Sophos Group plc Capital Markets Day

Sophos Group plc Capital Markets Day

June 29, 2016

Safe Harbour

The following presentation is being made only to, and is only directed at, persons to whom such presentation may lawfully be communicated (“relevant persons”). Any person who is not a relevant person should not act or rely on this presentation or any of its contents. Information in the following presentation relating to the price at which relevant investments have been bought or sold in the past or the yield on such investments cannot be relied upon as a guide to the future performance of such investments.

This presentation does not constitute an offering of securities or otherwise constitute an invitation or inducement to any person to underwrite, subscribe for or otherwise acquire securities in Sophos Group plc (the “Company”) or any company which is a subsidiary of the Company.

The release, publication, or distribution of this presentation in certain jurisdictions may be restricted by law, and therefore persons in such jurisdictions into which this presentation is released, published or distributed should inform themselves about, and observe, such restrictions.

Certain statements contained in this presentation constitute forward-looking statements. All statements other than statements of historical facts included in this presentation, including, without limitation, those regarding the Company’s financial condition, business strategy, plans and objectives, are forward-looking statements. These forward-looking statements can be identified by the use of forward-looking terminology, including the terms “believes”, “estimates”, “anticipates”, “expects”, “intends”, “may”, “will”, or “should” or, in each case, their negative or other variations or comparable terminology. Such forward-looking statements involve known and unknown risks, uncertainties and other factors, which may cause the actual results, performance or achievements of the Company, or industry results, to be materially different from any future results, performance or achievements expressed or implied by such forward-looking statements. Such forward-looking statements are based on numerous assumptions regarding the Company’s present and future business strategies and the environment in which the Company will operate in the future. Such risks, uncertainties and other factors include, among others: inherent difficulty in predicting customer behaviour; customers may not respond as we expected to our sales and marketing activities; the competitive environment; our ability to adapt to technological change; business interruption or failure of our systems architecture and communication systems; problems with implementing upgrades to our applications and supporting information technology infrastructure; any failure to properly use and protect personal customer information and data; our ability to manage and maintain third party business partnerships; increased regulation of our businesses; any failure to process transactions effectively; any failure to adequately protect against potential fraudulent activities; any significant quality problems or delays; the global macro-economic environment; our inability to attract, retain and develop talented people; our ability to repurchase shares; our inability to adequately protect our intellectual property rights; disruptions, expenses and risks associated with any acquisitions and divestitures; amortisation of acquired intangible assets and impairment charges; our use of debt to finance acquisitions or other activities; and the cost of, and potential adverse results in, litigation involving intellectual property, competition authority, shareholder and other matters. These forward-looking statements speak only as at the date of this presentation. Except as required by the Financial Conduct Authority, or by law, the Company does not undertake any obligation to update or revise publicly any forward-looking statement, whether as a result of new information, future events, or otherwise.

2

Agenda

Strategy Kris Hagerman 20

Product

Overview Joe Levy 20

Sophos Central Bill Lucchini 15

Enduser John Shaw 20

Network Bryan Barney 20

Strategy and Product Q&A session Kris, Joe, Bill, John, Bryan 20

Break 20

Go-To-Market

Channel strategy Mike Valentine 10

Marketing Matt Fairbanks 10

GTM Q&A session Mike and Matt 15

Finance Nick Bray 25

Finance Q&A Nick Bray 20

Summary and Wrap Up Kris Hagerman 10

3

Today’s Presenting Team

Kris HagermanChief Executive Officer

Bryan BarneySVP, Network Security

Bill LucchiniSVP & GM, Cloud Security Group

John ShawVP of PM, Endpoint Security

Matt FairbanksChief Marketing Officer

Joe LevyChief Technology Officer

Mike ValentineSVP, Worldwide Sales

Nick BrayChief Financial Officer

4

StrategyKris Hagerman

Chief Executive Officer

22.6%Cash EBITDA margin(4)

101.9%Renewal rate including up-sell and cross-sell

Sophos Snapshot

Compelling IndustryFundamentals

Security consistently is the top priority for corporate IT spend

$38B TAM (1) 7%

CAGR (1)

45%Enduser50%

Network

5%Other

Complete Cloud-Enabled Security Offering for Mid-

Market

Only player focused on the mid-market

with a comprehensive endpoint and network

offering

Highly EfficientSales Model

100% “channel first” approach delivers

scale and operating leverage

800+Sophos Partner

Reps & Sales Engineers

20,000+ Partners

175,000+ Sales Reps

65,000+ Sales Engineers

Workwith

+13.4%Enduser like-for-like billings

growth(2)

+27.5%Network like-for-like billings

growth(2)

$534.9MReported billings(3)

+19.7%Like-for-like billings growth(2)

Large (5)

