Earnings Labs

Palo Alto Networks, Inc. (PANW)

Q1 2025 Earnings Call· Wed, Nov 20, 2024

$182.17

-0.40%

Key Takeaways · AI generated
AI summary not yet generated for this transcript. Generation in progress for older transcripts; check back soon, or browse the full transcript below.

Same-Day

+1.22%

1 Week

-0.69%

1 Month

-7.37%

vs S&P

-8.08%

Transcript

Walter Pritchard

Management

Good day, everyone, and welcome to Palo Alto Networks First Quarter 2025 Earnings Conference Call. I'm Walter Pritchard, Senior Vice President of Investor Relations and Corporate Development. Please note that this call is being recorded today, Wednesday, November 20th, 2024, at 1.30 p.m. Pacific Time. With me on today's call to discuss first quarter results are Nikesh Arora, our Chairman and Chief Executive Officer; and Dipak Golechha, our Chief Financial Officer. Following our prepared remarks, Lee Klarich, our Chief Product Officer, will join us for the question-and-answer portion. You can find the press release and other information to supplement today's discussion on our website at investors.paloaltonetworks.com. While there, please click on the link for quarterly results to find the 1Q ‘25 supplemental information and 1Q ‘25 earnings presentation. During the course of today's call, we will make forward-looking statements and projections regarding the company's business operations and financial performance. These statements made today are subject to a number of risks and uncertainties that could cause our actual results to differ from these forward-looking statements. Please review our press release and recent SEC filings for a description of these risks and uncertainties. We assume no obligation to update any forward-looking statements made in the presentation today. This presentation contains non-GAAP financial measures and key metrics relating to the company's past and expected future performance. Non-GAAP financial measures should not be considered a substitute for financial measures prepared in accordance with GAAP. The most directly comparable GAAP financial metrics and reconciliations are in the press release and the appendix of the investor presentation. Unless otherwise noted today, all results and comparisons are on a fiscal year-over-year basis. We also note that management is scheduled to participate in the UBS Global Technology Conference. I will now turn the call over to Nikesh.

Nikesh Arora

Management

Thank you, Walter. Good afternoon and thank you everyone for joining us today for our earnings call. We're delighted to report a strong start to fiscal year 2025. In our first quarter of focusing on RPO and NGS ARR, we saw strength in both metrics and saw them perform well ahead of our expectations. The market for cybersecurity continues to be robust and continues to grow faster than the overall technology market. Despite the acceleration of technology spend due to AI, cybersecurity continues to [out space] (ph) technology spend. We saw particular strength in our next-generation security offerings, notably in Cortex and in NetSec. NGS ARR grew 40% to over $4.5 billion. It is still well ahead of our industry's expectations independent of a one-time increase due to the IBM deal. On the profitability front, we expanded our operating margin by 60 basis points year-over-year as we continue to see benefits from our broad efficiency focus while making the necessary investments to sustain our growth. This translated into a 13% EPS growth and strong cash generation. We are particularly pleased with our continued execution at scale where we are able to balance our growth initiatives within our financial investment envelope, allowing us to deliver upside to our EPS guidance. We've been talking about the benefits of simplifying security architectures and consolidating point products into platforms for a while now. I'm sure all of you remember our eventful quarter where we changed gears on platformization, and as I've said before, I wish we could have made our good decisions faster. We continue to see momentum across our partner ecosystem and our customers. More recently, our industry peers have been evangelizing the virtues of platformization, and industry experts have begun to weigh in. I had our teams go back and compare the…

