U.S. Markets close in 1 hr 37 mins

Edited Transcript of MIME earnings conference call or presentation 5-Aug-19 8:30pm GMT

Q1 2020 Mimecast Ltd Earnings Call

LONDON Aug 12, 2019 (Thomson StreetEvents) -- Edited Transcript of Mimecast Ltd earnings conference call or presentation Monday, August 5, 2019 at 8:30:00pm GMT

TEXT version of Transcript

================================================================================

Corporate Participants

================================================================================

* Peter C. Bauer

Mimecast Limited - Co-Founder, Chairman & CEO

* Rafeal E. Brown

Mimecast Limited - CFO

* Robert Sanders

Mimecast Limited - Director of IR

================================================================================

Conference Call Participants

================================================================================

* Catharine Anne Trebnick

Dougherty & Company LLC, Research Division - VP and Senior Research Analyst of Data & Internet Protocol Networking

* Eric Carlos Lemus

SunTrust Robinson Humphrey, Inc., Research Division - Associate

* John Stephen DiFucci

Jefferies LLC, Research Division - Equity Analyst

* Jonathan Blake Ruykhaver

Robert W. Baird & Co. Incorporated, Research Division - Senior Research Analyst

* Keith Frances Bachman

BMO Capital Markets Equity Research - MD & Senior Research Analyst

* Matthew George Hedberg

RBC Capital Markets, LLC, Research Division - Analyst

* Matthew Melotto Parron

JP Morgan Chase & Co, Research Division - Analyst

* Saket Kalia

Barclays Bank PLC, Research Division - Senior Analyst

================================================================================

Presentation

--------------------------------------------------------------------------------

Operator [1]

--------------------------------------------------------------------------------

Good day, ladies and gentlemen, and welcome to the Q1 2020 Mimecast Limited Earnings

Conference Call. (Operator Instructions) I would now like to introduce your host for today's conference call, Mr. Robert Sanders, Director of Investor Relations. You may begin.

--------------------------------------------------------------------------------

Robert Sanders, Mimecast Limited - Director of IR [2]

--------------------------------------------------------------------------------

Welcome to Mimecast's earnings call for the fiscal first quarter of 2020 ended June 30, 2019. I'm Robert Sanders, Director of Investor Relations. With me on the call tonight are Peter Bauer, our Co-Founder, Chairman and CEO; and Rafe Brown, our CFO. Tonight's conference call is being broadcast live via webcast. A replay of this call will be available 2 hours after the live call has ended.

On this call, we will make forward-looking statements regarding future events and the future financial performance of the company. These forward-looking statements are subject to risks and uncertainties that could cause actual results to differ materially from those in the forward-looking statements. We caution you to consider the important risk factors that could cause actual results to differ materially from those in the forward-looking statements contained in today's press release and on this conference call. These risk factors are further defined in Mimecast's most recent Form 10-K filed with the Securities and Exchange Commission.

During this call, we will present both GAAP and non-GAAP financial measures. These non-GAAP measures are not intended to be considered in isolation from, a substitute for or superior to our GAAP results. A reconciliation of GAAP to non-GAAP measures and the reasons for our representation of the non-GAAP information is included in today's press release, which can be found in the Investor Relations section of our website.

The date of this call is August 5, 2019. Any forward-looking statements we make today are based on assumptions that we believe to be reasonable as of this date. We undertake no obligation to update these statements as the result of new information or future events. We are reporting first quarter 2020 results in accordance with ASC 842, a new standard related to the accounting for leases. The company adopted ASC 842 on April 1, 2019, the start of our 2020 fiscal year.

Now I'd like to turn the call over to

Peter Bauer. Peter?

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [3]

--------------------------------------------------------------------------------

Good evening, and thank you for joining our first quarter 2020 earnings call. I'll begin with an overview of our key financials and discuss the

Success we're having in attracting customers to our platform. Next, I'll discuss some of the factors supporting our growth. We'll introduce some of the innovations our team are delivering to the market, and then I'll provide examples of how we're enhancing cyber resilience for organizations. Finally, I'll hand over the call to Rafe Brown, our

CFO, to take you through the numbers in greater detail. And then we'll take your questions.

To begin, I am delighted to report that we've again exceeded our expectations for constant currency revenue growth. Revenue of USD 99.2 million grew at 27% year-over-year as reported and 32% in constant currency over prior year's achievements. We added 900 net new customers to our platform with sales across our 10 services and are -- today, 39% of our customers use 4 or more services, benefiting from our integrated suite of capabilities that combine security, data protection and integrity at high availability services.

Notable was the strong adoption of our targeted threat protection and internal e-mail protection services. Our ability to keep customers safe from advanced threats continues to distinguish Mimecast from competitors. Also, our awareness training service, which strengthens employee's cyber skills continues to see adoption as businesses across all industries can benefit when employees are kept aware of the threat landscape and how to deal with it.

So let's look at what's behind the demand we're seeing. Well, bad actors continue to assault organizations and target their data. Recently, we read about highly disruptive attacks on municipalities, resulting in system failures impacting tens of thousands of citizens. Other communities have been ransomed for the return of their data. And these headlines exemplify the need for strong cyber defenses, including protection from e-mail-borne threats and stronger data protection and assurance.

Additionally, we believe the regulatory environment has raised the stakes for organizations regarding the cost of breach data as recent fines levied under GDPR are orders of magnitude larger than previously observed. Our archiving services help organizations comply with a wide range of regulatory requirements, including GDPR, HIPAA and FINRA. We were recently recognized as the best e-mail security solution by SC Awards Europe. And this builds on our reputation as a leader and positions the company well for customers across the region.

