Sophos Group plc Capital Markets Day
Transcript of Sophos Group plc Capital Markets Day
Sophos Group plc Capital Markets Day
June 29, 2016
Safe Harbour
The following presentation is being made only to, and is only directed at, persons to whom such presentation may lawfully be communicated (“relevant persons”). Any person who is not a relevant person should not act or rely on this presentation or any of its contents. Information in the following presentation relating to the price at which relevant investments have been bought or sold in the past or the yield on such investments cannot be relied upon as a guide to the future performance of such investments.
This presentation does not constitute an offering of securities or otherwise constitute an invitation or inducement to any person to underwrite, subscribe for or otherwise acquire securities in Sophos Group plc (the “Company”) or any company which is a subsidiary of the Company.
The release, publication, or distribution of this presentation in certain jurisdictions may be restricted by law, and therefore persons in such jurisdictions into which this presentation is released, published or distributed should inform themselves about, and observe, such restrictions.
Certain statements contained in this presentation constitute forward-looking statements. All statements other than statements of historical facts included in this presentation, including, without limitation, those regarding the Company’s financial condition, business strategy, plans and objectives, are forward-looking statements. These forward-looking statements can be identified by the use of forward-looking terminology, including the terms “believes”, “estimates”, “anticipates”, “expects”, “intends”, “may”, “will”, or “should” or, in each case, their negative or other variations or comparable terminology. Such forward-looking statements involve known and unknown risks, uncertainties and other factors, which may cause the actual results, performance or achievements of the Company, or industry results, to be materially different from any future results, performance or achievements expressed or implied by such forward-looking statements. Such forward-looking statements are based on numerous assumptions regarding the Company’s present and future business strategies and the environment in which the Company will operate in the future. Such risks, uncertainties and other factors include, among others: inherent difficulty in predicting customer behaviour; customers may not respond as we expected to our sales and marketing activities; the competitive environment; our ability to adapt to technological change; business interruption or failure of our systems architecture and communication systems; problems with implementing upgrades to our applications and supporting information technology infrastructure; any failure to properly use and protect personal customer information and data; our ability to manage and maintain third party business partnerships; increased regulation of our businesses; any failure to process transactions effectively; any failure to adequately protect against potential fraudulent activities; any significant quality problems or delays; the global macro-economic environment; our inability to attract, retain and develop talented people; our ability to repurchase shares; our inability to adequately protect our intellectual property rights; disruptions, expenses and risks associated with any acquisitions and divestitures; amortisation of acquired intangible assets and impairment charges; our use of debt to finance acquisitions or other activities; and the cost of, and potential adverse results in, litigation involving intellectual property, competition authority, shareholder and other matters. These forward-looking statements speak only as at the date of this presentation. Except as required by the Financial Conduct Authority, or by law, the Company does not undertake any obligation to update or revise publicly any forward-looking statement, whether as a result of new information, future events, or otherwise.
2
Agenda
Strategy Kris Hagerman 20
Product
Overview Joe Levy 20
Sophos Central Bill Lucchini 15
Enduser John Shaw 20
Network Bryan Barney 20
Strategy and Product Q&A session Kris, Joe, Bill, John, Bryan 20
Break 20
Go-To-Market
Channel strategy Mike Valentine 10
Marketing Matt Fairbanks 10
GTM Q&A session Mike and Matt 15
Finance Nick Bray 25
Finance Q&A Nick Bray 20
Summary and Wrap Up Kris Hagerman 10
3
Today’s Presenting Team
Kris HagermanChief Executive Officer
Bryan BarneySVP, Network Security
Bill LucchiniSVP & GM, Cloud Security Group
John ShawVP of PM, Endpoint Security
Matt FairbanksChief Marketing Officer
Joe LevyChief Technology Officer
Mike ValentineSVP, Worldwide Sales
Nick BrayChief Financial Officer
4
StrategyKris Hagerman
Chief Executive Officer
22.6%Cash EBITDA margin(4)
101.9%Renewal rate including up-sell and cross-sell
Sophos Snapshot
Compelling IndustryFundamentals
Security consistently is the top priority for corporate IT spend
$38B TAM (1) 7%
CAGR (1)
45%Enduser50%
Network
5%Other
Complete Cloud-Enabled Security Offering for Mid-
Market
Only player focused on the mid-market
with a comprehensive endpoint and network
offering
Highly EfficientSales Model
100% “channel first” approach delivers
scale and operating leverage
800+Sophos Partner
Reps & Sales Engineers
20,000+ Partners
175,000+ Sales Reps
65,000+ Sales Engineers
Workwith
+13.4%Enduser like-for-like billings
growth(2)
+27.5%Network like-for-like billings
growth(2)
$534.9MReported billings(3)
+19.7%Like-for-like billings growth(2)
Large (5)
Mid-Market
26%
18%
56%
SMBIntegrated through Sophos Central
Who deliver
FY16
Scale, above-market growth, healthy profitability, visibility and sustainability
6
Mission
To be the best in the world at delivering
complete IT security to mid-market enterprises
and the channel that serves them
Strategy
Security only