Dipak Golechha

Management

Thank you, Nikesh, and good afternoon, everyone. To maximize our time spent on Q&A, I will provide you with highlights of Q1. You can review the results in our press release and the supplemental financial information on our website. Note that we have removed billings and added NGS ARR and RPO to our supplemental financials, reflecting our focus on the latter metrics. In Q1, total revenue was $2.14 billion and grew 14%, above the high end of our guidance. Within revenue, product revenue grew 4%, while total services revenue grew 16%. Drilling into services revenue, subscription revenue grew 21% and support revenue rose 8%. As Nikesh mentioned, the demand for firewall appliances was stable in Q1 and we continue to expect growth of 0% to 5% as we have previously discussed. Our support revenue is mainly tied to our appliance form factor. Moving on to geographies, we saw double-digit revenue growth across all of our theaters with the Americas growing 12%, EMEA up 21% and JAPAC growing 13%. Total RPO grew 20% to $12.6 billion. We added approximately $68 million in RPO sequentially from the acquisition of the QRadar SaaS business. Approximately $30 million of this RPO was also included in our deferred revenue. Our current RPO grew 18% to $5.9 billion. The average duration of our new contracts remained at approximately three years, in line with the year-ago quarter and slightly down from Q4. Our NGS ARR grew 40%, finishing Q1 at $4.52 billion. We added $74 million in NGS ARR from QRadar SaaS. We expect this QRadar NGS ARR to decline to approximately half this amount by Q4 as we focus on upgrading these customers to XSIAM and growing our XSIAM ARR. Also, it is worth noting that about a third of our new platformizations in Q1 came…

A - Walter Pritchard

Operator

[Operator Instructions] Our first question will come from Saket Kalia from Barclays followed by Brad Zelnick from Deutsche Bank. Go ahead, Saket.

Saket Kalia

Analyst

Okay, great. Hey, guys. Thanks for taking my question and nice start to the year. Maybe this is a question for both you Nikesh and Dipak. The platformization strategy is clearly starting to hit its stride. And we've talked about the ARR implications of that longer term, specifically the long-term ARR target. But I'm curious if we can just talk about the margin implications from platformization long term as those deals tend to be bigger and also tend to have higher lifetime value.

Nikesh Arora

Management

Well, I'm going to add Dipak to add. If look at margin, if you look at the biggest cost on any enterprise company's P&L, it's a cost of sales by far. The second largest cost is your COGS as it relates to cloud spend. Now, we are privileged to have some amazing deals with two large cloud service providers, which allow us to maintain margins that are consistent almost with on-prem solutions that other people do because of our scale, and we expect that to continue to improve over time. So that -- at one end, that's a significant factor. The second significant factor towards margin improvement is, as I mentioned, cost of sales. So the more we can platformize with existing customers and have large deal sizes with customers, it reduces our effort but you don't have to get 20 deals to get $200 million like some of our peers, you get one deal for $200 million, which means the cost of sales is lower on an incremental basis as we established a land and expand strategy from a customer perspective. And last but not the least, I sort of alluded to it, we're noticing some very interesting outcomes from a customer support perspective, which ends up being the third largest area of cost. We're seeing, in some cases, our Tier 1 support cases are getting solved by support Copilots, which our support teams are using. So we're significantly reducing the time to resolution of support tickets at least on the sort of simpler end for now. But as I said, we've trained 50,000 data points into our Network Security Copilot. I think as we get better and better at training our models and training their customer support Copilots, where we've fully revamped the way we collect data on customer issues, I think there's tremendous potential there to give us future margin expansion. So I think across the Board, margin expansion on COGS, margin expansion from lower cost of sales, and margin expansion from customer support automation.

Walter Pritchard

Management

Great. Thanks, Saket for the question. Next up is Brad Zelnick from Deutsche Bank, followed by Hamza Fodderwala from Morgan Stanley. Go ahead, Brad.

Brad Zelnick

Analyst

Great. Thanks so much and congrats on a strong start to the year. Nikesh, your net set competitors are talking about hardware refresh cycles. And I appreciate hardware is a much smaller part of your mix. So I won't bother asking why you're not expecting a refresh benefit like they are.

Nikesh Arora

Management

But we look forward to their refresh cycle. So we get a chance to take out their customers last Palo Alto. So I'm delighted there's a refresh cycle in the market.

Brad Zelnick

Analyst

And that's exactly what I wanted to ask. Instead, how should we think about their refresh impacting your opportunity, both in the positive sense that you can go in and displace them as their boxes reach end of life, but also perhaps as a headwind? If they're using the event to bundle in SASE SecOps and other next-gen capabilities. Are you running campaigns actively to go after this? Thank you.