Mid-Market

26%

18%

56%

SMBIntegrated through Sophos Central

Who deliver

FY16

Scale, above-market growth, healthy profitability, visibility and sustainability

6

Mission

To be the best in the world at delivering

complete IT security to mid-market enterprises

and the channel that serves them

Strategy

Security only

Focus on mid-market enterprises

Complete security – Made simple

Integrated Next Gen endpoint and network security

Managed and delivered through the cloud

‘Channel First’ sales model

7

Synchronized Security Platform and Strategy

Sophos Central

Cloud Intelligence

Sophos Labs

Analytics | Analyze data across all of Sophos’ products to create simple, actionable insights and automatic resolutions

| 24x7x365, multi-continent operation |URL Database | Malware Identities | File Look-up | Genotypes | Reputation | Behavioural Rules | APT Rules Apps | Anti-Spam | Data Control | SophosID | Patches | Vulnerabilities | Sandboxing | API Everywhere

Admin Self Service Partner| Manage All Sophos Products | User Customizable Alerts | Management of Customer Installations

Endpoint/Next-Gen Endpoint

Mobile

Server

Encryption

UTM/Next-Gen Firewall

Wireless

Email

Web

In Cloud On Prem

8

Robust Innovation Pipeline for FY17

• Unified Endpoint Management• Security Heartbeat• Sophos Central managed Full EMM• iOS Mobile Security

• Hyper-V protection• AWS Auto-scaling• MTD for Linux, Windows• Security Heartbeat

• Next Gen Endpoint: Exploit Prevention, Anti-Ransomware, Root Cause Analysis

• Sophos Clean• Role-based Administration in Sophos Central

• Sophos UTM 9.5• XG Firewall and Firewall Manager v16• New Synchronized Security Use Cases• New XG Series Appliances

• Global Sophos Central managed SWG• Next-Gen Web Protection • Hybrid On-Prem and Cloud Model • Simplified licensing and pricing

ENDPOINT

MOBILE

SERVER

UTM/NGFW

WEB

• Synchronized Encryption• Sophos Central managed Full Disk Encryption• Multiple Key Support

ENCRYPTION

• Sophos Central managed Wireless• New Sophos Secure Access Points• New XG 1x Series Wireless AppliancesWIRELESS

• Sophos Central managed Sophos Email• Time of Click Protection• New Anti-Spam Engine• New Sophos Email AppliancesEMAIL

9

Competitor Landscape

Mid Market Centric

Network Leader

Endpoint Leader

Sync Security

Channel First

Mid Market Centric

Network Leader

Endpoint Leader

Sync Security

Channel First

Mid Market Centric

Network Leader

Endpoint Leader

Sync Security

Channel First

Mid Market Centric

Network Leader

Endpoint Leader

Sync Security

Channel First

Mid Market Centric

Network Leader

Endpoint Leader

Sync Security

Channel First

Mid Market Centric

Network Leader

Endpoint Leader

Sync Security

Channel First

Mid Market Centric

Network Leader

Endpoint Leader

Sync Security

Channel First

Mid Market Centric

Network Leader

Endpoint Leader

Sync Security

Channel First

Mid Market Centric

Network Leader

Endpoint Leader

Sync Security

Channel First

Mid Market Centric

Network Leader

Endpoint Leader

Sync Security

Channel First

10

Multiple Growth Drivers

• Large and rapidly growing marketo $38B market growing at 7% per yearo Sophos addressable market $15B+ growing at 7%+o Approximately 60% of this market is SMB and mid-marketo Over 60M small and mid-market enterprises worldwide

• Market share expansiono Appx. 5% share of enduser security market and 5% share of network security market: plenty of “running room”

• Continued global expansiono Growth opportunities in multiple underpenetrated regions, including US, LatAm, Asia Pacific and others

• Innovation and disciplined M&A to drive new sales opportunities with existing customers and enter new, adjacent markets

o Next-Gen Endpoint, cloud-managed Wi-Fi, cloud-managed Email security, cloud-managed Web security, analytics

• Continue to leverage Channel First sales modelo Recruit more partnerso Turn more of the existing partner base into “Blue Chip” partnerso Drive greater productivity, share of customers, and share of customer IT security wallet among Blue Chip partners

• Significant up-sell and cross-sell opportunitieso Leverage Sophos Central platform across entire portfolio to help partners drive up-sell and cross-sell

11

Product OverviewJoe Levy

Chief Technology Officer

MegatrendsCloud, Mobile and IaaS driving CASB, EMM, and data protection

Top Security Trends

Paradox of EncryptionPervasive SSL inhibits network decryption, requiring collaboration with endpoints for content visibility