Focus on mid-market enterprises
Complete security – Made simple
Integrated Next Gen endpoint and network security
Managed and delivered through the cloud
‘Channel First’ sales model
7
Synchronized Security Platform and Strategy
Sophos Central
Cloud Intelligence
Sophos Labs
Analytics | Analyze data across all of Sophos’ products to create simple, actionable insights and automatic resolutions
| 24x7x365, multi-continent operation |URL Database | Malware Identities | File Look-up | Genotypes | Reputation | Behavioural Rules | APT Rules Apps | Anti-Spam | Data Control | SophosID | Patches | Vulnerabilities | Sandboxing | API Everywhere
Admin Self Service Partner| Manage All Sophos Products | User Customizable Alerts | Management of Customer Installations
Endpoint/Next-Gen Endpoint
Mobile
Server
Encryption
UTM/Next-Gen Firewall
Wireless
Web
In Cloud On Prem
8
Robust Innovation Pipeline for FY17
• Unified Endpoint Management• Security Heartbeat• Sophos Central managed Full EMM• iOS Mobile Security
• Hyper-V protection• AWS Auto-scaling• MTD for Linux, Windows• Security Heartbeat
• Next Gen Endpoint: Exploit Prevention, Anti-Ransomware, Root Cause Analysis
• Sophos Clean• Role-based Administration in Sophos Central
• Sophos UTM 9.5• XG Firewall and Firewall Manager v16• New Synchronized Security Use Cases• New XG Series Appliances
• Global Sophos Central managed SWG• Next-Gen Web Protection • Hybrid On-Prem and Cloud Model • Simplified licensing and pricing
ENDPOINT
MOBILE
SERVER
UTM/NGFW
WEB
• Synchronized Encryption• Sophos Central managed Full Disk Encryption• Multiple Key Support
ENCRYPTION
• Sophos Central managed Wireless• New Sophos Secure Access Points• New XG 1x Series Wireless AppliancesWIRELESS
• Sophos Central managed Sophos Email• Time of Click Protection• New Anti-Spam Engine• New Sophos Email AppliancesEMAIL
9
Competitor Landscape
Mid Market Centric
Network Leader
Endpoint Leader
Sync Security
Channel First
Mid Market Centric
Network Leader
Endpoint Leader
Sync Security
Channel First
Mid Market Centric
Network Leader
Endpoint Leader
Sync Security
Channel First
Mid Market Centric
Network Leader
Endpoint Leader
Sync Security
Channel First
Mid Market Centric
Network Leader
Endpoint Leader
Sync Security
Channel First
Mid Market Centric
Network Leader
Endpoint Leader
Sync Security
Channel First
Mid Market Centric
Network Leader
Endpoint Leader
Sync Security
Channel First
Mid Market Centric
Network Leader
Endpoint Leader
Sync Security
Channel First
Mid Market Centric
Network Leader
Endpoint Leader
Sync Security
Channel First
Mid Market Centric
Network Leader
Endpoint Leader
Sync Security
Channel First
10
Multiple Growth Drivers
• Large and rapidly growing marketo $38B market growing at 7% per yearo Sophos addressable market $15B+ growing at 7%+o Approximately 60% of this market is SMB and mid-marketo Over 60M small and mid-market enterprises worldwide
• Market share expansiono Appx. 5% share of enduser security market and 5% share of network security market: plenty of “running room”
• Continued global expansiono Growth opportunities in multiple underpenetrated regions, including US, LatAm, Asia Pacific and others
• Innovation and disciplined M&A to drive new sales opportunities with existing customers and enter new, adjacent markets
o Next-Gen Endpoint, cloud-managed Wi-Fi, cloud-managed Email security, cloud-managed Web security, analytics
• Continue to leverage Channel First sales modelo Recruit more partnerso Turn more of the existing partner base into “Blue Chip” partnerso Drive greater productivity, share of customers, and share of customer IT security wallet among Blue Chip partners
• Significant up-sell and cross-sell opportunitieso Leverage Sophos Central platform across entire portfolio to help partners drive up-sell and cross-sell
11
Product OverviewJoe Levy
Chief Technology Officer
MegatrendsCloud, Mobile and IaaS driving CASB, EMM, and data protection
Top Security Trends
Paradox of EncryptionPervasive SSL inhibits network decryption, requiring collaboration with endpoints for content visibility
Public/Private Sector Encryption TensionsApple/FBI, GDPR mandates, #nobackdoors
Ransomware and CryptowareA $325M “business”, demands NGEP solutions
IoT Expands Attack SurfacesDevices need protections at the network level
Common-mode FailuresThe Internet is built on common components, vulnerabilities must be mitigated before patching can occur
Lack of Defender CoordinationAnalytics showing promise as it matures from novelty to utility
Cybersecurity Skills GapEnterprises increasingly cite a shortage of security professionals, driving the need for simplicity
C-level Spear Phishing (“Whaling”)Increasing attack professionalism requires better training and detection tools
Risk-Based Approach to SecurityEnterprises are learning to quantify risk, and are beginning to match controls to attack surface
14
THE 99%
Off the shelf
Exploit Kits
ExecutableMalware
Doc / ScriptMalware
DataLeakage
THR
EATS
0days
Long dwellCampaigns
InjectionAttacks
TargetedPhishing
BespokeMalware
SIEM
Threat Intel
CO
NTR
OLS Endpoint AV URL Filtering
Email SecurityWAF
Encryption
CASB
NextGen FirewallSandboxing
NextGenEP
DLP
User Behavior Analytics
Security Automation / Risk
Quantification
1%
Critical Infrastructure / Nation-State Attacks
Supply Chain Integrity Compromises
Insider movementPTH, Skeleton Key,
Golden Ticket
Deception Networks / DDW monitoring
TIMECOMPLEXITY
RISK BASED ROI
15
TIME
User Behavior Analytics
Security Automation / Risk
Quantification
1%
Critical Infrastructure / Nation-State Attacks
Supply Chain Integrity Compromises
Insider movementPTH, Skeleton Key,
Golden Ticket
Deception Networks / DDW monitoring
Off the shelf
Exploit Kits
ExecutableMalware
Doc / ScriptMalware
SIEM
DataLeakage
Threat Intel
THR
EATS
CO
NTR
OLS Endpoint AV
THE 99%
URL Filtering
Email SecurityWAF
Encryption
CASB
NextGen Firewall
0days
Long dwellCampaigns
InjectionAttacks
TargetedPhishing