Now I'm very excited to announce that Brandon Bekker, an almost 12-year veteran of the firm who previously led our African and Middle East business, has been elevated to a newly created role as the SVP of EMEA. Approximately half of our revenue today is generated outside of North America, and the EMEA region represents the majority of that. We're seeing exciting opportunities to continue our growth in our more mature markets like the U.K. and South Africa as well as continued successful expansion in the Middle East and Continental Europe. Brandon's experience leading growth from our South

Africa business will be a great asset as he supports the respective regional leaders. He'll be based out of London. I'd like to thank Brandon for his years of service and leadership within the company.

Now we continue to invest in the best people and provide a culture that encourages their best work. This enables us to innovate and deliver better protection and new functionality to our customers. The recently introduced Mimecast Threat Intelligence capability is seeing an excellent response from our customers with over 1,000 customers currently accessing the new Mimecast Threat Dashboard feature.

Our threat research group also recently published research regarding a Microsoft Excel weakness, allowing it to be exploited by a remote payload. Mimecast customers are protected from this type of exploit being trafficked through e-mail and through our advanced deep pausing and deobfuscation techniques, technologies that came through our acquisition of the Solebit business in Israel last year.

In past calls, I discussed our deep application interface capabilities enabled through Mime|OS. After several quarters of increasing use of our APIs and a rapidly growing ecosystem of companies relying on these services, we've now launched our Cyber Alliance Program to allow tighter

Integration between security vendors and our platform, benefiting customers further.

Partners also benefit by deploying integration solutions from multiple vendors that are more effective and easier to manage. And currently, we have over 100 API integrations with leading vendors like Splunk and Palo Alto benefiting from this program.

One of the largest security buyers in North America recently deployed a solution for customers leveraging threat intelligence from Fortinet and Mimecast integrated through our

API with Splunk Phantom for orchestration and remediation of threats. These integrations that support custom use cases with greater flexibility are of particular interest to our larger customers.

I'm excited to announce that we are hosting our first major global customer event in October. The Mimecast Cyber Resilience Summit will bring together IT and security professionals within our customer base to learn, network and focus on best practices. Until now, our rapidly growing user community has existed virtually in an online forum, which we call Mimecaster Central. Bringing this group together physically will strengthen our ties and promote deeper levels of understanding of each other and our technologies.

Additionally, we're announcing that we'll be hosting an Investor Day in early calendar 2020. And we look forward to connecting in person with our analysts and shareholders. And we'll share some additional details as we draw closer to the event.

Now let's have a quick look at some examples of the types of solutions that we're providing customers. Firstly, a cybersecurity company of about 9,000 employees was exposed to spearfishing and zero-day

Attacks and required a solution to protect against the latest impersonation or whaling attacks in their Office 365 deployment. Additionally, this customer sought to automatically remove internal e-mails containing malicious content, freeing up resources and simplifying IT. Mimecast was evaluated against other leading vendors and selected for our ability to keep this customer safe with our cloud-native architecture and our flexible integration to their SIEM environment enabled through our APIs.

And secondly, an enterprise software company with 18,000 users who's running an on-premise e-mail security system found it increasingly difficult and costly to respond to the latest threats with this platform. Mimecast was evaluated alongside 2 other leading security vendors, and we were selected for the efficacy of our advanced threat detection, the simplicity of our user experience and the flexibility we offered to work with their identity system.

Thirdly, a U.S. health care company with about 27,000 employees was using another e-mail security solution, and they look to add an advanced archiving solution to better manage and protect unstructured data. Now the tight integration of the Mimecast platform offering not only advanced security and daily prevention but also uptime assurance and archiving together proved to be very compelling. Additionally, our awareness training service was selected to replace their existing vendor in the space, making this a great solution for the customer and an exciting multiproduct deal for Mimecast.

Finally, an existing Mimecast customer with about 65,000 employees sought to add additional protection from threats originating within their organization. So they upgraded from our S1 offering to our S2 bundle that includes Internal Email Protect. Now with IEP, they gained the ability to automatically hunt for and remediate threats inside their e-mail network. These newer innovations on our platform are helping to make Mimecast more sticky and grow the lifetime value of our customer relationships.

So in summary, we had another strong quarter, exceeding our guidance and attracting new customers to our platform. Growth drivers fueling our success remain in place as we execute on the large opportunity in front of us and further penetrate the global market for cyber resilience services. The competitive environment remains favorable as we continue to innovate and deliver advanced solutions that address today's requirements.

Now let me turn the call to Rafe Brown, our CFO, to review our results in more detail. Rafe?

--------------------------------------------------------------------------------

Rafeal E. Brown, Mimecast Limited - CFO [4]

--------------------------------------------------------------------------------

Thank you, Peter. I'm pleased to report that for the first quarter of fiscal 2020, we exceeded the high end of our guidance for both revenue and adjusted EBITDA. Despite significant currency headwinds, in the first quarter, we generated revenue of $99.2 million, which represents growth of 26.6% over the prior year in absolute dollar terms. Adjusting for the $4 million of currency headwind we faced, our constant currency growth rate over the prior year stood at 31.7% for the quarter. Since providing guidance last quarter, foreign currency negatively impacted our first quarter results by $400,000.

Adjusted EBITDA for the first quarter totaled $13.5 million, representing an adjusted EBITDA margin of 13.6% compared to $10 million or 12.7% in the same quarter of the prior year.

On a net basis, we added 900 customers in the quarter, in line with the first quarter of last year. Our total customer count now stands at

35,300.

