ZeroFox Holdings, Inc. (NASDAQ:ZFOX) Q3 2023 Earnings Call Transcript

ZeroFox Holdings, Inc. (NASDAQ:ZFOX) Q3 2023 Earnings Call Transcript December 6, 2022

Operator: Thank you for standing by, and welcome to the ZeroFox Fiscal Third Quarter 2023 Results Conference Call. At this time, all participants are in a listen-only mode. After the speaker’s presentation, there will be a question-and-answer session and as a reminder, today’s call is being recorded. I would now like to turn the conference call over to Marc Griffin, Senior Vice President of Investor Relations for ICR. Marc?

Marc Griffin: Thank you, operator. Good afternoon, and thank you for joining us today to review ZeroFox’s fiscal third quarter 2023 financial results. With me on the call today are James C. Foster, or as many of you know him, Foster. Foster is the Founder, Chief Executive Officer and Chairman of ZeroFox. Also with me on the call is ZeroFox’s CFO, Tim Bender. After prepared remarks, we’ll open up the call for questions. During this call, we may make statements related to our business that are forward-looking statements under federal securities laws. These statements are not guarantees of future performance but rather are subject to a variety of risks and uncertainties. Our actual results could differ materially from expectations reflected in any forward-looking statements.

Forward-looking statements made today speak only to our expectations as of today, and we undertake no obligation to publicly update or revise them. For a discussion of the material risks and other important factors that could affect our actual results, please refer to the Risk Factors section of our SEC filings available on the EDGAR — the SEC’s EDGAR system and our website as well as the risks and other important factors discussed in today’s earnings release. Additionally, non-GAAP financial measures will be discussed in this call. Please refer to the tables in our press release and other investor portions of our website and a reconciliation of these measures to the most directly comparable GAAP financial measure. With that, I’d like to turn the call over to ZeroFox’s Chief Executive Officer, Foster.

Please go ahead.

James Foster: Thanks, Marc, and good afternoon, everyone. I am genuinely excited to speak with you today. This call represents an important milestone in our journey as we look to capitalize on the significant opportunity we see in external cybersecurity. Been a very nice quarter. And given this is our first call as a public company, I wanted to start off with a pledge, a pledge to be passionate and transparent with you on our business. And I believe as you get to know me, this becomes glaringly apparent. So let’s get started. In August, we were able to raise new growth capital, complete our strategic acquisition of IDX and finalized our business combination with the public entity, L&F Acquisition Corp. We are proud of the fact that we navigated these volatile equity markets, and even though it took a little longer than we had hoped, we emerged as the newly public ZeroFox.

We believe that ZeroFox now has the scale and platform depth to continue to build on our leadership position in the emerging external cybersecurity market. And as history has shown, the overall cybersecurity market is large, growing and evolving, we saw the emergence of significant market opportunities in areas like edge and endpoint security. These markets are now well established and have clear category leaders like CrowdStrike and SentinelOne and Endpoint and Palo Alto Networks and Zscaler on the edge. We believe that external cybersecurity is emerging as the next significant growth opportunity and that ZeroFox is well positioned to become the category leader. Furthermore, one of the fundamental truths I have learned over the course of my career is that customers and the market reward cybersecurity category leaders.

So what is external cybersecurity? External cybersecurity enables customers to expose, disrupt and respond to threats outside the perimeter. Traditionally, the focus of cybersecurity has been on protecting the assets that are owned and controlled by the organization. Owned assets include things like laptops, networks, systems, any of the cloud workloads. However, with digital transformation continuing to accelerate, the primary ways that companies interact and transact is now through digital channels and mediums, which require a different approach to cybersecurity. This movement has led to the proliferation of digital assets and data residing on external platforms that are outside the control of an organization. These platforms include things like the surface web, deep and dark web, social media sites, collaboration platforms, code-sharing sites and even mobile app stores.

And the result is that the public attack surface for every organization continues to grow, increasing their financial and reputational risk for these organizations. Adversaries have taken notice. This is reflected an increased targeted phishing attacks, account takeovers, credential theft, data leakage, domain spoofing and impersonations. All of these pose significant risk to organizations, their brands and their assets. And defending against this external cybersecurity group of threats is very challenging. Today, organizations have limited visibility to assets and systems they don’t know they own nor control. They simply can’t protect what they can’t see and they don’t know exist. Furthermore, continuous monitoring and protection of this external environment is difficult, given its size and dynamic unstructured nature.