BespokeMalware
SandboxingNextGen
EP
COMPLEXITY
RISK BASED ROI
Complete SimpleSystem
16
Synchronized Security Platform and Strategy
Sophos Central
Cloud Intelligence
Sophos Labs
Analytics | Analyze data across all of Sophos’ products to create simple, actionable insights and automatic resolutions
| 24x7x365, multi-continent operation |URL Database | Malware Identities | File Look-up | Genotypes | Reputation | Behavioural Rules | APT Rules Apps | Anti-Spam | Data Control | SophosID | Patches | Vulnerabilities | Sandboxing | API Everywhere
Admin Self Service Partner| Manage All Sophos Products | User Customizable Alerts | Management of Customer Installations
Endpoint/Next-Gen Endpoint
Mobile
Server
Encryption
UTM/Next-Gen Firewall
Wireless
Web
In Cloud On Prem
17
Sophos Central
Cloud Intelligence
Sophos Labs
Analytics | Analyze data across all of Sophos’ products to create simple, actionable insights and automatic resolutions
| 24x7x365, multi-continent operation |URL Database | Malware Identities | File Look-up | Genotypes | Reputation | Behavioural Rules | APT Rules Apps | Anti-Spam | Data Control | SophosID | Patches | Vulnerabilities | Sandboxing | API Everywhere
Admin Self Service Partner| Manage All Sophos Products | User Customizable Alerts | Management of Customer Installations
Mobile
Server
Encryption
Wireless
Web
In Cloud On Prem
Endpoint/Next-Gen EndpointUTM/Next-Gen Firewall
Synchronized Security Platform and Strategy
Heartbeat
18
Sophos Central
Cloud Intelligence
Analytics | Analyze data across all of Sophos’ products to create simple, actionable insights and automatic resolutions
Admin Self Service Partner| Manage All Sophos Products | User Customizable Alerts | Management of Customer Installations
Mobile
Server
Encryption
Wireless
Web
In Cloud On Prem
Endpoint/Next-Gen EndpointUTM/Next-Gen Firewall
Synchronized Security Platform and Strategy
Sophos Labs | 24x7x365, multi-continent operation |URL Database | Malware Identities | File Look-up | Genotypes | Reputation | Behavioural Rules | APT Rules Apps | Anti-Spam | Data Control | SophosID | Patches | Vulnerabilities | Sandboxing | API Everywhere
Unknown App ID
19
Cloud Intelligence
Analytics | Analyze data across all of Sophos’ products to create simple, actionable insights and automatic resolutions
Sophos Labs | 24x7x365, multi-continent operation |URL Database | Malware Identities | File Look-up | Genotypes | Reputation | Behavioural Rules | APT Rules Apps | Anti-Spam | Data Control | SophosID | Patches | Vulnerabilities | Sandboxing | API Everywhere
UTM/Next-Gen Firewall
Admin Self Service Partner| Manage All Sophos Products | User Customizable Alerts | Management of Customer Installations
Wireless
Web
Synchronized Security Platform and Strategy
Endpoint/Next-Gen Endpoint
Mobile
Server
Encryption
Sophos CentralIn Cloud On Prem
Synchronized Encryption
20
Encryption
Cloud Intelligence
Analytics | Analyze data across all of Sophos’ products to create simple, actionable insights and automatic resolutions
Sophos Labs | 24x7x365, multi-continent operation |URL Database | Malware Identities | File Look-up | Genotypes | Reputation | Behavioural Rules | APT Rules Apps | Anti-Spam | Data Control | SophosID | Patches | Vulnerabilities | Sandboxing | API Everywhere
Sophos Central
Admin Self Service Partner| Manage All Sophos Products | User Customizable Alerts | Management of Customer Installations
Web
In Cloud On Prem
Synchronized Security Platform and Strategy
UTM/Next-Gen Firewall
Wireless
Endpoint/Next-Gen Endpoint
Mobile
Server
Lateral Movement Protection
21
Mobile
Server
Wireless
Encryption
Cloud Intelligence
Analytics | Analyze data across all of Sophos’ products to create simple, actionable insights and automatic resolutions
Sophos Labs | 24x7x365, multi-continent operation |URL Database | Malware Identities | File Look-up | Genotypes | Reputation | Behavioural Rules | APT Rules Apps | Anti-Spam | Data Control | SophosID | Patches | Vulnerabilities | Sandboxing | API Everywhere
Admin Self Service Partner| Manage All Sophos Products | User Customizable Alerts | Management of Customer Installations
Web
Synchronized Security Platform and Strategy
UTM/Next-Gen Firewall
Sophos CentralIn Cloud On Prem
Endpoint/Next-Gen Endpoint
Synchronized Phishing Protection
22
Server
Wireless
Encryption
Analytics | Analyze data across all of Sophos’ products to create simple, actionable insights and automatic resolutions
Sophos Labs | 24x7x365, multi-continent operation |URL Database | Malware Identities | File Look-up | Genotypes | Reputation | Behavioural Rules | APT Rules Apps | Anti-Spam | Data Control | SophosID | Patches | Vulnerabilities | Sandboxing | API Everywhere
Admin Self Service Partner| Manage All Sophos Products | User Customizable Alerts | Management of Customer Installations
Synchronized Security Platform and Strategy
UTM/Next-Gen Firewall
Sophos CentralIn Cloud On Prem
Endpoint/Next-Gen Endpoint
Mobile
Web
Cloud Intelligence
Continuous Authentication
23
Sophos CentralBill Lucchini
SVP and General Manager, Cloud Security Group
Synchronized Security Platform and Strategy
Sophos Central
Cloud Intelligence
Sophos Labs
Analytics | Analyze data across all of Sophos’ products to create simple, actionable insights and automatic resolutions
| 24x7x365, multi-continent operation |URL Database | Malware Identities | File Look-up | Genotypes | Reputation | Behavioural Rules | APT Rules Apps | Anti-Spam | Data Control | SophosID | Patches | Vulnerabilities | Sandboxing | API Everywhere
Admin Self Service Partner| Manage All Sophos Products | User Customizable Alerts | Management of Customer Installations
Endpoint/Next-Gen Endpoint
Mobile
Server
Encryption
UTM/Next-Gen Firewall
Wireless
Web
In Cloud On Prem
26
Sophos Central
27
Sophos Central: Admin Dashboard
User-Centric
Unified
Powerful
Simple
Fast
28
Sophos Central: Self Service
29
Sophos Central: Partner Dashboard
Partner-Centric
Portfolio Mgmt.