Consistent with recent trends, we saw an increase in our average order value driven by both customers buying multiple services from us and the mix shift whereby we are now selling to a blend of larger customers. Currently, the average order value of all customers stands at 11,300, up approximately 15% in constant currency terms.

Average services per customer across our base increased to 3.2 services per customer. Our positive trend with customers using Microsoft Office 365 continued in the first quarter with 46% of our customers now using Mimecast in conjunction with Office 365, up from 34% in the first quarter of 2019. Particularly compelling with customers using Office 365 is the fact that they continue to purchase a higher number of services per customer, 3.5 services per customer compared to 2.9 services for customers not using Office 365. Importantly, our trailing 12-month revenue retention figures remained strong at 111% as our existing customers continue to renew their subscription and purchase additional services.

From a geographic perspective, the United States and Australia turned in solid first quarter performance against our expectations. We continued to see growth in the EMEA region, but know we saw some softness within the region in the back half of the quarter. Given there are a number of factors complicating the business environment across the EMEA region, including the current U.K. political situation, which is significantly impacting the pound, and political challenges within South Africa and their impact on its economy, we are watching our performance within this region closely. This said, as you will see in our guidance, we remain confident in our ability to achieve our full year performance targets.

Turning to gross margin for the first quarter. We recognized a 75.8% non-GAAP gross margin, up 190 basis points from Q1 of the prior year. First quarter non-GAAP operating expenses totaled $68.6 million compared to $54 million for the same period in the prior year. Non-GAAP R&D expense stood at 17% of revenue in Q1 compared to 15% for the same period in the prior year. This increase reflects our view of the importance of investing in our product offerings and the differentiated services we deliver to our customers. Non-GAAP sales and marketing expenses increased in absolute dollar terms but declined to 39.9% of revenue, down from 41.3% of revenue for the same period of the prior year. Non-GAAP G&A expense was 12.3% of revenue, down slightly from 12.6% of revenue in the prior year. Improving the efficiency of our G&A functions over time is an organizational priority, and we expect G&A to gradually be a source of leverage in the coming quarters.

Adjusted EBITDA was $13.5 million in the first quarter, representing an adjusted EBITDA margin of 13.6% compared to $10 million or 12.7% in the same quarter of the prior year. Our non-GAAP operating profit for the first quarter was $6.6 million or 6.7% of revenue, up from $3.9 million or 4.9% of revenue in the prior year.

In bottom line terms, our first quarter GAAP net loss was $4 million or a loss of $0.07 per basic and diluted share based on 61.4 million weighted average shares outstanding. This was net of stock-based compensation charges of approximately $10 million and tax charges of approximately

$230,000. We expect full year GAAP tax charges to be approximately $2.5 million, a slight improvement since our last projection. Our non-GAAP net income for the quarter was $5 million or $0.08 per diluted share based on 63.9 million fully diluted weighted average shares outstanding.

Our non-GAAP tax rate was 31.5% for the quarter. We continue to project a full year non-GAAP tax rate of approximately 31%.

Turning to cash flow. Our operating cash flow for the first quarter totaled $28.5 million compared to

$16.6 million in the same quarter of last year, even net of the approximately $7 million benefit from the advanced payment of our tenant improvement allowance that I mentioned in our prior earnings call. This represents a nice uptick in our operating

Cash flows driven by strong collections in the first quarter. We generated $19.4 million in free cash flow for the quarter compared to $9.1 million in the previous year. And as a reminder, in last quarter's earnings call, we discussed the fact that office build-outs and grid expansion would drive unique CapEx requirements during FY '20. With these projects now underway, we expect our Q2 capital expenditures to total approximately $16 million.

Turning now to the balance sheet. And as of June 30, Mimecast had $196.8 million in cash and short-term investments. The balance sheet also reflects the adoption of the new lease standard, ASC 842, the summary effect of which is to gross up the balance sheet by approximately $110 million, adding both leased asset and lease liability lines.

Noting that currency headwinds at present have become quite challenging, let me now turn to guidance. For the second quarter of fiscal 2020, we expect year-over-year constant currency revenue growth to be in the range of 26% to 27% and revenue to be in the range of $101.1 million to $102.1 million. Our guidance is based on exchange rates as of July 31, 2019, and includes an estimated negative impact of $2.3 million resulting from the strengthening of the U.S. dollar compared to the prior year. Adjusted EBITDA for the second quarter is expected to be in the range of $17.6 million to $18.6 million.

Full year fiscal 2020 revenue is expected to be in the range of $414 million to $422.6 million or 25% to 27% growth in constant currency terms. Foreign exchange rate fluctuations are negatively impacting this guidance by an estimated $11.1 million compared to the rates in effect in the prior year. The prior guidance for fiscal year 2020 provided in May was $420.3 million at the midpoint. Our overachievement in Q1, coupled with the strength we are seeing in our business, is leading us to raise the midpoint of our full year guidance by $3.8 million in constant currency terms. However, this raise of $3.8 million is being negatively impacted by $5.8 million of foreign exchange headwind that has risen just since the rates used in our May call, resulting in the midpoint of our full year guidance moving down by $2 million in absolute dollar terms from $420.3 million to $418.3 million. Full year 2020 adjusted EBITDA expectations are being raised to a range of $71.6 million to $73.6 million.

In summary, I am pleased to see that despite currency challenges, the Mimecast team was able to once again deliver a result that exceeded our expectations and that we are raising our full year guidance for revenue in constant currency terms and for EBITDA in both constant currency and absolute dollar terms.

With that, I would like to thank you for your time. And operator, can you please open the line for questions?