Nikesh Arora

Management

So, Brad, let me parse that out actually. I know I spoke faster and English is my second language. So, I did try to suddenly land in there that I am positive about hardware, where I said we're seeing steady growth in hardware, both from refreshes of boxes for our customers. We're seeing expanded demand for new use cases like ruggedized and IoT, et cetera. And last but not the least, we are seeing slow and steady takeouts of other customers. So what's happening is our SASE cohort from two or three years ago, we landed with SASE. As that end of life happens in that customer base for firewalls, they turn to us and say, now I know the Palo Alto security interface, I don't have to learn it and they can just put firewalls, hardware firewalls against that SASE management pain because we have the same security management pain across SASE. It's not going to be revolutionary, but it is going to be evolutionary. If you look every year, our market share in hardware firewalls goes up 200 basis points to 300 basis points. So we think there are donors in the market of market share who will constantly keep donate market share as they hit their refresh cycles. And there are acquirers of market share, and we're hopefully one of those. So I actually have a steady expectation from product hardware which I think is going to underpin our growth across the Board over the next few years.

Walter Pritchard

Management

Great. Thanks for the question, Brad. Next is Hamza Fodderwala from Morgan Stanley, followed by Brian Essex from JPMorgan. Hamza, go ahead.

Hamza Fodderwala

Analyst

All right. Great. Good afternoon. Thank you for taking my question. And great to see the success with the Prisma Access Browser, you're into that acquisition. Nikesh, I wanted to get your -- just maybe early view into 2025. I mean, on the one hand, there's some optimism on the macro. You have a lot of new products. On the other hand, CIO, CSOs they still want value for what they're spending. There's some talks about the incoming administration looking to perhaps roll back certain regulations, maybe cut entire civilian agencies. You're a big seller into the federal government. So I'm just curious how you weigh those puts and takes as you look into 2025. Thank you.

Nikesh Arora

Management

Thank you, Hamza, for a great question. Look, I think the most -- if you separate signal and noise, the biggest signal is AI in the next 12 to 48 months. And AI is already having significant impact both on the attack side, attacks are getting faster and faster and quicker. AI is possibly being used to evaluate what are the more vulnerable parts of your infrastructure, so we can go after that. So I think from a cyber incident perspective, unfortunately, it's not going to slow down. And that's the biggest driver of improved security posture and improve higher spend from CIOs. I think you're right. There is a consolidation. Let me spend less money for security. And there, we are discovering -- it's a more top-down motion than it is a bottom-up motion. And as you're aware, we are expending a lot of effort to interacting with CIOs and C-level executives. And actually, we're spending a lot more time with our GSI partners trying to address that issue because they are typically involved in the transformation stage where say, let's take all of the stuff and put it together and replace it. So we're seeing early success. As I said, we should have done that sooner because when you sit across this, I say, look, you have nine different products, you could bundle it together, take it down, have one management pain and you'll save a lot of cost because and they understand, because we're not ingesting data nine times across nine products or in just to get once analyzing it nine times, and giving them the outcomes they want. So I think the trend is in our favor. As regards to the incoming administration, I think clearly, a higher standard deviation administration by the sounds of it, and higher standard deviation implies more risk and more risk implies possibly a more return.

Walter Pritchard

Management

All right. Thank you, Hamza. Next up is Brian Essex from JPMorgan, followed by Joe Gallo from Jefferies. Go ahead, Brian.

Brian Essex

Analyst

Great. Thanks, Walter. Thank you for taking my question. And great to see the strong profitability and cash flow, by the way. I want to ask about the integration between Cortex and Cloud. And I wanted to understand when did that kind of hit the market. Is it typically led by Cortex or Cloud? And how should we think about how that positions you competitively, not just in the cloud security market, but across all of Strata, Prisma, Cortex segments of the business?