MSP
License Mgmt.
Trial to Purchase
30
Sophos Central: Partner View
View Upsell Opportunities
View Renewal Opportunities
Easily Manage Licenses
31
FY16 Sophos Central Launches
Locate for MobileMobile Security
Server LockdownWeb Gateway: Win/Mac
Web Gateway: iOS
Web Gateway: Chromebook
Security Heartbeat
vShield
AD Sync Filters Groups
Endpoint Update Caching
Download Reputation
Application Control
Endpoint for Linux
Localization
Updated Email Alerts
32
Sophos Central: Fastest Growing Solution in Sophos History
92% Growthin Active Partners
0k
2,000k
4,000k
6,000k
8,000k
10,000k
12,000k
Q1FY14 Q2FY14 Q3FY14 Q4FY14 Q1FY15 Q2FY15 Q3FY15 Q4FY15 Q1FY16 Q2FY16 Q3FY16 Q4FY16
220% Growthin Billings
1,000
1,500
2,000
2,500
3,000
Apr May Jun Jul Aug Sep Oct Nov Dec Jan Feb Mar
77% of billings come from
competitive wins
33
Enduser ProductsJohn Shaw
VP Product Management ESG
Data Protection
Device Encryption
File Encryption
Pro
du
cts
% o
f En
du
ser
Bill
ings
(1)
Endpoint Protection Server Protection
Server Standard
Server Advanced
Mobility Management
Mobile Security
Mobile Control
Note: 1. Figures refer to FY16 on a like-for-like basis
Endpoint Standard
Endpoint Advanced
Endpoint Intercept
Enduser Security: Product Overview (13% Growth)
8%
11%14%
67%
36
Sophos Enduser Security Strategy
Secure the (Mobile) Device
Secure phones and tablets like any other endpoint
Signature-less Next-Gen Protection
Across Windows, Mac, Linux and Android
Next Gen EncryptionEncrypt Everything, All the
time, EverywhereHacker-Proof Encryption
Secure the Servers Protection optimized for
servers (physical, virtual and IaaS)
Innovate to Enhance and Expand Existing Business and Enter Exciting Adjacent Growth Opportunities
Highlights
Schrodinger
Application Reputation
Secure BYOD
Root Cause Analytics
Exploit Prevention
CryptoGuard
IaaS (AWS / Azure)
Synchronized security
37
Sophos Central
Data ProtectionEndpoint Protection Server ProtectionMobility Management
Schrodinger: Driving Cross-Sell
Management capabilities for larger organisations
Feature parity in Sophos Central
On premise version
38
Next-Gen
Detect
Device ControlApp ControlWeb Control
Surface ExecuteFile Heuristics
Signatures
Traditional
Root Cause Analysis
Network IsolationKey Revoke/Restore
PostureInvestigate Clean
Signaturelesscleanup
AdvancedExploit Prevention
Malicious Traffic Detection
BehaviorExploit
QuarantineMalware Removal
Remediate
Crowd Sourced Reputation
Delivery
Prevent
Whitelist
Application Lockdown
BehaviorHIPS/Behavior
Monitoring
Collaborate
Synchronized Security
EmulationOn Device Emulation
Respond
ExposureWeb Protect
DLP
Cryptoguard
Behavior
Sophos Next-Gen Endpoint
39
Exploit Prevention and Next-Gen Endpoint Protection
ANNUAL NEW MALWARE
SAMPLES100,000,000s
ANNUAL KNOWN EXPLOITS (CVE’S) 1,000s
CUMULATIVE KNOWN EXPLOIT TECHNIQUES 24
40
Next-gen Endpoint: Root Cause Analytics
41
Mobile Strategy: Manage, Secure + Protect DataAn Endpoint Is an Endpoint Is an Endpoint
42
Server Protection Strategy
•Optimize performance •Lightweight agent
•Performance is key•Agentless/Light agent
•On-demand resources•Usage based licensing
PHYSICAL VIRTUAL IaaS
Optimized for performance
MTD Server Spectrum
ADDING NEXT GEN PROTECTION
Anti-malware
TODAY
MTD CryptoguardLockdown
43
Two Types of Encryption: Both Are Needed
FULL DISK ENCRYPTION FILE ENCRYPTION
Protects against device theft or loss
Secures data stored in the cloud
Secures data even if exfiltrated
Secures sensitive email
Secures data even if system is hacked or compromised
Helps to protect against insider threats
Secures data stored on mobile devices and elsewhere44
Synchronized Encryption: A New Paradigm in Data Protection
User Integrity App Integrity System Integrity
Encrypt Everything, Everywhere, Automatically
Synchronized with Endpoint Protection
“By 2019, 25% of security spend will be driven by EU data protection regulation
and privacy concerns.”- IDC
45
Network ProductsBryan Barney
SVP and General Manager NSG
Pro
du
cts
% o
f N
etw
ork
Bill
ings
(1)
81%
11%4%
UTM/Next-GenFirewall
Secure Wi-Fi Email Security
Network Security: Product Overview (28% Growth)
UTM/Next-Gen Firewall IPS Application control User-based policies Web filtering Email security SG105W/115W/125W/
135W (desktop UTMs with built in wireless)
AP15, 55, & 100 (wireless access points)
RED
iView Reporting
Sophos UTM Manager
Sophos UTM for AWS
Note: 1. Figures refer to FY16 on a like-for-like basis
Secure Email Appliance
Virtual Email Appliance
PureMessage for Unix
PureMessage for Exchange
Sophos Email (Beta: cloud-based email security)
Sophos Wireless (Beta -cloud managed wireless access points)
4%
Web Security
Secure Web Appliance