================================================================================

Questions and Answers

--------------------------------------------------------------------------------

Operator [1]

--------------------------------------------------------------------------------

(Operator Instructions) Our first question comes from Don DiFucci with Jefferies.

--------------------------------------------------------------------------------

John Stephen DiFucci, Jefferies LLC, Research Division - Equity Analyst [2]

--------------------------------------------------------------------------------

And it's -- never mind, Don DiFucci, just maybe...

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [3]

--------------------------------------------------------------------------------

I think it's [DiFucci], John.

--------------------------------------------------------------------------------

John Stephen DiFucci, Jefferies LLC, Research Division - Equity Analyst [4]

--------------------------------------------------------------------------------

You can kiss my ring next time. But anyway, Rafe, thank you for all the detail on the foreign exchange, especially its impact on guidance. That's really helpful. I guess my question is something that came up -- I think I was looking at the transcript for last quarter, and I looked at the cash flow statement this quarter in CapEx. I know you talked about building out the infrastructure and office space. But this quarter -- you had mentioned something last quarter about a $5 million onetime CapEx this quarter, I think. And it looks like you had it. It was in there. Can you give us a little more detail on this? I think you spoke about like a North American opportunity. Is this -- can you give us a little more light on that?

--------------------------------------------------------------------------------

Rafeal E. Brown, Mimecast Limited - CFO [5]

--------------------------------------------------------------------------------

Sure. And let me just start with a quick refresher on some complicated discussion from last quarter. We called out that there would be some onetime CapEx investments that take place this year totaling $28 million. It's largely the office build-outs in London and South Africa and then the grid expansion that you just referenced. Actually, those are really kicking in going forward here over the next few quarters. So the grid expansion is still yet to come. In the quarter, we did receive and got a benefit from a tenant allowance that I had mentioned that as well last quarter. That actually flows through operating cash flow if you're tracking it down, but no, we still had really a nice uptick in operating cash flow even having backed that out. What you would expect then is the CapEx as it's building over the next 3 quarters, both on the real estate front and the grid expansion to take place. And I would call it, just to kind of help everybody with all this complicated math, that we're expecting total CapEx of approximately $16 million in Q2.

--------------------------------------------------------------------------------

John Stephen DiFucci, Jefferies LLC, Research Division - Equity Analyst [6]

--------------------------------------------------------------------------------

Okay. Okay. Great. And that grid expansion, is that just an increase to just be able to handle more capacity just generally in North America? Or is it something specific beyond that?

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [7]

--------------------------------------------------------------------------------

Yes. So John, we haven't announced more specifics on it, but it's a discrete additional opportunity in the North American region that we would put down a new good facility for.

--------------------------------------------------------------------------------

John Stephen DiFucci, Jefferies LLC, Research Division - Equity Analyst [8]

--------------------------------------------------------------------------------

Okay. Okay. Cool. We look forward to hearing that. And we also look forward, Peter, for your first customer event and actually the Analyst Day, too. So that's good to prepare for. I guess one other question. It sounds like things are humming along. You guys have been putting up above 30% constant currency growth for some time now which

Is pretty impressive. And you're doing it in a market which I think is underappreciated as far as the size of the market because not just e-mail security but the archiving and the continuity. But I've often -- it seems to me that given the architecture that you have that there's other things that you could be moving into. And I'm just wondering if you could talk a little bit about that, Peter, perhaps like what areas -- like one of the areas I think about is identity, but I'm just curious if you have any thoughts on that or any other areas and -- that makes sense for Mimecast to become more relevant in.

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [9]

--------------------------------------------------------------------------------

Yes, that's a great question. So I think as you identified, there's sort of 2 interesting pieces. The one is this underlying integrated architecture that's a micro services architecture we call Mime|OS and the fact that it's multi-tenant that allows us to provision and serve a very large customer base with a very smooth and cost-effective provisioning capability and then be a multiproduct suite on top of that with this contiguous suite that we built up that really deals with a large number of use cases very efficiently, simplifying IT for customers but on the other hand, being very margin accretive for us as customers buy more of the products over time.

And what we've done, obviously, we started out and we have a very strong heritage in the e-mail-centric use cases, and a considerable amount of our growth has been derived in this very important area of e-mail security and many of the additional requirements that have been needed over the last few years around targeted threats and ransomware and impersonations and so on. But we've been able to leverage this platform to expand into some additional adjacencies. And sometimes, we've used M&A to capitalize those, not necessarily buy a full stack capability somewhere else and then sort of host that and pretend that it's part of the suite when it's really independent. But we've been able to acquire componentry and skills and domain expertise in other areas like web security and like user awareness training and then expand the continuous suite into that.

What's interesting is those are discrete sort of monetizable use cases on their own, but what we're finding is that as we have more and more of these capabilities that allow us to craft unique value propositions that sort of exist at the intersections of these things. And we're very excited about what that is setting us up to be able to do in the coming years to really change the frame of how our customers think about solving cyber resilience and security solutions.

Now there are numerous areas. Just a walk around a show like RSA will tell you that there's an infinite amount of complexity that customers are having to deal with. Identity is an important area. And it's an area where there are many vendors in, and there are many different sort of flavors of requirement. And without talking about any specific areas that we may or may not head into, what I would say is we've really invested in our API strategy so that we can -- with or without having modules of capability in a particular space, we have the ability to integrate seamlessly with other applications, be those other players, strong players in identity or next-generation firewall or endpoint security or SIEM or SOAR type functionality. Our API strategy and the new Cyber Alliance partnership program that we've just announced really helps us to continue that promise of strengthening cyber resilience and security but also simplifying it at the same time for customers.