Public/Private Sector Encryption TensionsApple/FBI, GDPR mandates, #nobackdoors

Ransomware and CryptowareA $325M “business”, demands NGEP solutions

IoT Expands Attack SurfacesDevices need protections at the network level

Common-mode FailuresThe Internet is built on common components, vulnerabilities must be mitigated before patching can occur

Lack of Defender CoordinationAnalytics showing promise as it matures from novelty to utility

Cybersecurity Skills GapEnterprises increasingly cite a shortage of security professionals, driving the need for simplicity

C-level Spear Phishing (“Whaling”)Increasing attack professionalism requires better training and detection tools

Risk-Based Approach to SecurityEnterprises are learning to quantify risk, and are beginning to match controls to attack surface

14

THE 99%

Off the shelf

Exploit Kits

ExecutableMalware

Doc / ScriptMalware

DataLeakage

THR

EATS

0days

Long dwellCampaigns

InjectionAttacks

TargetedPhishing

BespokeMalware

SIEM

Threat Intel

CO

NTR

OLS Endpoint AV URL Filtering

Email SecurityWAF

Encryption

CASB

NextGen FirewallSandboxing

NextGenEP

DLP

User Behavior Analytics

Security Automation / Risk

Quantification

1%

Critical Infrastructure / Nation-State Attacks

Supply Chain Integrity Compromises

Insider movementPTH, Skeleton Key,

Golden Ticket

Deception Networks / DDW monitoring

TIMECOMPLEXITY

RISK BASED ROI

15

TIME

User Behavior Analytics

Security Automation / Risk

Quantification

1%

Critical Infrastructure / Nation-State Attacks

Supply Chain Integrity Compromises

Insider movementPTH, Skeleton Key,

Golden Ticket

Deception Networks / DDW monitoring

Off the shelf

Exploit Kits

ExecutableMalware

Doc / ScriptMalware

SIEM

DataLeakage

Threat Intel

THR

EATS

CO

NTR

OLS Endpoint AV

THE 99%

URL Filtering

Email SecurityWAF

Encryption

CASB

NextGen Firewall

0days

Long dwellCampaigns

InjectionAttacks

TargetedPhishing

BespokeMalware

SandboxingNextGen

EP

COMPLEXITY

RISK BASED ROI

Complete SimpleSystem

16


Sophos Central

Cloud Intelligence

Sophos Labs





Mobile

Server

Encryption


Wireless

Email

Web

In Cloud On Prem

17

Sophos Central

Cloud Intelligence

Sophos Labs




Mobile

Server

Encryption

Wireless

Email

Web

In Cloud On Prem

Endpoint/Next-Gen EndpointUTM/Next-Gen Firewall


Heartbeat

18

Sophos Central

Cloud Intelligence



Mobile

Server

Encryption

Wireless

Email

Web

In Cloud On Prem

Endpoint/Next-Gen EndpointUTM/Next-Gen Firewall


Sophos Labs | 24x7x365, multi-continent operation |URL Database | Malware Identities | File Look-up | Genotypes | Reputation | Behavioural Rules | APT Rules Apps | Anti-Spam | Data Control | SophosID | Patches | Vulnerabilities | Sandboxing | API Everywhere

Unknown App ID

19

Cloud Intelligence





Wireless

Email

Web



Mobile

Server

Encryption

Sophos CentralIn Cloud On Prem

Synchronized Encryption

20

Encryption

Cloud Intelligence



Sophos Central


Email

Web

In Cloud On Prem



Wireless


Mobile

Server

Lateral Movement Protection

21

Mobile

Server

Wireless

Encryption

Cloud Intelligence




Web



Email



Synchronized Phishing Protection

22

Server

Wireless

Encryption






Email



Mobile

Web

Cloud Intelligence

Continuous Authentication

23

Sophos CentralBill Lucchini

SVP and General Manager, Cloud Security Group


Sophos Central

Cloud Intelligence

Sophos Labs





Mobile

Server

Encryption


Wireless

Email

Web

In Cloud On Prem

26

Sophos Central

27

Sophos Central: Admin Dashboard

User-Centric

Unified

Powerful

Simple

Fast

28

Sophos Central: Self Service

29

Sophos Central: Partner Dashboard

Partner-Centric

Portfolio Mgmt.

MSP

License Mgmt.