Virtual Web Appliance
Cloud Web Gateway (cloud-based web security)
48
Sophos Network Security Strategy
Accelerate NGFW/UTMCombine the strengths of Sophos
and Cyberoam
Grow Secure Email Gateway
Consolidate technology and launch a cloud offering
Become a Leader in Wireless
Leveraging UTM/NGFW, build a cloud-managed wireless product
line
Innovate to Enhance and Expand Existing Business and Enter Exciting Adjacent Growth Opportunities
Highlights
Grow Secure Web Gateway
Consolidate technology and create hybrid offerings
IaaS (AWS / Azure) Advanced securityIntegrate with Sophos Central
Synchronized security Converged architectures Performance
49
UTM/Firewalls: Two Platforms with Competitive Advantage
Trusted platform getting stronger
New platform for an exciting future
SG UTM XG Firewall
• Combined platform with the best features of SG UTM 9 and Cyberoam
• Feature superset of Sophos SG UTM
• Simplified user experience
• Comprehensive central management solution on-prem and in the cloud
• Enhanced Synchronized Security
• Solid, stable platform customers and
partners know and love
• Sophos Sandstorm in v9.4
• WAF and VPN enhancements in v9.5
• Future-proofed and ready for SF-OS
whenever customers/partners choose
50
SFOS v16 User Interface (UTM/NGFW)
administrator
51
UTMWi-Fi
Sophos Wireless Strategy
Proliferation of Wi-Fi across enterprises of every size
Opportunities to accelerate growth:• Improved performance / scale • Separation of admin privilege • Competitive in pure Wi-Fi opportunities
UTM Managed Cloud Managed
Better scalabilityFaster innovationNew sales opps
Improved scalabilityBenefit from cloudSeamless migration
Next-Gen Protection
Synchronized Security
Simplified Experience
Visibility and Reporting
Sophos UTM Wi-Fi:• Strong solution, good features• 50%+ YoY fastest NSG growth• Expanding hardware portfolio
Differentiate
MARKET FORCES
52
Next-Gen Protection
Data Protection
Synchronized Security
Simplified Experience
Sophos Email Strategy
Proven securityOffice 365 integration
Self-Service PortalContinuity
Managed ApplianceATP FeaturesEncryption
DLP
Office 365 AdoptionIncreased Threat Vector
MARKET FORCESSophos Email solutions:• Powerful security features• Strong industry reputation• Evolving portfolio
Opportunities for Growth:• Secure Office 365 • Protect against evolving threats• Support global compliance landscape
UTM Managed Cloud Managed
Differentiate
53
Sophos Web Protection Strategy
Cloud UTM/FirewallApplianceEndpoint
• All the features Sophos UTM customers receive today
• Web category policies• Web malware detection• On-prem reporting (iView)• Optional cloud sandbox
Web Standard
• Web Standard + • Extra SWA 4.x features• Cloud reporting• Hybrid enforcement • Web DLP (future)• CASB visibility (future)
Web Advanced
• Web control • Category-based web
filtering enforced on and off the corporate network
Endpoint Advanced
54
Product Q&A Session
Channel StrategyMike Valentine
SVP of Worldwide Sales
Sophos ‘Blue Chip’ Partner Growth (1)
20002100220023002400250026002700280029003000310032003300340035003600370038003900400041004200430044004500460047004800
Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4
National Resellers
Distributors
FY 2014 FY 2015Note:1. Blue chip partners defined as partners transacting 5 or more deals in trailing 6 months
FY 2016
Sampling of VARs
High-Quality and Fast-Growing Channel Ecosystem
58
‘Channel First’ Approach Drives Reach and Leverage
Best-in-Class Reach and Leverage
Sophos Partner Reps and Sales Engineers
800+Partners
20,000+ 175,000+ Sales Reps
65,000+ Sales Engineers
Key Elements
Greater customer reach and touch1
Lower go-to-market costs2
More predictable billings3
Faster to scale4
Increased customer satisfaction5
Key Benefits
1 Commitment to channel at the top
Attractive program: discounts, tiers, etc.2
Effective training and certification3
High quality products4
Channel-focused sales executives5
High quality partner marketing and partner enablement6
Opportunity to cross-sell other products and services7
No direct sales destroying channel trust/loyalty8
Work with Who Deliver
59
NETWORK SECURITY
APPLIANCE
NETWORK SECURITY
OVERALL SCORE 93.2 90.4 74.9 76.3
Sophos Sweeps Prestigious CRN ARC Awards
CLIENT SECURITY
Sophos is the first-ever winner in all
THREE security categories
two years running
Source: CRN 2015
OVERALL SCORE 91.8 81.8 80 79.4
OVERALL SCORE 91.6 90.6 79.5 77.3
CLIENT
SECURITY
WINNER
2015
NETWORK
SECURITY
APPLIANCE
WINNER
2015
NETWORK
SECURITY
WINNER
2015
60
Why Are Partners Joining Sophos
Synchronized SecuritySophos CentralNext-Gen Endpoint
(Intercept)
61
MarketingMatt Fairbanks
Chief Marketing Officer
What Does Marketing Do?