We believe the solution to the external cybersecurity challenge requires a platform-based approach, and this is exactly what we have built at ZeroFox. Our External Cybersecurity Platform is cloud-native. We combine AI and full spectrum threat intelligence, adversary disruption capabilities and response services into an integrated solution that provides continuous protection and continuous response. The strategic acquisition of IDX was driven by our view that having a comprehensive technology-driven response capability is fundamental to solving the external cybersecurity challenge. IDX is one of the largest providers of breach response capabilities in the United States. They have several accolades to include providing services to one of the largest breach response contracts ever awarded by the U.S. federal government and protecting millions of individuals via our platform today.

Historically, ZeroFox’s capabilities were pre-breach with our 3 strategic pillars focused on protection, intelligence and disruption. And the IDX acquisition expanded our platform to include now an important fourth strategic pillar, post-breach response. We see multiple synergies with IDX. First, IDX accelerates our multi-pillar platform roadmap. While IDX provided us with core capabilities around response, it also enhances capabilities across all of our other strategic pillars. One example of this is our recent launch of PII removal. This is a new disruption service that helps organizations combat data broker websites that include personal identifiable information of individuals listed for sale on the Internet. This is an important capability for our customers and ZeroFox.

The second synergy is accelerating globalization. Today, nearly 100% of IDX’s business is in the U.S. We see an opportunity to leverage ZeroFox’s international go-to-market capability to globalize the full solution. On this front, we recently announced the expansion of our response services to now support multinational organizations. And last but not least, we see an opportunity to accelerate revenue by cross-selling and upselling our traditional capabilities to the new combined customer base. While we are still in early stages of integrating ZeroFox and IDX, we are excited about the progress we are making and the pace of our combined innovation. We expect to see IDX synergies become more meaningful over the next fiscal year. Now I’d like to change gears and discuss our third quarter.

Even though we operated in a partial quarter, I’m very pleased with our results and our execution. This is especially gratifying, given the current challenges in the macro environment. We reported total revenue of $43 million. And as you heard already, we launched several new joint capabilities. We have continued to see healthy growth and demand from both new and existing customers. Other cybersecurity category leaders have reported signs of increased scrutiny on deals, lengthening of sales cycles and softness in Europe. We too have seen signs of this. However, given our smaller size and emerging market, we are seeing consistent demand in North America and the rest of the world, of course, excluding Europe. Looking forward, I’d like to outline our 3 main priorities for the remainder of the fiscal year.

We are in our Q4. You’ll be able to remember these by the simple acronym, FOX. First, F is for focus. We will focus on executing our strategic plan to lead and grow our External Cybersecurity Platform capabilities and customer base. Success here will be reflected in our quarterly performance metrics. Second, O is for optimization. As a new public company, we’ll continue to optimize our infrastructure to support our near-term growth while also laying the foundation to efficiently scale the business over the next several years in anticipation of driving operational efficiencies, leverage and free cash flow. Lastly, X is for IDX. We will continue to thoughtfully and rapidly integrate our 2 organizations to realize the cost efficiencies and revenue growth that we know are possible.

These goals will not be achieved overnight. However, with the continued energy, passion and commitment of all of our Foxes around the world, I’m confident that we will continue to set the gold standard in external cybersecurity. With that, I’d like to turn the call over to our CFO, Tim Bender, who will provide more color on our financial performance, nuances of the transaction and Q4 guidance. Tim, the floor is yours.

See also 10 Best Jim Cramer Stocks To Buy Now and 16 Biggest Betting Companies in the World.

Tim Bender: Thanks, Foster. I would like to echo Foster’s excitement around the significant milestone we achieved in becoming a public company. And I’m even more excited about the opportunity we have to remain a market-leading external cybersecurity company. Before we take a closer look at our third quarter results, there are a few important points I would like to be sure to level set so you can better understand our story and measure our future progress. First, as Foster mentioned earlier, Q3 represents a partial period. The transaction closed on August 3, and accordingly, our Q3 results reflect the combined operations of ZeroFox and IDX from August 4 through October 31. Second, due to the accounting requirements of the transaction, the SPAC, L&F was deemed the accounting acquirer.