Trial to Purchase

30

Sophos Central: Partner View

View Upsell Opportunities

View Renewal Opportunities

Easily Manage Licenses

31

FY16 Sophos Central Launches

Locate for MobileMobile Security

Server LockdownWeb Gateway: Win/Mac

Web Gateway: iOS

Web Gateway: Chromebook

Security Heartbeat

vShield

AD Sync Filters Groups

Endpoint Update Caching

Download Reputation

Application Control

Endpoint for Linux

Localization

Updated Email Alerts

32

Sophos Central: Fastest Growing Solution in Sophos History

92% Growthin Active Partners

0k

2,000k

4,000k

6,000k

8,000k

10,000k

12,000k

Q1FY14 Q2FY14 Q3FY14 Q4FY14 Q1FY15 Q2FY15 Q3FY15 Q4FY15 Q1FY16 Q2FY16 Q3FY16 Q4FY16

220% Growthin Billings

1,000

1,500

2,000

2,500

3,000

Apr May Jun Jul Aug Sep Oct Nov Dec Jan Feb Mar

77% of billings come from

competitive wins

33

Enduser ProductsJohn Shaw

VP Product Management ESG

Data Protection

Device Encryption

File Encryption

Pro

du

cts

% o

f En

du

ser

Bill

ings

(1)

Endpoint Protection Server Protection

Server Standard

Server Advanced

Mobility Management

Mobile Security

Mobile Control

Note: 1. Figures refer to FY16 on a like-for-like basis

Endpoint Standard

Endpoint Advanced

Endpoint Intercept

Enduser Security: Product Overview (13% Growth)

8%

11%14%

67%

36

Sophos Enduser Security Strategy

Secure the (Mobile) Device

Secure phones and tablets like any other endpoint

Signature-less Next-Gen Protection

Across Windows, Mac, Linux and Android

Next Gen EncryptionEncrypt Everything, All the

time, EverywhereHacker-Proof Encryption

Secure the Servers Protection optimized for

servers (physical, virtual and IaaS)

Innovate to Enhance and Expand Existing Business and Enter Exciting Adjacent Growth Opportunities

Highlights

Schrodinger

Application Reputation

Secure BYOD

Root Cause Analytics

Exploit Prevention

CryptoGuard

IaaS (AWS / Azure)

Synchronized security

37

Sophos Central

Data ProtectionEndpoint Protection Server ProtectionMobility Management

Schrodinger: Driving Cross-Sell

Management capabilities for larger organisations

Feature parity in Sophos Central

On premise version

38

Next-Gen

Detect

Device ControlApp ControlWeb Control

Surface ExecuteFile Heuristics

Signatures

Traditional

Root Cause Analysis

Network IsolationKey Revoke/Restore

PostureInvestigate Clean

Signaturelesscleanup

AdvancedExploit Prevention

Malicious Traffic Detection

BehaviorExploit

QuarantineMalware Removal

Remediate

Crowd Sourced Reputation

Delivery

Prevent

Whitelist

Application Lockdown

BehaviorHIPS/Behavior

Monitoring

Collaborate

Synchronized Security

EmulationOn Device Emulation

Respond

ExposureWeb Protect

DLP

Cryptoguard

Behavior

Sophos Next-Gen Endpoint

39

Exploit Prevention and Next-Gen Endpoint Protection

ANNUAL NEW MALWARE

SAMPLES100,000,000s

ANNUAL KNOWN EXPLOITS (CVE’S) 1,000s

CUMULATIVE KNOWN EXPLOIT TECHNIQUES 24

40

Next-gen Endpoint: Root Cause Analytics

41

Mobile Strategy: Manage, Secure + Protect DataAn Endpoint Is an Endpoint Is an Endpoint

42

Server Protection Strategy

•Optimize performance •Lightweight agent

•Performance is key•Agentless/Light agent

•On-demand resources•Usage based licensing

PHYSICAL VIRTUAL IaaS

Optimized for performance

MTD Server Spectrum

ADDING NEXT GEN PROTECTION

Anti-malware

TODAY

MTD CryptoguardLockdown

43

Two Types of Encryption: Both Are Needed

FULL DISK ENCRYPTION FILE ENCRYPTION

Protects against device theft or loss

Secures data stored in the cloud

Secures data even if exfiltrated

Secures sensitive email

Secures data even if system is hacked or compromised

Helps to protect against insider threats

Secures data stored on mobile devices and elsewhere44

Synchronized Encryption: A New Paradigm in Data Protection

User Integrity App Integrity System Integrity

Encrypt Everything, Everywhere, Automatically

Synchronized with Endpoint Protection

“By 2019, 25% of security spend will be driven by EU data protection regulation

and privacy concerns.”- IDC

45

Network ProductsBryan Barney

SVP and General Manager NSG

Pro

du

cts

% o

f N

etw

ork

Bill

ings

(1)

81%

11%4%

UTM/Next-GenFirewall

Secure Wi-Fi Email Security

Network Security: Product Overview (28% Growth)

UTM/Next-Gen Firewall IPS Application control User-based policies Web filtering Email security SG105W/115W/125W/

135W (desktop UTMs with built in wireless)

AP15, 55, & 100 (wireless access points)

