

--------------------------------------------------------------------------------

Operator [41]

--------------------------------------------------------------------------------

Our next question or comment comes from the line of Steve Koenig from Wedbush Securities.

--------------------------------------------------------------------------------

Steven Richard Koenig, Wedbush Securities Inc., Research Division - MD [42]

--------------------------------------------------------------------------------

Your answer on the Microsoft competition was very helpful. Maybe just digging into that for a second, since you're seeing more and more of your base at Office 365, that scenario where they already have Office 365 becomes more important. Can you kind of help us understand how many of those competitions are, say, a customer has E3 without any e-mail protect or might have E5. And then I gather from your answer that if they do have Microsoft protection, either EOP or ATP, et cetera, Mime is usually an incremental add to that. Maybe you can just help understand the nature of how you play with those Microsoft deployment?

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [43]

--------------------------------------------------------------------------------

Yes, great. So we don't have a reliable way at scale to tell what our customers' licensing arrangements are with Microsoft. So I'm pretty sure within our base, we have -- with 19,000 organizations using us with Office 365, I'm sure that we have a pretty good mix of all types of Microsoft licensing. The one thing we do say to our customers is whatever level you license that and whatever your reasons for being licensed at that level, absolutely use as much of the Microsoft security technology as you can. Turn it on to the max, but be very sure to add the Mimecast layers and the Mimecast layers are both layers of security to provide better efficacy to radically reduce the likelihood of the wrong thing landing up in people's mailboxes, but also the broader suite of risk mitigation technologies and offerings that deal with some of the new issues that we face as the world becomes massively dependent on Office 365. So things like our continuity offering, which provides a plan B in the event of downtime; our Sync & Recover capability, which provides an external backup of the data inside your exchange online tenant and allows you to reconstitute data; the awareness training offering and all of the other strategies that come with it. So there are many flavors and solutions that go way beyond the scope of what an E3 or an E5 may offer, although where there may be some conceptual overlap in terms of in terms of the classic Zone 1 blocking bad things from getting into mailboxes. We certainly add considerable value and continue to be a very popular offering in -- just in that regard with Microsoft's customers.

--------------------------------------------------------------------------------

Operator [44]

--------------------------------------------------------------------------------

Thank you. Unfortunately, that's all the time we have for your Q&A period at this time. At this time, I would like to close today's conference call. Thank you for participating. You may now disconnect. Everyone, have a wonderful day.