However, ZeroFox, Inc. is the predecessor entity for reporting purposes. This means that prior period financials presented reflect only the results of ZeroFox Inc. on a stand-alone basis and do not include the results of IDX. To assist investors with this lack of comparability, we have provided supplemental financial information that includes historical stand-alone financial statements for ZeroFox and IDX. This information can be found on our IR website. Now let’s take a closer look at our third quarter fiscal 2023 results. With the exception of revenue and unless otherwise stated, all financial results we will discuss today are non-GAAP financial measures. Reconciliations between our GAAP and non-GAAP results can be found in our earnings release.

For Q3, ZeroFox reported $43 million in revenue. Subscription revenue was $15.2 million. Subscription revenue primarily consists of revenue from the ZeroFox Platform. Services revenue was $27.8 million. Services revenue largely consists of revenue from breach response services as well as revenue from investigative and intelligent services that accompany the ZeroFox Platform. As of October 31, our annual recurring revenue was $153 million. We ended the quarter with 1,138 subscription customers. We continue to see a significant opportunity to both land new customers and expand platform capabilities and services within the existing customer base. Turning to gross margin. For the third quarter, non-GAAP subscription gross margin was 72%, and non-GAAP total gross margin was 40%.

We see opportunities to improve our overall gross margin as we scale our business, drive greater cost efficiencies and our higher-margin subscription revenue becomes a greater portion of our overall revenue mix. Turning to operating expenses. Total non-GAAP operating expenses were $23 million in the quarter. We continue to invest in R&D to drive innovation and remain a market leader. Regarding sales and marketing, we expect to spend more in absolute dollars to increase our go-to-market capabilities since we see a lot of white space in external cybersecurity. Taking a deeper look at G&A expenses, they were impacted by increased costs directly attributable to the transaction. We expect to absorb some additional nonrecurring transaction costs in the fourth quarter.

However, after that, we expect to see a more normalized run rate in fiscal 2024. Our non-GAAP loss from operations was $5.8 million. Looking at the balance sheet, we ended the quarter with $53 million in cash, $29 million in accounts receivable and $53 million in total deferred revenue. Our total outstanding debt was $171 million, including $150 million in convertible debt that was raised as part of the transaction. Provisions of the convertible debt provides ZeroFox the option to pay the interest in cash or to pay it in kind, thereby adding to the convertible note balance. The cash interest rate is 7% and the PIK rate is 8.75%. For our first interest payment due on December 15, we elected the PIK option. We reported $4.4 million of interest expense in the income statement, which reflects the PIK rate on the convertible debt and rising rates on our senior bank note which has a variable interest rate.

We believe the PIK option will provide us the opportunity and flexibility to prudently invest in the growth of our business. In our financial statements, you will see a $699 million goodwill impairment charge. This charge was attributable to the accounting treatment for the SPAC wherein L&F was the accounting acquirer but ZeroFox is the surviving entity. The August 3 closing day market valuation was used to determine the initial goodwill, and the subsequent decline in our stock price as of October 31 led to the impairment charge. The important takeaway is that this impairment charge has no impact on the operations of ZeroFox. Turning to cash flow. Cash flow used in operations was $22 million. Again, the cash flow presentation reflects the aforementioned accounting treatment for the SPAC.

The cash used in operations includes approximately $14 million in advisory, legal and other transaction costs associated with the capital release. As indicated earlier, we expect some additional impact from transaction costs in the fourth quarter and similar to our G&A expense, we’d expect these to moderate and normalize in fiscal 2024. Now to our outlook. We are certainly cognizant of the macro environment. However, based on what we are currently seeing, we remain confident in achieving our Q4 outlook. Based on our Q3 achievements, we are raising the low end of our previous guidance for the second half of fiscal year ’23 by $2 million, so we now expect revenue to be in the range of $84 million to $86 million. During our Q4 earnings call, we anticipate providing you with full year guidance for next year.

With that, we’d like to take your questions. Operator, please poll for questions.

Q&A Session

Operator: Our first question will come from the line of Brad Reback from Stifel.

Brad Reback: So as we think about the guide for 4Q and some of the commentary around optimization, obviously, you didn’t provide an op income range. But any thoughts on, should we be in the same ballpark? Or are there some of these onetime items that may cause that to deviate significantly in 4Q?

Tim Bender: Brad, this is Tim. I’ll take this one. Listen, I think from an OpEx standpoint, listen, we talked about we’re going to continue to make investments. But as we think about our OpEx, first of all, a partial quarter, albeit a few days will have an impact on Q4 so we’ll see a little bit more there. And then as it relates to kind of the mix, I think G&A will tick slight away from the transaction as some of those costs start to trickle away. But again, Q4 is generally a strong quarter for us from a sales standpoint, so you might see a tick-up in sales and marketing. But I think all in all, kind of that OpEx number, it should be relatively consistent.