AWARENESS DEMAND GEN ENABLEMENT
64
Consistent Growth in the Marketing Funnel
Q2FY14
Q3FY14
Q4FY14
Q1FY15
Q2FY15
Q3FY15
Q4FY15
Q1FY16
Q2FY16
Q3FY16
Q4FY16
Marketing Contacts
+40%
Qualified Leads
+58%
Closed Business
+92%WEBSITE VISITORS
MARKETING CONTACTS
QUALIFIED LEADS
WON
65
Awareness
67
Sophos Home
Accounts Created NPS Score
45Industry Avg.
19350,000+
EXCELLENT
0
50,000
100,000
150,000
200,000
250,000
300,000
350,000
400,000
NO
V
DEC
JAN
FEB
MA
R
AP
R
May
Jun
“There are zero reasons for a home user to pay for AV now . . . and per-machine web-filters are a huge bonus for us parents!!”
Brad Call, Internal I.T. Ltd.
“I've found it to be easy to use, reliable, and not heavy on system resources. It's also picked up on every bit of malware that I've been able to throw at it.”
ZD Net Review
“Very unobtrusive program, doesn't have constant nag windows trying to get me to upgrade. If I wanted to be nagged to death I would go talk to my ex-wife.”
Anonymous IT Administrator
68
Partner App
Sophos Partner Program: Marketing Tools
• Simple quoting and deal registration• Online training and certification• Partner demand gen campaigns• Sophos website-in-a-box and marketing service center• Asset registration and reporting• Renewal tracking• Sales tools, price configurator, battlecards
• Partner Portal in your pocket• View and register for Sophos events• Rate presenters at events / feedback• Sophos news and alerts• Webcasts / podcasts on the go
Partner Portal
69
Sophos Partner Program: Marketing Campaigns
• Digital awareness with channel media and PR outreach
• Active partner recruitment at industry events
• Disti-led partner recruitment efforts
Partner RecruitmentPartner Campaigns
• 55% of discretionary marketing spend on channel “to” and “thru” efforts
• Funding skewed heavily to largest partners who drive the most volume
• e.g., 46% YoY billings growth at CDW
Partner Spend
Ransomware
HIPAA Compliance
7 Deadly IT Sins
Encryption
Virtualization Security
Synchronized Security
XG Firewall
Endpoint Comparison
TMG ReplacementSophos vs. Websense
Sophos vs. Symantec
Banner Ads
Landing Page
Emails
UTM Elevated 9.4
70
Go-To-Market Q&A Session
FinanceNick Bray
Chief Financial Officer
Billings TrendsHigh-teens growth with contribution from Network and Enduser
204.1 224.1 238.2
158.5
223.7
266.725.5
28.2
30.0
FY14 FY15 FY16
476.0
47%
47%
41%
6%
6%
5%
534.9
ENDUSER
NETWORK
OTHER
53% 45%
50%
LIKE-FOR-LIKE BILLINGS GROWTH ($M)
4.3%
17.5%
19.7%
0.5%
13.0% 13.4%
18.0%
30.7% 31.2%
8.9%
23.9%
27.5%
FY14 FY15 FY16
ENDUSER
NETWORK
GROUP
UTM
534.9
388.1
74
New and Existing Customer Billings
New Customer Metrics FY15 FY16
Partners 15K 20K
Blue Chip partners (>5 orders last 6 mo.) 3.4K 4.7K
Number of customers 200K 220K
New Customer Billings(5) YOY 33.0%
Existing Customer Metrics FY15 FY16
Customer Billings(5) YOY 19.7%
Renewal rate 100.2% 101.9%
Cross-sell % Endpoint / UTM 5.6% 7.4%
FY14 FY15 FY16
New Customer Enduser Billings(5) YOY -20.8% 16.3% 28.3%
Significant Enduser recovery
New business to brand new customers has improved growth; aided by improvement in the renewal rate
75
Long-Term Stability of Billings
33.0
9.0
48.0
6.04.0
FY16
100.0
3 Year Subscription
2 Year Subscription
1 Year Subscription
5 Year Subscription4 Year Subscription
4.0 6.0
48.0
9.0
33.0
FY16 FY17 FY18 FY19 FY20 FY21
EXAMPLE AVAILABLE FOR RENEWAL ($M) AS EXISTING CUSTOMER BILLINGS
EXAMPLE NEW BILLINGS ($M)
Majority of current year billings are available for renewal three years out; hence growth of the existing customer base takes time yet is very robust
Average billings length has remained consistent over time
(FY16: 28.6 months; FY15: 28.0 months)
76
Cumulative Effect of New Billings
3 Year Subscription2 Year Subscription1 Year Subscription
5 Year Subscription4 Year Subscription
New billings continually adding to the existing customer base
33.0 33.0 33.0 33.0 33.0 33.0
9.0 9.0 9.0
48.0
48.0
6.0
4.0
FY16 FY17 FY18 FY19 FY20 FY21 FY22
FY16
FY17
FY18
FY19
FY20
FY21
FY22
FY23
FY24
FY25
FY26
FY27
FY28
FY29
• The renewal rate (FY16: 101.9%) reflects a sticky existing customer base…• …Which with the cumulative effect of new billings translates to a solid opening base level of billings at the start of
each year (rather than starting each year at zero)…• …From which the Group can then grow…• …Supporting growth momentum and providing visibility
EXAMPLE OF CUMULATIVE EFFECT ($M)EXAMPLE AVAILABLE FOR RENEWAL ($M) AS EXISTING CUSTOMER BILLINGS
77
Short-Term Billings Visibility and Sustainability
Billings, $M FY16 rates FY15 FY16Growth
(AR)Growth
(LFL)
Subscription 384.9 422.8 9.8% 16.5%
Hardware 78.4 99.0 26.3% 37.7%
Other 12.7 13.1 3.1% 10.2%
Total billings 476.0 534.9 12.4% 19.7%
FY17 renewal base for existing subscription billings up c.11%(6); majority of subscription contracts are from renewals and hence expected to increase double digit even without further improvement in the retention rate
• Subscription billings split c.$333M from existing customers and c.$90M from new customers
• FY17 renewal base for existing subscription billings up c.11%
78
159.0
66.8
24.0
14.2
FY16
264.0
25%
9%6%