RED

iView Reporting

Sophos UTM Manager

Sophos UTM for AWS

Note: 1. Figures refer to FY16 on a like-for-like basis

Secure Email Appliance

Virtual Email Appliance

PureMessage for Unix

PureMessage for Exchange

Sophos Email (Beta: cloud-based email security)

Sophos Wireless (Beta -cloud managed wireless access points)

4%

Web Security

Secure Web Appliance

Virtual Web Appliance

Cloud Web Gateway (cloud-based web security)

48

Sophos Network Security Strategy

Accelerate NGFW/UTMCombine the strengths of Sophos

and Cyberoam

Grow Secure Email Gateway

Consolidate technology and launch a cloud offering

Become a Leader in Wireless

Leveraging UTM/NGFW, build a cloud-managed wireless product

line

Innovate to Enhance and Expand Existing Business and Enter Exciting Adjacent Growth Opportunities

Highlights

Grow Secure Web Gateway

Consolidate technology and create hybrid offerings

IaaS (AWS / Azure) Advanced securityIntegrate with Sophos Central

Synchronized security Converged architectures Performance

49

UTM/Firewalls: Two Platforms with Competitive Advantage

Trusted platform getting stronger

New platform for an exciting future

SG UTM XG Firewall

• Combined platform with the best features of SG UTM 9 and Cyberoam

• Feature superset of Sophos SG UTM

• Simplified user experience

• Comprehensive central management solution on-prem and in the cloud

• Enhanced Synchronized Security

• Solid, stable platform customers and

partners know and love

• Sophos Sandstorm in v9.4

• WAF and VPN enhancements in v9.5

• Future-proofed and ready for SF-OS

whenever customers/partners choose

50

SFOS v16 User Interface (UTM/NGFW)

administrator

51

UTMWi-Fi

Sophos Wireless Strategy

Proliferation of Wi-Fi across enterprises of every size

Opportunities to accelerate growth:• Improved performance / scale • Separation of admin privilege • Competitive in pure Wi-Fi opportunities

UTM Managed Cloud Managed

Better scalabilityFaster innovationNew sales opps

Improved scalabilityBenefit from cloudSeamless migration

Next-Gen Protection


Simplified Experience

Visibility and Reporting

Sophos UTM Wi-Fi:• Strong solution, good features• 50%+ YoY fastest NSG growth• Expanding hardware portfolio

Differentiate

MARKET FORCES

52

Next-Gen Protection

Data Protection


Simplified Experience

Sophos Email Strategy

Proven securityOffice 365 integration

Self-Service PortalContinuity

Managed ApplianceATP FeaturesEncryption

DLP

Office 365 AdoptionIncreased Threat Vector

MARKET FORCESSophos Email solutions:• Powerful security features• Strong industry reputation• Evolving portfolio

Opportunities for Growth:• Secure Office 365 • Protect against evolving threats• Support global compliance landscape

UTM Managed Cloud Managed

Differentiate

53

Sophos Web Protection Strategy

Cloud UTM/FirewallApplianceEndpoint

• All the features Sophos UTM customers receive today

• Web category policies• Web malware detection• On-prem reporting (iView)• Optional cloud sandbox

Web Standard

• Web Standard + • Extra SWA 4.x features• Cloud reporting• Hybrid enforcement • Web DLP (future)• CASB visibility (future)

Web Advanced

• Web control • Category-based web

filtering enforced on and off the corporate network

Endpoint Advanced

54

Product Q&A Session

Channel StrategyMike Valentine

SVP of Worldwide Sales

Sophos ‘Blue Chip’ Partner Growth (1)

20002100220023002400250026002700280029003000310032003300340035003600370038003900400041004200430044004500460047004800

Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4

National Resellers

Distributors

FY 2014 FY 2015Note:1. Blue chip partners defined as partners transacting 5 or more deals in trailing 6 months

FY 2016

Sampling of VARs

High-Quality and Fast-Growing Channel Ecosystem

58

‘Channel First’ Approach Drives Reach and Leverage

Best-in-Class Reach and Leverage

Sophos Partner Reps and Sales Engineers

800+Partners

20,000+ 175,000+ Sales Reps

65,000+ Sales Engineers

Key Elements

Greater customer reach and touch1

Lower go-to-market costs2

More predictable billings3

Faster to scale4

Increased customer satisfaction5

Key Benefits

1 Commitment to channel at the top

Attractive program: discounts, tiers, etc.2

Effective training and certification3

High quality products4

Channel-focused sales executives5

High quality partner marketing and partner enablement6

Opportunity to cross-sell other products and services7

No direct sales destroying channel trust/loyalty8

Work with Who Deliver

59

NETWORK SECURITY

APPLIANCE

NETWORK SECURITY

OVERALL SCORE 93.2 90.4 74.9 76.3

Sophos Sweeps Prestigious CRN ARC Awards

CLIENT SECURITY

Sophos is the first-ever winner in all

THREE security categories

two years running

Source: CRN 2015

OVERALL SCORE 91.8 81.8 80 79.4

OVERALL SCORE 91.6 90.6 79.5 77.3

CLIENT

SECURITY

WINNER

2015

NETWORK

SECURITY

APPLIANCE

WINNER

2015

NETWORK

SECURITY

WINNER

2015

60

Why Are Partners Joining Sophos

Synchronized SecuritySophos CentralNext-Gen Endpoint

(Intercept)

61

MarketingMatt Fairbanks

Chief Marketing Officer

What Does Marketing Do?