Nikesh Arora

Management

So look, at a higher level, the Cloud market is effectively right now, three parts, right? There's the entire configuration management part, which is the CNAP part and posture management part. There is the blocking real-time threats and protecting enterprises part, which is the CDR cloud detection response part. And then there's a cloud -- the network traffic that needs to be inspected from a firewall perspective. We're clearly leaders in the network traffic part. As we talked about, 70% of our use case is not public-facing cloud service provider traffic. We are still one of the leaders in the CNAP space from our early start in Prisma Cloud. But what I think is going to happen in the next few years, this market is going to shift more and more toward the real-time security side on Cloud, which is where CDR, cloud SOCs, XSIAM become more and more important. So almost every one of our XSIAM deals, there is a portion of that is deployed toward cloud security now. And having that data together allows us to prioritize all the configuration issues and separate again, signal from noise. So, I'm going to let Lee describe a bit more about how we see that evolving. But I think that will change the cast of characters who are going to win in Cloud Security in the future.

Lee Klarich

Analyst

Yeah. Thanks, Nikesh. Thanks, Brian, for the question. Picking upward where Nikesh left off, the -- if you think about sort of end-to-end cloud security, there's the -- all of the work that goes into sort of the cloud posture side, generates a lot of data and understanding about what assets are deployed, what workloads are deployed, how they're configured, how they might be vulnerable or susceptible to attack, and by connecting that with CDR, it allows us to both leverage that for better protection of the cloud workloads in real-time. And vice versa, it allows us to leverage all the run time, cloud run time components back into posture from a remediation perspective. And so -- we initiated this earlier this year with the initial launch of CDR, which basically connects Prisma Cloud with Cortex. And then since then, we've been continuing to iterate on that and drive closer and closer integration between those two platforms.

Brian Essex

Analyst

Great. Thank you.

Walter Pritchard

Management

Great. Thanks, Brian. Next up, Joe Gallo from Jefferies, followed by Matt Hedberg from RBC. Go ahead, Joe.

Joe Gallo

Analyst

Hey guys, thanks for the question. I think you could characterize cyber guidance broadly for calendar 4Q, is tepid at best. But yet your F 2Q guide calls for an acceleration in RPO and a really strong ARR. So I mean, what are you seeing with budget flush or Fed or pipeline that's allowing you to kind of defy the gravity that others are feeling? Thanks.

Dipak Golechha

Management

Well, I think we covered a lot of these, Joe, in our prepared remarks. I mean, we've got a product portfolio that we feel very proud of. We've just recently done an IBM acquisition, where we have a lot of additional pipeline that's coming through the pipe there. And hopefully, we've proven over the last few years that we have a forecasting process that we feel comfortable, like, manages the business. So I don't want to comment about others, but we really focus more on what we see. And maybe your comment is just proof positive that our platformization strategy is working and is somewhat unique.

Walter Pritchard

Management

Great. Thanks for the question, Joe. Matt Hedberg, go ahead, followed by Gregg Moskowitz after that.

Matt Hedberg

Analyst

Thanks for taking my questions, guys. What stood out to me, the large deal success was striking. I know you spent a lot of time talking about platformization. It seems like Q1 brings a whole another level to it. Could you talk about specifically on the SIEM side of it? The NGS, it really does seem like there's a next-gen SIEM replacement opportunity here. And we've talked a lot about some of the competitors with Splunk. Can you talk about just like what could -- what are some of the catalysts that could unlock some of these large replacement deals? I know they take a long time, but curious if there's anything that you guys can do to accelerate that.

Nikesh Arora

Management

Matt, look, we're very happy in two years since going GA on XSIAM, we're positively enthused about the progress we've made. We've crossed $1 billion in ARR and Cortex. We're seeing larger and larger XSIAM deals. We have 150 customers. And as we already mentioned, have a robust pipeline north of $1 billion. And this is the fastest-growing product in the history of cybersecurity at scale. Now the good news is, there are two or three very interesting characteristics of the SIEM market. If you look at the SIEM market, 90% of the SIEMs are of technology that is 10 to 15 years old. If you go back and look at the history of what SIEMs are, whether QRadar, LogRhythm, Exabeam, Jazz, Sumo Logic, Splunk, these things are 10 -- 7, 10, 15 years old. I think there's a new breed of SIEM players that is fast coming in to replace these legacy SIEMs. I think we're going to go through a SIEM replacement cycle that we went through the endpoint replacement cycle from Symantec and McAfee to the XDR vendors. I think it is a moment of SIEM now for the next five years. Now interestingly, every SIEM deal that we see, we are able to deliver a much better security posture and median time to remediate and detect, which is better than the current deployment and we're able to save cost. So from a compelling proposition perspective, this is a no-brainer. You come and say, I know you're spending $10 million a year running your stock. I can do it for $9 million. I can consolidate and I can improve your median time to remediate from four days in many cases from 19 minutes to four hours. So that's a compelling proposition. We are seeing tremendous amount of interest in the market. We have created a compelling event in the case of QRadar customers because they have to migrate to us or elsewhere, and we're seeing enough traction where people are considering Palo Alto instead. So I think in the next three to five years, you will notice that the entire $20 billion TAM of SIEM is going to go through upheaval.