Billings by Region and EMEA CurrencyStrong diversification of billings by market; modest UK domestic exposure
215.9255.5 264
124.6
152.9187.947.6
67.6
83.0
FY14 FY15 FY16
476.0
54%
32%
32%
12%
14%
16%
EUR
GBP
USD
56% 49%
35%
534.9
388.1
60%
OTHER
EMEA
AMERICAS
APJ
30%
12%
4%
3%
% EMEA % TOTAL
EMEA Billings
Sterling and Euro costs at 20% and 26%, respectively 79
Billings to Revenue Example
• Three brand new customers purchasing subscriptions in the middle of FY16 of one, two and three year durations
• One brand new customer purchasing hardware
• Cash received up-front on standard credit terms
• Subscription billings recognised over the term of the contract
• Hardware billings recognised up-front
Billings Revenue Recognition
FY16 FY16 FY17 FY18 FY19
Customer 1 – 1 year subscription
100 50 50
Customer 2 – 2 year subscription
100 25 50 25
Customer 3 – 3 year subscription
100 17 33 33 17
Customer 4 – Hardware 100 100
400 192 133 58 17
Current-year billings recognised as revenue over term of contract
80
0.8 1.5 1.5 1.5 0.8
8.0
16.0 16.0
8.0
2.3
4.5 2.3 16.5
16.5
FY16 FY17 FY18 FY19 FY20 FY21
Subscription Billings to RevenueBillings flow more evenly to revenue; yet not linear due to mix of contract terms
EXAMPLE REVENUE RECOGNITON ($M)
33.0
9.0
48.0
6.04.0
FY16
100.0
3 Year Subscription
2 Year Subscription
1 Year Subscription
5 Year Subscription4 Year Subscription
EXAMPLE NEW BILLINGS ($M)
81
Revenue by Source
REPORTED REVENUE BY SOURCE ($M)
251.4
128.7
98.1
FY16
478.2
REPORTED BILLINGS BY TYPE ($M)
422.8
13.1
99.0
FY16
534.9
SUBSCRIPTION+9.8%
79.0% of billings
HARDWARE+26.3%
18.5% of billings
OTHER+3.1%
2.5% of billings
52.6% of total revenuebrought forward deferred
revenue
20.5% of total revenuefrom FY16 hardware
billings(7)
26.9% of total revenuefrom FY16 subscription
and other billings
Over half of FY16 revenue from opening deferred revenue balance; hardware billings have an immediate effect; current year subscription billings mostly benefit future years
Revenue in the main reflects past billings performance
286.5
FY17
82
Deferred Revenue Analysis
$M FY14 FY15 FY16
Billings 388.1 476.0 534.9
Revenue recognised (378.8) (446.7) (478.2)
Net deferral 9.3 29.3 56.7
Translation and other adjustments 12.8 (43.8) 8.7
Net movement 22.1 (14.5) 65.4
Deferred revenue – b/f 425.7 447.8 433.3
Deferred revenue – c/f 447.8 433.3 498.7
251.4286.5
118.4
137.7
50.6
58.412.9
16.1
End FY15 End FY16
< 1 YEAR
2-3 YEARS
>3 YEARS
1-2 YEARS
433.3
498.7
+14.0%
+15.4%
+24.8%
+16.3%
+15.1%
Subscription billings growth takes time to translate to revenue; strong subscription performance increases deferred revenue, hence revenue growth lags subscription billings growth
14.0% increase YOY in revenue to be recognised within one year
TOTAL
83
Earnings Analysis
EBITDA RECONCILIATION
$M FY14 FY15 FY16
Cash EBITDA 97.0 101.4 120.9
Cash EBITDA margin 25.0% 21.3% 22.6%
Net deferral of revenue (9.3) (29.3) (56.7)
Adjusted EBITDA 87.7 72.1 64.2
• Number of Shares currently 452M; dilution policy announced at IPO: up to 10% over five years
• Share Based Payments will increase over time with each annual issue of three-year “options”; FY16 charge of $15M expected to broadly double in FY17 as moving to run rate
• Will decrease over time given reducing balance methodology
• FY16 charge of $29M expected to fall to $18M in FY17
• Operational ETR medium term in the 24% to 26% range, longer term expected to decline as benefit of UK tax rate obtained with majority of IP being held in the UK
• Anticipated reduction in cash tax YOY below $25M FY16 amount
• Previously under a private equity funding structure• FY16 re-financed debt to $235M and €60M facility
agreements• Margin of Libor and Euribor +2.25%
Cash EBITDA is a leading indicator of current year cash flow and future statutory profit performance (billings less expenses); Adjusted EBITDA is an indicator of past performance (revenue less expenses)
Share based payment expense (1.3) (1.4) (15.0)
Depreciation (7.6) (8.3) (8.4)
Amortisation (58.7) (47.6) (29.2)
Gains / (loss) on group asset disposal (0.1) - -
Exceptional items (16.0) (17.3) (41.9)
Unrealised foreign exchange (loss) / gain (6.4) 2.0 (2.4)
Operating loss (2.4) (0.5) (32.7)
Net finance expense (88.1) (53.8) (35.7)
Income tax charge (0.7) (5.7) (3.5)
Loss for the year (91.2) (60.0) (71.9)
84
Cash Flow: Working Capital Focus
$M FY15 FY16
Cash EBITDA 101.4 120.9
Capex (11.9) (16.8)
Cash tax (25.7) (25.2)
Change in working capital 1.5 (32.5)
Unlevered FCF 65.3 46.4
$M FY15 FY16
Unlevered FCF 65.3 46.4
Capex 11.9 16.8
Exceptional items (17.3) (41.9)
Net cash from operating activities
59.9 21.3
Unlevered free cash flow is expected to approximately double in FY17• Profit level anticipated to improve• Working capital in FY17 expected to normalise at approximate average of FY15 / FY16
CASH EBITDA TO UFCF(8) RECONCILIATION UFCF TO OPERATING CASH RECONCILIATION
$M FY15 FY16
Increase in inventory (8.1) (6.7)
Increase in trade and other receivables
(15.8) (16.1)
Increase/(decrease) in trade and other payables
27.0 (10.9)
Other (1.6) 1.2
Change in working capital 1.5 (32.5)
WORKING CAPITAL MOVEMENTS
Working capital in FY17 expected to normalise
85
Outlook: Confident on Key Metrics for FY17