--------------------------------------------------------------------------------

Operator [10]

--------------------------------------------------------------------------------

Our next question comes from Matt Hedberg with RBC Capital Markets.

--------------------------------------------------------------------------------

Matthew George Hedberg, RBC Capital Markets, LLC, Research Division - Analyst [11]

--------------------------------------------------------------------------------

So in the prepared remarks, I think, Rafe, you mentioned you were watching the U.K. and Australia. It certainly sounds like you had good results. And obviously, the guidance would imply you guys are probably not seeing anything. But I just wanted to maybe dig into that comment a little bit more. I mean, you called it out. Just a little bit more color around some of the specifics on those 2. Obviously, Brexit. But is it change in customer buying? Some -- just a little bit more detail there would be helpful.

--------------------------------------------------------------------------------

Rafeal E. Brown, Mimecast Limited - CFO [12]

--------------------------------------------------------------------------------

Yes. At the end of every quarter, we have our QBRs with all the sales teams worldwide and had a number of discussions. And I don't think that we could say there's anything like that going on. It is a bit of a complicated time. For the U.K., it's certainly showing up in the pound. But it does seem like it's a bit of a cloudy time in terms of overall confidence and direction in the country. So we're just paying particular attention to it to make sure that we're on top of anything that happens there. And as you noted, being able to have a nice beat on the quarter and have constant currency revenue growth at 31.7% as well as to be able to raise the full year guidance, it kind of gives you the bigger picture of how we're looking at it.

--------------------------------------------------------------------------------

Matthew George Hedberg, RBC Capital Markets, LLC, Research Division - Analyst [13]

--------------------------------------------------------------------------------

Yes, it certainly didn't look like it showed up in numbers or guidance. So that's great. And then I guess, Peter, you mentioned on the call sort of when you started off, you saw strength in TTP, which we've seen. But you continue to call out IEP. I believe it has about 3,000 customers. That's great. I mean, the product hasn't been in the market that long. If you look at longer term, I think we're often asked, what is the next TTP product? I mean does IEP have that potential to get to some of the same attach rates longer term? And is that the kind of product that you -- or the demand that you're seeing here?

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [14]

--------------------------------------------------------------------------------

Yes, I think that's a great question. We -- the TTP has been such a runaway success and such a great driver of growth. It's an obvious question, what's the next TTP. And we have several products that perhaps collectively can conspire to create the next TTP-like effect. And so it's difficult to forecast what the trajectory and timing of any one of those offerings is going to be. I think IEP is a very compelling capability. It's a very natural addition to a TTP customer to buy it, and we're seeing strong interest in it. I think it also very much fits this kind of zero trust model where you think about traffic and people on your -- inside your network and inside your environment. You sort of treat them with the same level of scrutiny and suspicion from a cybersecurity point of view as you do to your external parties.

And so IEP really brings that sort of zero trust strategy dimension to your east-west traffic and traffic that's trying to get outside of -- get out of your network from within and providing that scrutiny and that assurance to that traffic from both a deadly prevention and also from a sort of malware or other kinds of nefarious content that an attacker might be trying to leverage from inside your organization once they've gotten in. So yes, I think IEP is a really, really exciting product, and we continue to evolve it and add capabilities and tie it in with our threat protection and IEP strategy, too.

--------------------------------------------------------------------------------

Operator [15]

--------------------------------------------------------------------------------

Our next question comes from Saket Kalia with Barclays.

--------------------------------------------------------------------------------

Saket Kalia, Barclays Bank PLC, Research Division - Senior Analyst [16]

--------------------------------------------------------------------------------

Pretty straightforward quarter on the results. Maybe just a higher-level question for you, Peter Bauer. A nice uptake -- continue to see a nice uptick in security awareness training. As that business gets more settled in at Mimecast, can you just talk about whether the buyer there is usually the same that Mimecast usually sell to? And then just strategically, if you put yourself into the seat of the customer, is there any synergy for a customer to buy their e-mail security tool and their security awareness training tool from the same vendor? Can you just talk a little bit about the synergies between those 2 businesses, if you will?

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [17]

--------------------------------------------------------------------------------

Yes, that's great. So awareness training, big issue for organizations. The employee is being a very important part of the cybersecurity framework, historically referred to as the weakest link, and increasingly with vendors like us providing options to really enroll the employees as allies in the security program, which requires education and compelling content and forms of engagement that really drive up their awareness and make them a lot more cybersecurity savvy. That is very important. Now it's interesting in terms of who buys that. Frequently, it is the security team that's looking at this and is given this as a task to go and fulfill. And particularly where they're looking for telemetry or measurements, they want to be able to benchmark how susceptible employees are to scams and to threats. And so that aspect of the product appeals to security folks.

Where the compliance buyer comes into it quite frequently is really around the training, have employees consumed training and have they assimilated the information and the knowledge that was expected from that training. And so in terms of that, there is quite often on the

Compliance side of the organization, some budgets and some motivation to drive that. So we see that as well on compliance and risk management and then on the IT side as well.

Now your question of is this -- does this fit naturally or more naturally with a gateway provider, we certainly think so. And we've certainly seen a lot of enthusiasm for our combined offering and particularly the road map that we've been articulating where we can take sort of actual employee behavior and incorporate that into the telemetry that security folks are looking for. And we can take actual live threats that have been targeted at an organization, and we can defang those essentially and release those and use those as phishing simulations rather than having pure template driven or more fictitious phishing simulations that you're trying to arrive your benchmarking from.

So we think there's really strong synergy. There's obviously strong operational synergy because it allows the administrator who's trying to take care of e-mail security and trying to set up policies to have this extra tool in their tool bag directly within the administrative and management sort of paradigm and tool set that they're using with us. And so we do think that it makes a lot of sense as part of a suite and as opposed to just being a stand-alone option.