Walter Pritchard

Management

Great. Thanks for the question, Matt. Next up, Gregg Moskowitz from Mizuho followed by Rob Owens from Piper Sandler. Go ahead, Gregg.

Gregg Moskowitz

Analyst

Great. Thanks for taking the question. Nikesh, now that we're a few quarters into the platformization go-to-market, I'd love to get a little more of a flavor of how it's going. Is there an aspect for two of the strategy that's been most successful so far. For example, if you were to look at traction with legacy trade-ins versus introductory offers or more multiproduct incentives, what would you say is resonating the most with customers?

Nikesh Arora

Management

Thing that seems to resonate the most, Greg, is elimination of execution risk. And what I mean by that is when I go to go to a customer saying, okay, let's go do this in a phased manner. We'll replace your SASE or deploy SASE for you and then Phase 2 will come in and replace their firewalls, they like that. If I say don't worry, I'll start executing today and you can start paying me when you stop being the other vendor, that's kind of the -- that's like the golden bear hug because the biggest risk they have is wait I have to go extend another deal by one year. Guess what, that you're sending a signal to the other vendor, you're out in the air, so the prices go up. And I say, don't worry about it. Let's start executing now were deployed, you can pay me when the current contract expires. So that elimination risk is resonating the most. Again, the customers fully understand that we're going to get our pound of flesh in the year two or year three of that deal. So they understand there is no free lunch. But eliminating that execution risk goes a long way. I think the -- as I said to Hamza and I said in our prepared remarks, it really helps us step back and say, look, what are you trying to achieve? I mean, in many cases, we've been able to converge XDR and SIEM RFPs, for example, saying, listen, 50% of the data is going to go into XDR, which is going to be one vendor. That data is needed for AI-based or machine learning-based analysis across the entire stack. Why wouldn't you make sure that, that data can be part of the same and be used to improve your posture and get better, faster outcomes?

Gregg Moskowitz

Analyst

Thank you.

Walter Pritchard

Management

Great. Thank you, Greg. Next question, Rob Owens from Piper Sandler, followed by Gray Powell from BTIG.

Rob Owens

Analyst

Yeah, thanks, Walter. And Nikesh, as a part of your prepared remarks, I would love for you to build on the data security. And another one of the holy grails alongside next-generation SIEM, of course, is data that everybody is chasing. So what you're seeing from end customers? I know you made acquisitions of a DSPM capability in the space. But how you see Palo Alto's evolution longer term relative to the data opportunity? Thanks.

Nikesh Arora

Management

Rob, this is my perfunctory question. I have to give to Lee otherwise, he…

Rob Owens

Analyst

Sounds good.

Lee Klarich

Analyst

Thanks, Rob. The -- look, if you take a step back, data securities is a long-standing sort of product category that's often been very painful. It's difficult to be accurate in data classification. It's difficult to figure out what policies to enforce and it's difficult to do that holistically everywhere the data might exist and need to be protected, right? There’s -- so there's two pieces to our data security strategy that you've seen us evolve. First is around getting coverage of all the places where data might exist and improving the data classification capabilities within those. So over the last six months, we've launched AI-based data classification, leveraging large language models, machine learning models to get more and more accurate in the data classification, being able to apply that to all different places where data can exist and move. The second piece and very importantly, is the tie-in with Prisma Access Browser. The way that users interact with data, access it, download it, share it is one of the highest-risk areas for data security. And historically, it's been very difficult to get all of the necessary context for enforcing an accurate policy. Within the Secure Browser, we get all of the context needed. And what we're already seeing with the early adopters of Prisma Access Browser is the realization that this One component of what it does is effectively a next-gen data security component for how they secure data interaction with all of their employees. And this is part of the reason why the browser is expanding from being primarily focused on unmanaged devices and third-party contractors to actually being something that applies to all devices and all users across the entire enterprise.