• FY17 Outlooko Mid-teens percentage billings growth on a like-for-like basis; contributing to similar
mid-teens revenue growtho Modest Cash EBITDA margin expansion; reflecting the operational leverage in the
businesso Unlevered free cash flow expected to approximately double; as working capital
normalises and the level of our anticipated profit improves
• Q1 Trading Updateo Sophos has continued to enjoy strong trading, with Q1 billings expected to be above
the Board’s expectationso Q1 FY17 Like-for-like billings growth is expected to be in the range of 20 percent to
23 percent year-over-year o Billings assisted by a material contract with an existing customer o Sophos re-confirms FY17 outlook
86
Finance: Key Points (1 of 2)
• Billings: 79% of billings from subscriptions which are visible, sustainable and have a strong “cumulative growth” impact
○ c. 62% of FY16 total billings from existing customer subscriptions with a 101.9% renewal rate
○ Existing customer subscription billings growth driven by the cumulative effect; assisted by improving
renewal rate
○ Strong growth in subscription billings from new customers which is expected to grow
○ Positive cumulative impact of new customer billings results in growth even if new customer billings flat
• Revenue: High level of visibility
○ 53% of FY16 revenue from deferred revenue on the balance sheet at the start of the period; current year
billings in the main benefit future periods
○ Revenue growth rate has been moving closer to billings growth rate and we expect this to continue
87
Finance: Key Points (2 of 2)
• Cash EBITDA margin: Improving and now a solid proxy for unlevered free cash flow
○ Investments set to drive billings growth
○ Cash EBITDA (billings less expenses) has grown over the past three years; yet adjusted EBITDA (revenue
less expenses) has declined with significant subscription billings deferred to the balance sheet
○ Inflexion point imminent
• Unlevered Free Cash Flow: Expected to approximately double in FY17
○ Working capital expected to be a more normal year in FY17; specifically creditor movements
• FY17: Confident on key metrics for FY17
○ The year when all key metrics start moving “up and to the right” – billings, cash EBITDA and unlevered
free cash flow; statutory metrics of revenue and adjusted EBITDA also expected to move positively
88
Finance Q&A Session
Summary and Wrap UpKris Hagerman
Chief Executive Officer
Summary and Wrap Up
• Strong market and demand environment
• Focused and differentiated mission and strategy
• Solid and consistent execution across product, go-to-market, and operations
• Innovative product roadmap led by synchronized security platform and Sophos Central
• Solid foundation for continued strong financial performance driven by billings growth in existing customers and new customers
91
End Notes
(1) Source for c.$38Bn IT security market (hardware + software) is IDC WW IT Security Products 2015-2019 Forecast: Comprehensive Security Product Review (December 2015, IDC #US40709015) and represents expected market size in 2016. Growth of 7% represents2015E-2019E CAGR.
(2) Like-for-like billings represent billings on a constant currency basis excluding disposals and including acquisitions from the point of acquisition plus the pre-acquisition billings of any acquired companies on a reported basis. Like-for-like billings are presented to enhance comparability. Key constant currency rates for the period were: USD vs. Euro of 0.931; USD vs. GBP of 0.674; and USD vs. Yen of 119.9.
(3) Billings represents the value of products and services invoiced to customers after receiving a purchase order from the customer and delivering products and services to them, or for which there is no right to a refund for undelivered items. Billings does not equate to statutory revenue.
(4) Cash earnings before interest, taxation, depreciation and amortisation (“cash EBITDA”) is defined as the Group’s operating (loss) / profit adjusted for depreciation and amortisation charges, any gain or loss on the sale of tangible and intangible assets, share option charges, unrealised foreign exchange differences and exceptional items, with billings replacing recognised revenue.
(5) Constant currency billings excluding Cyberoam.
(6) Estimated, excluding acquisitions and OEM.
(7) $98.1 million of hardware revenue relates to FY16 hardware billings, difference to total FY16 hardware revenue of $100.9 million and FY16 hardware billings of $99.0 million due to release of deferrals from earlier periods and deferral into future periods of certain minor legacy hardware items as well as Email and Web hardware.
(8) Unlevered free cash flow (“uFCF”) is defined as cash EBITDA, less capex, less change in net working capital, less cash taxes.
93
© Copyright 2016. Sophos Group plc. All rights reserved.Sophos Group plc (Company Number: 09608658) is Incorporated in England and Wales, with registered offices at The Pentagon, Abingdon, OX14 3YP, United Kingdom.
Sophos is the registered trademark of the Sophos Group.All other product and company names mentioned are trademarks or registered trademarks of their respective owners.
95