Brad Reback: That’s great. And then Foster, over the years, you very effectively have used M&A to help augment your product set, obviously IDX being the biggest but some other smaller ones historically. What’s your philosophy here and now as it relates to M&A going forward?

James Foster: Yes, Brad, thanks for the question. I don’t believe it’s fundamentally changed in the previous years. I mean, in general, my bar when it comes to M&A is incredibly high. It starts with making sure the culture of the team that we acquire and merge with is on par or better than ours. We look to raise the bar every single time. I think we have a tremendous amount of work to do with IDX. We are focused solely on execution here in Q4 and setting us up with a strong foundation for next year. When we get through integration, we find new opportunities, we’ll kind of evaluate and address them as we see them.

Operator: Our next question comes from the line of Joseph Gallo from Jefferies.

Joseph Gallo: Foster, Tim, congrats on the results and getting the combined company out the door and publicly reporting. It’s got to feel good. And congrats on the results in a tough time. I’ve got a few questions, if I may. But maybe just to start with Foster. Foster, can you just talk about the combos you’re having with your current customers? What does their budgets look like? I know you said you’ve largely missed a lot of the macro, but maybe just drill down into that and how your customers are thinking about their spend environment next year? And where external threats fall in the priority stack for those customers.

James Foster: Yes. Thanks for the question, Joe. I think it’s a fair question. I think some of our customers are still evaluating and waiting to be given guidance from their executive teams on what full fiscal year budgets will look like next year. We get feedback from our customers that — I mean, we’re part of the critical modern security tech stack. I firmly believe in what we tell our customers, what we tell Wall Street and more importantly, where we see threats arising. And threats can attack the inside of your network. They can attack the perimeter and try to get inside, but they can attack the assets beyond that traditional perimeter. We have seen an increase in those attacks. I think our customers have taken note and also seen alongside of us that we are adding material and critical value to their stack.

And so I think where they are evaluating right now from our point of view is, will they get new budgets or will their budgets stay relatively consistent? And then I would also say, at any time when an economic situation looks like it’s less certain in the future than the past, people look for consolidation plays. And I think ZeroFox has got a potential advantage here where we are a platform. We’re no longer a product company, and we’ve got the opportunities to help our customers consolidate on a single pane of glass with a combined expanded vision of being that unified External Cybersecurity Platform.

Joseph Gallo: That’s great to hear. And maybe just as my second question for Tim. Maybe just since your first call with us like how should we think about your guidance methodology? And then in your fourth quarter guidance, does that imply things get better, worse or stay the same as it relates to macro? And then if you could maybe just provide some guardrails on how to think about profit inflection in the future, and what kind of underpins that forward leverage in what’s going to be a tougher environment.

Tim Bender: Sure. I heard a couple of several questions, so I’ll take them in kind of the order I have them in my head. I guess first is a macro environment, we talked about that and how it kind of maybe kind of affects our guidance. Listen, we know our has a lot going on. We see other companies reporting. We’re certainly cognizant of the impacts that we’re seeing. But as we sit here today, our demand remains steady, and so we’re going to be prudent in how we think about our growth. And I think how that dovetails into profitability, again, we’re going to invest in growth but we’re going to do so prudently. We know that profitability, it will be an important metric for us. And as we get into providing you fiscal ’24 guidance, we’ll update you at that time.

Just in general, as it relates to our guidance, we’re going to — we have our internal plans, where again, we’re stretching for growth. We know that’s important for a security, a software company of our size and scale. But again, I want to do that, like you said, in the full macro where we’re being conservative, where we’re taking an approach that sees what’s happening in the larger macroeconomic conditions.

Joseph Gallo: That’s helpful. And maybe if I can just squeeze in a clarification, but — so you gave $153 million of ARR. $83 million of that, I believe, is OPM. You could probably subtract out a handful of millions, low single digits for the rest of IDX. I think that gets you to like a mid- to high 60s core ZeroFox ARR number. Am I thinking about that correct if I look at kind of the supplementals you’ve had? Does that imply, call it, a low 30% ARR growth rate? And then I would imagine that implies that, that’s an acceleration versus the 24% last quarter. So is that true? And then what drove that inflection when most other vendors have seen kind of a moderation in growth rates?