Walter Pritchard

Management

Great. Thanks, Rob, for the question there. Next up is Gray Powell, BTIG, followed by Andy Nowinski from Wells Fargo. Go ahead, Gray.

Gray Powell

Analyst

All right. Great. Thanks for letting me ask a question on the call. Really appreciate it. So, I have to admit, I'm a little confused on the NGS ARR statistics. If I look at the numbers, and back out the QRadar deal, you added around $230 million in net new ARR this quarter versus $270 million a year ago. That metric has never been down on a year-over-year basis before. So is there I’m something or something with the acquisition that maybe I'm not thinking about? Or just like what was the driver there? And then for the full-year increase in NGS ARR, how much of that is organic versus full visibility on the QRadar asset?

Dipak Golechha

Management

So let me answer both, Gray, and let me just start off with the NGS ARR was above our guidance. So some of this, we already knew when we provided the guidance, but -- some of the products that move into NGS ARR have also been the advanced versions of our cloud subscriptions from a year ago, so things that were attached to our firewalls, where we made them cloud-enabled. Some of that happened last year, which is what led to a lot of the increase in the ARR. We're now lapping that. We're not -- so that's really the bigger explanation of the base. We knew that. That's why we included that in our guidance to begin with. When it comes to what's happening with QRadar, we talked about the one-time benefit. Our strategy is to convert all of the customers to XSIAM. Over time, we expect about half of that to occur within this year. So we would expect maybe half of that additional NGS ARR to be there by the end of the year.

Nikesh Arora

Management

Gray, I think to recast what Dipak said, you have seen the peak inorganic NGS ARR this quarter at $74 million, or is that the number, from IBM. And half of that, we will migrate to us, and we expect half of that still stay on QRadar for -- through the end of this fiscal year. So there's no more net new inorganic NGS ARR expected this year.

Gray Powell

Analyst

Understood. Okay. Thank you.

Walter Pritchard

Management

All right. Great. Thanks, Gray. Next up, Andy Nowinski from Wells Fargo, followed by Fatima Boolani from Citi. Go ahead, Andy.

Andy Nowinski

Analyst

Great. Thank you. Good afternoon and great results this afternoon. I wanted to ask you about the Prisma SASE. You highlighted a number of large deals that either deployed SASE or the expanded with SASE. And I know it's bringing a lot of new customers, which is great. But I was wondering if you could provide an update on the growth of ARR from that solution, whether those new customers you're bringing into Palo Alto onto the platform, are coming at the expense of other vendors? Or are those -- were they just not using any SASE solution previously? Thank you.

Nikesh Arora

Management

So, Andy, all of the above, there are some customers who are going through a network transformation and they're now replacing their legacy VPN clients or other solutions they've had in the past. In some cases, there are competitor vendors who only had an Internet proxy-based deployment with the legacy VPN or in some cases, with Palo Alto VPN, which is converting to a full SASE solution from us. So we see all variants of that, as we said, 40% of that are net new logos to us, which means they are not deploying a Palo Alto VPN. They're deploying our SASE solution. So we're seeing all of that. I just think the SASE market, as I said in the past, is a fast-growing market. We have clearly established ourselves one of the top three players in the market. I think we're definitely growing faster than some of the others, one or at least one more of the other top three players in the market. And we particularly like the SASE space because we're always innovating, providing new stuff as we basically -- as I said in my remarks, we've made it available to every existing SASE customers. They can deploy Prisma Access Browser for the unused licenses. So they can actually experience the browser. It's integrated. It's in the same management pain. It's the same UI. Yes. So I guess I feel positive about it. We haven't quite reached $1 billion yet as the way we told you, but we're looking forward to it.