--------------------------------------------------------------------------------

Saket Kalia, Barclays Bank PLC, Research Division - Senior Analyst [18]

--------------------------------------------------------------------------------

Makes sense. Rafe, maybe for you, just a quick follow-up. Obviously, I think we all see the FX variability on the top line, especially for some key currencies like the pound and the rand. But just for the benefit of everybody in the call, can you just remind us of the amount of expenses that you have in those currencies as well -- in those respective currencies as well so we could just think about the degree of natural hedging?

--------------------------------------------------------------------------------

Rafeal E. Brown, Mimecast Limited - CFO [19]

--------------------------------------------------------------------------------

Yes. We actually have quite a nice level of natural hedging overall. So typically, on the bottom line, it is just a de minimis impact. So that's why we don't really break out those figures on constant currency numbers. As you're probably aware, the company started in the U.K., and it's our largest office by headcount. So the natural hedges to the income statement are quite helpful.

--------------------------------------------------------------------------------

Operator [20]

--------------------------------------------------------------------------------

Our next question comes from Keith Bachman with BMO.

--------------------------------------------------------------------------------

Keith Frances Bachman, BMO Capital Markets Equity Research - MD & Senior Research Analyst [21]

--------------------------------------------------------------------------------

I wanted to ask 2 questions, if I could. The first is on the competitive landscape. And there's been some indirect questions around this. But I think there's a growing investor concern that eventually

Microsoft will become more competitive just like they did with -- over some period of time with Power BI versus the data visualization vendors. And so are you seeing any changes in your win rate? And the corollary, the question is going back to what Don Juan DiFucci was asking, is on adding to the value proposition. And I understand you want to -- you partner in certain areas. But just how do you approach the partner versus build? Because while I think that's a worthy strategy, you could see the value creation going on. And just to pick an area of the identity folks, there's a lot of value in that area. So if you could just talk a little bit about your competitive wins and how that might or might not be changing and then how you approach the build versus buy or partner thesis to try to create sustained differentiation.

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [22]

--------------------------------------------------------------------------------

Yes. So Keith, great. Yes. So firstly, just on the competitive front, I think we've seen a pretty consistent competitive landscape. Microsoft, in particular, our win rate with Office 365 continues to be strong. We now have 46% of our customers using us with Office 365, and that's up from 34% a year ago. And those customers, they buy more products, as we've discussed beforehand. They're on about 3.5 products on average per customer versus 3.2 products as of the average across our base. So we're seeing continued popularity of our offering with 365.

And I think that is -- a fair amount of that has to do with our efficacy and the value that we add as an additional layer of e-mail security but also the broader value proposition. And I think you're talking a little bit to that in terms of expanding the suite, the things like data protection and archiving, the business continuity capabilities that we offer to 365 and on-premise exchange as well, our secure messaging offering, our large file transfer offering, some of the unique capabilities around awareness, training and web security. So that is driving demand broadly, but a fair amount of the demand continues to be the importance of having really robust e-mail security protection on top of 365.

Generally, from a competitive landscape point of view, a great quarter with 900 new customers coming onto the platform and continued upsell within the base with 39% of our customers now having 4 or more products. So we feel really good about the value proposition and the strength of the platform today.

And as we look out at the buy versus build capability or partner versus build or buy opportunity, I think we have to be pragmatic. We can solve lots of problems for customers with things that we built and extend it into the suite. But we want to make sure that we're building things that we can introduce and then mature and really win that over time by adding maturity and capability and that we can compete both in terms of a feature function point of view as well as the value of having stuff within a suite on the unfair advantages that we have through the deep integration of our platform.

So we're mindful of that, and we're really opening up with the API strategy to allow partners and to allow other vendors to create a much broader solution set that we can be part of within the security ecosystem. And that's something we've heard time and time again from customers that they have a real appetite for. And because of our cloud architecture and our cloud native architecture that we built from day 1 on, we have a tremendous advantage in terms of being able to expose really easy-to-consume, consistent APIs across the platform, across all of the features and functions of the platform and introduce those to

Partners. And likewise, when we identify partners or players in the market that we may want to acquire and then bring in as part of an integration, that same API strategy really allows us to make that available to customers in a simpler and more easy to consume and well integrated fashion as well.

--------------------------------------------------------------------------------

Keith Frances Bachman, BMO Capital Markets Equity Research - MD & Senior Research Analyst [23]

--------------------------------------------------------------------------------

Okay. Yes, it's a tricky balance, tricky balance. And I'll just sneak my last one in, and I'll cede the floor. If you could just give a quick update on Germany. You mentioned U.K. and South Africa were weak. But just any updates on Germany, and that's it for me.

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [24]

--------------------------------------------------------------------------------

Yes. Great. So Central Europe, we -- as you know, we put on our data centers there in the summer of last year. So coming up for a full year. And we've hired a team in that market. It's a really large market opportunity. From a revenue point of view, it's going to take a while before it shows up in revenue, largely because we have -- these other large regions that are also growing really quickly. So we're adding customers, and it's a really positive market opportunity and something as well that we're excited about the opportunity, particularly seeing some of the things going on with GDPR now in that marketplace.

--------------------------------------------------------------------------------

Operator [25]

--------------------------------------------------------------------------------

Our next question comes from Sterling Auty with JPMorgan.