AWARENESS DEMAND GEN ENABLEMENT

64

Consistent Growth in the Marketing Funnel

Q2FY14

Q3FY14

Q4FY14

Q1FY15

Q2FY15

Q3FY15

Q4FY15

Q1FY16

Q2FY16

Q3FY16

Q4FY16

Marketing Contacts

+40%

Qualified Leads

+58%

Closed Business

+92%WEBSITE VISITORS

MARKETING CONTACTS

QUALIFIED LEADS

WON

65

Awareness

67

Sophos Home

Accounts Created NPS Score

45Industry Avg.

19350,000+

EXCELLENT

0

50,000

100,000

150,000

200,000

250,000

300,000

350,000

400,000

NO

V

DEC

JAN

FEB

MA

R

AP

R

May

Jun

“There are zero reasons for a home user to pay for AV now . . . and per-machine web-filters are a huge bonus for us parents!!”

Brad Call, Internal I.T. Ltd.

“I've found it to be easy to use, reliable, and not heavy on system resources. It's also picked up on every bit of malware that I've been able to throw at it.”

ZD Net Review

“Very unobtrusive program, doesn't have constant nag windows trying to get me to upgrade. If I wanted to be nagged to death I would go talk to my ex-wife.”

Anonymous IT Administrator

68

Partner App

Sophos Partner Program: Marketing Tools

• Simple quoting and deal registration• Online training and certification• Partner demand gen campaigns• Sophos website-in-a-box and marketing service center• Asset registration and reporting• Renewal tracking• Sales tools, price configurator, battlecards

• Partner Portal in your pocket• View and register for Sophos events• Rate presenters at events / feedback• Sophos news and alerts• Webcasts / podcasts on the go

Partner Portal

69

Sophos Partner Program: Marketing Campaigns

• Digital awareness with channel media and PR outreach

• Active partner recruitment at industry events

• Disti-led partner recruitment efforts

Partner RecruitmentPartner Campaigns

• 55% of discretionary marketing spend on channel “to” and “thru” efforts

• Funding skewed heavily to largest partners who drive the most volume

• e.g., 46% YoY billings growth at CDW

Partner Spend

Ransomware

HIPAA Compliance

7 Deadly IT Sins

Encryption

Virtualization Security


XG Firewall

Endpoint Comparison

TMG ReplacementSophos vs. Websense

Sophos vs. Symantec

Banner Ads

Landing Page

Emails

UTM Elevated 9.4

70

Go-To-Market Q&A Session

FinanceNick Bray

Chief Financial Officer

Billings TrendsHigh-teens growth with contribution from Network and Enduser

204.1 224.1 238.2

158.5

223.7

266.725.5

28.2

30.0

FY14 FY15 FY16

476.0

47%

47%

41%

6%

6%

5%

534.9

ENDUSER

NETWORK

OTHER

53% 45%

50%

LIKE-FOR-LIKE BILLINGS GROWTH ($M)

4.3%

17.5%

19.7%

0.5%

13.0% 13.4%

18.0%

30.7% 31.2%

8.9%

23.9%

27.5%

FY14 FY15 FY16

ENDUSER

NETWORK

GROUP

UTM

534.9

388.1

74

New and Existing Customer Billings

New Customer Metrics FY15 FY16

Partners 15K 20K

Blue Chip partners (>5 orders last 6 mo.) 3.4K 4.7K

Number of customers 200K 220K

New Customer Billings(5) YOY 33.0%

Existing Customer Metrics FY15 FY16

Customer Billings(5) YOY 19.7%

Renewal rate 100.2% 101.9%

Cross-sell % Endpoint / UTM 5.6% 7.4%

FY14 FY15 FY16

New Customer Enduser Billings(5) YOY -20.8% 16.3% 28.3%

Significant Enduser recovery

New business to brand new customers has improved growth; aided by improvement in the renewal rate