Andy Nowinski

Analyst

Thank you.

Walter Pritchard

Management

Great. Thanks, Andy. Fatima Boolani from Citi is up next. And our last question will be from Roger Boyd from UBS. Fatima, go ahead.

Fatima Boolani

Analyst

Thank you. Good afternoon. I appreciate you taking my questions. I think the topic du jour is definitely QRadar and a lot of the momentum that you've been seeing that $80 million or more than $80 million of bookings that you've already seen in the short amount of time. What I wanted to actually shift gears on is on the on-premise side of the QRadar business. And, Nikesh, some of your commentary, which I think is so apropos, there is just a stodgy stale technology in the SIEM market, right? So that $500 million or so of revenue that is just still captive in the QRadar on-premise space, what is the thought process, the strategy to really forklift those customers to the goodies in XSIAM? And as you think about the arc of the next 12 to 24 months, how should we think about a multiplier effect on that business to really give Cortex booster shot to have it potentially be your biggest pillar?

Nikesh Arora

Management

Yeah, Fatima, I -- we had our Board meeting yesterday, and one of my Board members and I had this debate about which deal is going to look like the best deal Palo Alto ever did. And my bet is in the IBM deal, he bet on the Talon deal. Of course, I like both of them equally successful. But specifically, as it relates to QRadar, our teams are very focused. Since close, we've called the top 500 customers and reached out to see if we can support the migration from QRadar to Palo Alto. This is irrespective of whether they are QRoC or on-prem. I mentioned the $1 billion pipeline. That $1 billion pipeline is a hybrid pipeline at both QRoC and on-prem customers. The message is out there to on-prem customers that this technology will also over time be migrated. And I have to say IBM is doing a phenomenal job working with us and being proactive with those customers where we go -- I had a call yesterday with the CIO or IBM and elsewhere together in the room where we're talking to the customers saying they will provide the migration services, they'll work on the migrating the rules from QRadar to Palo Alto XSIAM and we're going to do it together. So look, it's -- we haven't done a partnership like this ever in the history of our Company. I haven’t seen one in the cybersecurity industry yet. We have a lot of expectations, but it's a lot of execution, a lot of hard work. It's not going to happen because I snap my fingers, but -- our teams are focused, we're dedicated. We're trying to do that. I think this will propel us into the top three SIEM players in the market in the next two years from nowhere. We did not play in this space two years ago.

Fatima Boolani

Analyst

Appreciate that.

Walter Pritchard

Management

Thank you. Last question, Roger Boyd to wrap it up. Go ahead, Roger.

Roger Boyd

Analyst

Great. Thanks, Walter. Dipak, you noted that the contract duration on new business remains constant at roughly three years. Can you comment on what you're seeing with renewal and upsell business? And particularly when customers are renewing on a platform deals and adopting XSIAM, which carries longer duration. I guess as we look to gauge the success of some of these platformization deals, shouldn't we expect to see contracts lengthen as customers place more strategic bets on your platform? Thanks.

Dipak Golechha

Management

Yeah. So I think we're, Roger, thanks a lot for the question. Look, at the end of the day, we're a large company with lots of different customers. We're definitely seeing the dynamic that you mentioned on some customers. We also see dynamics where other customers are saying, look, I know there's a lot more innovation to come. Let me go shorter duration on the renewals because that could be ahead of the large platformization in the future. So we see a little bit of everything. I think on the renewals, just the data trended slightly up, but nothing significant.

Roger Boyd

Analyst

Got it. Super helpful. Thank you.

Walter Pritchard

Management

Great. Thank you, Roger. And that will end the Q&A. I'll turn the call back over to Nikesh for his closing remarks.

Nikesh Arora

Management

Thank you, everyone, once again for joining us. As I said, I'm very excited about our great start to FY '25. We look forward to seeing many of you at upcoming investor events. I also want to thank all of our employees who put a lot of hard work to help us deliver these amazing results. And also, of course, I want to thank all of our customers for trusting Palo Alto for delivering cybersecurity solutions to them. With that, have a wonderful day.