--------------------------------------------------------------------------------

Matthew Melotto Parron, JP Morgan Chase & Co, Research Division - Analyst [26]

--------------------------------------------------------------------------------

This is Matt on for Sterling. So I actually have 2 questions, the first of them being you mentioned 46% of the customers are already using Office 365. So shouldn't most of the large customers move already to that? And if so, what do you guys think is left to penetrate? And then in terms of the product mix, I know you guys mentioned a couple of highlights, but are there any changes in the mix of products that you're seeing the biggest uptake?

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [27]

--------------------------------------------------------------------------------

Yes. Great, Matt. So Office 365 penetration within our basis of 46%, I think we've said this on prior calls as well that the percentage of our new business that we signed in quarter, so the new cohorts that we're bringing on, the percentage of those customers using Office 365 already is, as I said, higher than 46%. More than half of our new business comes with Office 365.

So from a business growth point of view, while the migration to 365 and the activity that they consider when they're planning a move, while that certainly has been a catalyst to finding and signing up with us, we're seeing real interest with customers that are already on Office 365, adding us after the fact to their accounts. So that's a positive event. And if you wouldn't mind just repeating, what was the second part of your question?

--------------------------------------------------------------------------------

Matthew Melotto Parron, JP Morgan Chase & Co, Research Division - Analyst [28]

--------------------------------------------------------------------------------

Yes. So in terms of the business mix, the product mix, is there any difference that you guys have seen in the mix of products? Which products are you seeing the biggest uptake?

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [29]

--------------------------------------------------------------------------------

Yes. Great. So the core e-mail security with TTP and IEP continue to be the strongest use case and drivers of new business. We've had some good growth with archiving, too. That's been an interesting progression. So we've done some things with our archiving product lately that I think explain it. So we're now at 14,800 archiving customers, adding about 300 new customers last quarter alone. And we have a leadership position from an archiving perspective for the fourth year in a row. I think we're one of the highest ranked leaders in the Gartner Magic Quadrant for enterprise information archiving and certainly -- probably one of the largest scale cloud archiving providers in the market today. We have very large volumes of data and over 300 billion e-mails that we manage within the archive. And that's all the attachments and other content associated with it.

So it's a unique value proposition that deals with not just compliance but also data protection and recovery business value, APIs for developers to have opportunities to interact with the data as well. So a really good home for companies to put their unstructured data for a long-term retention and management of that data.

But the 2 things that we've added recently to the platform are tools for the financial services vertical. So supervision tools for FINRA and the immutability requirements of the Section 17a-4, the certifications that we needed around that, which is relatively new. So it's surprising in the sense that we've been able to build quite a formidable archiving business with that, particularly going deep on the financial services vertical. So we're excited now to have more of those capabilities.

And then secondly, there's still a fair-sized opportunity in legacy archiving with organizations having on-premise archives, full of data that are very difficult to get away from and get off those older platforms and dealing with that format. So the Simply Migrate acquisition that we did earlier this calendar year is really enabling us to provide a much more seamless end-to-end experience for migrating data, a more cost-effective experience for migrating data out of legacy archives on to our platforms. So that's been another really key part of our growth story this year and this past quarter, too.

--------------------------------------------------------------------------------

Operator [30]

--------------------------------------------------------------------------------

Our next question comes from Catharine Trebnick with Dougherty.

--------------------------------------------------------------------------------

Catharine Anne Trebnick, Dougherty & Company LLC, Research Division - VP and Senior Research Analyst of Data & Internet Protocol Networking [31]

--------------------------------------------------------------------------------

Nice print with the headwind. So Peter, in your prepared remarks, you talked about some new customer wins that you had some relationships with Fortinet and Palo Alto. So it seems like -- and it had to do with your new API strategy. Can you just level base me on when you started working with these different vendors and implementing the API strategy and how you've introduced that into the channel such that you're getting some good traction on this?

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [32]

--------------------------------------------------------------------------------

Yes. Thanks, Catharine. So we have certain of the relationships with vendors directly collaborating and working on integrations, and we'll certainly be talking more about that over the coming months. I think the example that we called out there in particular was actually driven by a channel partner. So it was a channel partner that was working with a customer and builds out leveraging the APIs, pulls together the integration between ourselves and some of the other vendors that the customer had in their environment or was part of the solution that the partner themselves is bringing to the table.

So I think the beauty of the API strategy is that while we may sort of legislate for certain outcomes and invest in certain capabilities and provide those to the market, it really does afford us an opportunity to benefit from an organic and really flexible set of innovations and customer solutions that really are outside of our control and don't really require much effort from us at all but bringing together much better solutions for customers and at the same time, underlying the relevance and the value that we provide as being part of that ecosystem and part of that stack. And so we're delighted about that.

And really, our focus today is on educating partners about those possibilities and those opportunities and then bringing more sort of prepackaged integrations and design wins and scenarios to our partners and to our customers so that they can really get on board on this train and have Mimecast adding value to the broader set of solutions that they're selling or implementing or managing in their environment.

--------------------------------------------------------------------------------

Operator [33]

--------------------------------------------------------------------------------

Our next question comes from Jonathan Ruykhaver with Baird.

--------------------------------------------------------------------------------

Jonathan Blake Ruykhaver, Robert W. Baird & Co. Incorporated, Research Division - Senior Research Analyst [34]

--------------------------------------------------------------------------------

Looking into the opportunity to increase average order value, the key levers include upsell, cross-sell and growth to large accounts. So Peter, when I'm looking at your expectations for fiscal '20, can you kind of help us frame those 2 levers? Should we anticipate maybe lower net new customer adds but larger-size customers to be the more material dynamic relative to upsell, cross-sell? Or will it be fairly balanced?