75

Long-Term Stability of Billings

33.0

9.0

48.0

6.04.0

FY16

100.0

3 Year Subscription

2 Year Subscription

1 Year Subscription

5 Year Subscription4 Year Subscription

4.0 6.0

48.0

9.0

33.0

FY16 FY17 FY18 FY19 FY20 FY21

EXAMPLE AVAILABLE FOR RENEWAL ($M) AS EXISTING CUSTOMER BILLINGS

EXAMPLE NEW BILLINGS ($M)

Majority of current year billings are available for renewal three years out; hence growth of the existing customer base takes time yet is very robust

Average billings length has remained consistent over time

(FY16: 28.6 months; FY15: 28.0 months)

76

Cumulative Effect of New Billings

3 Year Subscription2 Year Subscription1 Year Subscription


New billings continually adding to the existing customer base

33.0 33.0 33.0 33.0 33.0 33.0

9.0 9.0 9.0

48.0

48.0

6.0

4.0

FY16 FY17 FY18 FY19 FY20 FY21 FY22

FY16

FY17

FY18

FY19

FY20

FY21

FY22

FY23

FY24

FY25

FY26

FY27

FY28

FY29

• The renewal rate (FY16: 101.9%) reflects a sticky existing customer base…• …Which with the cumulative effect of new billings translates to a solid opening base level of billings at the start of

each year (rather than starting each year at zero)…• …From which the Group can then grow…• …Supporting growth momentum and providing visibility

EXAMPLE OF CUMULATIVE EFFECT ($M)EXAMPLE AVAILABLE FOR RENEWAL ($M) AS EXISTING CUSTOMER BILLINGS

77

Short-Term Billings Visibility and Sustainability

Billings, $M FY16 rates FY15 FY16Growth

(AR)Growth

(LFL)

Subscription 384.9 422.8 9.8% 16.5%

Hardware 78.4 99.0 26.3% 37.7%

Other 12.7 13.1 3.1% 10.2%

Total billings 476.0 534.9 12.4% 19.7%

FY17 renewal base for existing subscription billings up c.11%(6); majority of subscription contracts are from renewals and hence expected to increase double digit even without further improvement in the retention rate

• Subscription billings split c.$333M from existing customers and c.$90M from new customers

• FY17 renewal base for existing subscription billings up c.11%

78

159.0

66.8

24.0

14.2

FY16

264.0

25%

9%6%

Billings by Region and EMEA CurrencyStrong diversification of billings by market; modest UK domestic exposure

215.9255.5 264

124.6

152.9187.947.6

67.6

83.0

FY14 FY15 FY16

476.0

54%

32%

32%

12%

14%

16%

EUR

GBP

USD

56% 49%

35%

534.9

388.1

60%

OTHER

EMEA

AMERICAS

APJ

30%

12%

4%

3%

% EMEA % TOTAL

EMEA Billings

Sterling and Euro costs at 20% and 26%, respectively 79

Billings to Revenue Example

• Three brand new customers purchasing subscriptions in the middle of FY16 of one, two and three year durations

• One brand new customer purchasing hardware

• Cash received up-front on standard credit terms

• Subscription billings recognised over the term of the contract

• Hardware billings recognised up-front

Billings Revenue Recognition

FY16 FY16 FY17 FY18 FY19

Customer 1 – 1 year subscription

100 50 50


100 25 50 25


100 17 33 33 17

Customer 4 – Hardware 100 100

400 192 133 58 17

Current-year billings recognised as revenue over term of contract

80

0.8 1.5 1.5 1.5 0.8

8.0

16.0 16.0

8.0

2.3

4.5 2.3 16.5

16.5

FY16 FY17 FY18 FY19 FY20 FY21

Subscription Billings to RevenueBillings flow more evenly to revenue; yet not linear due to mix of contract terms

EXAMPLE REVENUE RECOGNITON ($M)

33.0

9.0

48.0

6.04.0

FY16

100.0

3 Year Subscription

2 Year Subscription

1 Year Subscription


EXAMPLE NEW BILLINGS ($M)

81

Revenue by Source

REPORTED REVENUE BY SOURCE ($M)

251.4

128.7

98.1

FY16

478.2

REPORTED BILLINGS BY TYPE ($M)

422.8

13.1

99.0

FY16

534.9

SUBSCRIPTION+9.8%

79.0% of billings

HARDWARE+26.3%

18.5% of billings

OTHER+3.1%

2.5% of billings

52.6% of total revenuebrought forward deferred

revenue

20.5% of total revenuefrom FY16 hardware

billings(7)

26.9% of total revenuefrom FY16 subscription

and other billings

Over half of FY16 revenue from opening deferred revenue balance; hardware billings have an immediate effect; current year subscription billings mostly benefit future years

Revenue in the main reflects past billings performance

286.5

FY17

82

Deferred Revenue Analysis

$M FY14 FY15 FY16

Billings 388.1 476.0 534.9

Revenue recognised (378.8) (446.7) (478.2)