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [35]

--------------------------------------------------------------------------------

Yes, I think it's balanced. So I mean it's difficult to break out exactly how that's going to play out. I think the one trend that we do see is that in that net adds number, we generally are -- where there's churn, it's on the lower end, the sort of sub-50-seat space. And generally, we are replacing those churns with larger customers. And generally, over time, we're finding new customers who may have started their journey with 1 product or 2 products are now starting their journey with us with perhaps 2 products or 3 products.

So we're getting not only slightly larger customers into the base. And bear in mind, it's a big base. So this takes time to change and evolve. We're getting bigger customers into the base. We're also getting slightly bigger initial product adoption and purchases. And then naturally, as our portfolio has broadened up and we've got even more to offer customers, that upsell and that cross-sell opportunity is there and that -- supporting that gross revenue retention number, which is an important part of our growth as well.

--------------------------------------------------------------------------------

Jonathan Blake Ruykhaver, Robert W. Baird & Co. Incorporated, Research Division - Senior Research Analyst [36]

--------------------------------------------------------------------------------

Yes. Okay. That makes sense. And the other question I had is on the Solebit acquisition. I think it's been about a year. But can you just talk about how that web security service is performing relative to your initial expectations? And given how competitive that market has been historically, just help us understand positioning differentiation relative to some of the more traditional web security products in the market.

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [37]

--------------------------------------------------------------------------------

Yes. Great. So just to clarify, yes, you're right. The Solebit acquisition is kind of 1 year and a week or something in terms of its anniversary since the acquisition. Solebit brought us a technology that was super innovative and unique in its ability to identify malware at high speed inside data files. So not particular to web security specifically but a broad-based technology that actually has enormous compelling value inside our e-mail stack, and we partnered with an OEM, the technology for them -- from them in our e-mail offering since it was part of the TTP offering for almost a year prior to that acquisition.

So we've got this tremendous engine, this capability, this unique ability to very efficiently find malware. And that has driven our efficacy program really strongly and helped us win several accounts competitively in the market and sustain our advantage for customers against a very dynamic threat landscape and in a competitive environment, too, as we've moved up market. So a really successful acquisition.

Now I think we mentioned at the time of doing the acquisition that the technology is really interesting because we also announced our, upcoming at the time, web security offering and that this technology will be relevant to our web security, and in fact, any other forms of security that required high-speed, deep inspection of data files for threats. And so that has been integrated into our web security solution and provides actually quite a nice differentiator for our web security offering as one looks at file downloads from websites, scanning those through the Solebit engine, provides additional assurance that bad files aren't easily coming in from websites, so from social media sites and things like that as customers surf the web.

I think the web security opportunity is a really large opportunity, as you pointed out. They are both newer companies that are gaining some momentum in that space. It's also a considerable amount of legacy installed base around web security on-premise technologies, UTM appliances and the like. And then there are also a considerable number of companies that, frankly, have no particular web security technology in place. They may just have a firewall on their network, and users are free to roam and do what they like on the web.

So we see all of those as opportunities. The high-end web security companies are not a good fit for every type of organization. It can be an overengineered solution. It can be an expensive solution. It can be more than what a customer needs. The UTM and appliance type solutions, the on-premise solutions, again, are not that fit for purpose in a cloud-first world. They have limitations. And then, of course, the greenfield scenarios where customers don't have anything at all. Each one of those is an opportunity for us, and we have a particular opportunity within our customer base where our customers have already chosen our deep technology and security stack for protecting them against e-mail-borne threats and are interested in leveraging that capability in web security.

So we're continuing to invest, and we're currently working on our version 1.3 of the product. We're adding customers. We've also just added an automated trial capability. I think that goes live right now where customers are able to -- existing Mimecast customers are able to discover this capability, switch it on for themselves, give it a whirl and deploy it and then make a purchasing decision afterwards with that. So there's a lot of work going into it, and we're excited about what it can represent as an opportunity going forward.

--------------------------------------------------------------------------------

Operator [38]

--------------------------------------------------------------------------------

Our last question comes from Eric Lemus with SunTrust Robinson Humphrey.

--------------------------------------------------------------------------------

Eric Carlos Lemus, SunTrust Robinson Humphrey, Inc., Research Division - Associate [39]

--------------------------------------------------------------------------------

But I just have one question for you. And I wanted to circle back to another asset that you guys added roughly a year ago with the awareness training. I just want to see, have you guys seen any change in what you guys are replacing in awareness training, whether it be a single point solution? Or is it mostly greenfield opportunities?

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [40]

--------------------------------------------------------------------------------

Yes. It's a great question. I think today, it's mostly greenfield opportunities. There is a little bit of competitive displacement. If we're displacing with our suite another vendor that might have had a part of this, we may have a competitive displacement. I think today, for the most part, it's greenfield opportunity. And the penetration of this type of solution is still probably less than 1/3 of the market has something like this today. So we're mainly picking up net new or first-time buyers of these types of technologies.

--------------------------------------------------------------------------------

Operator [41]

--------------------------------------------------------------------------------

Ladies and gentlemen, this does conclude the Q&A portion of today's conference. I'd like to turn the call back over to Peter Bauer.

--------------------------------------------------------------------------------

Peter C. Bauer, Mimecast Limited - Co-Founder, Chairman & CEO [42]

--------------------------------------------------------------------------------

Great. Folks, thank you for joining our earnings call this quarter, and we appreciate your time and your questions. We look forward to giving you our results again in a few months' time. Goodnight.

--------------------------------------------------------------------------------

Operator [43]

--------------------------------------------------------------------------------

Ladies and gentlemen, this does conclude today's presentation. You may now disconnect, and have a wonderful day.