Net deferral 9.3 29.3 56.7

Translation and other adjustments 12.8 (43.8) 8.7

Net movement 22.1 (14.5) 65.4

Deferred revenue – b/f 425.7 447.8 433.3

Deferred revenue – c/f 447.8 433.3 498.7

251.4286.5

118.4

137.7

50.6

58.412.9

16.1

End FY15 End FY16

< 1 YEAR

2-3 YEARS

>3 YEARS

1-2 YEARS

433.3

498.7

+14.0%

+15.4%

+24.8%

+16.3%

+15.1%

Subscription billings growth takes time to translate to revenue; strong subscription performance increases deferred revenue, hence revenue growth lags subscription billings growth

14.0% increase YOY in revenue to be recognised within one year

TOTAL

83

Earnings Analysis

EBITDA RECONCILIATION

$M FY14 FY15 FY16

Cash EBITDA 97.0 101.4 120.9

Cash EBITDA margin 25.0% 21.3% 22.6%

Net deferral of revenue (9.3) (29.3) (56.7)

Adjusted EBITDA 87.7 72.1 64.2

• Number of Shares currently 452M; dilution policy announced at IPO: up to 10% over five years

• Share Based Payments will increase over time with each annual issue of three-year “options”; FY16 charge of $15M expected to broadly double in FY17 as moving to run rate

• Will decrease over time given reducing balance methodology

• FY16 charge of $29M expected to fall to $18M in FY17

• Operational ETR medium term in the 24% to 26% range, longer term expected to decline as benefit of UK tax rate obtained with majority of IP being held in the UK

• Anticipated reduction in cash tax YOY below $25M FY16 amount

• Previously under a private equity funding structure• FY16 re-financed debt to $235M and €60M facility

agreements• Margin of Libor and Euribor +2.25%

Cash EBITDA is a leading indicator of current year cash flow and future statutory profit performance (billings less expenses); Adjusted EBITDA is an indicator of past performance (revenue less expenses)

Share based payment expense (1.3) (1.4) (15.0)

Depreciation (7.6) (8.3) (8.4)

Amortisation (58.7) (47.6) (29.2)

Gains / (loss) on group asset disposal (0.1) - -

Exceptional items (16.0) (17.3) (41.9)

Unrealised foreign exchange (loss) / gain (6.4) 2.0 (2.4)

Operating loss (2.4) (0.5) (32.7)

Net finance expense (88.1) (53.8) (35.7)

Income tax charge (0.7) (5.7) (3.5)

Loss for the year (91.2) (60.0) (71.9)

84

Cash Flow: Working Capital Focus

$M FY15 FY16

Cash EBITDA 101.4 120.9

Capex (11.9) (16.8)

Cash tax (25.7) (25.2)

Change in working capital 1.5 (32.5)

Unlevered FCF 65.3 46.4

$M FY15 FY16

Unlevered FCF 65.3 46.4

Capex 11.9 16.8

Exceptional items (17.3) (41.9)

Net cash from operating activities

59.9 21.3

Unlevered free cash flow is expected to approximately double in FY17• Profit level anticipated to improve• Working capital in FY17 expected to normalise at approximate average of FY15 / FY16

CASH EBITDA TO UFCF(8) RECONCILIATION UFCF TO OPERATING CASH RECONCILIATION

$M FY15 FY16

Increase in inventory (8.1) (6.7)

Increase in trade and other receivables

(15.8) (16.1)

Increase/(decrease) in trade and other payables

27.0 (10.9)

Other (1.6) 1.2

Change in working capital 1.5 (32.5)

WORKING CAPITAL MOVEMENTS

Working capital in FY17 expected to normalise

85

Outlook: Confident on Key Metrics for FY17

• FY17 Outlooko Mid-teens percentage billings growth on a like-for-like basis; contributing to similar

mid-teens revenue growtho Modest Cash EBITDA margin expansion; reflecting the operational leverage in the

businesso Unlevered free cash flow expected to approximately double; as working capital

normalises and the level of our anticipated profit improves

• Q1 Trading Updateo Sophos has continued to enjoy strong trading, with Q1 billings expected to be above

the Board’s expectationso Q1 FY17 Like-for-like billings growth is expected to be in the range of 20 percent to

23 percent year-over-year o Billings assisted by a material contract with an existing customer o Sophos re-confirms FY17 outlook

86

Finance: Key Points (1 of 2)

• Billings: 79% of billings from subscriptions which are visible, sustainable and have a strong “cumulative growth” impact

￮ c. 62% of FY16 total billings from existing customer subscriptions with a 101.9% renewal rate

￮ Existing customer subscription billings growth driven by the cumulative effect; assisted by improving

renewal rate

￮ Strong growth in subscription billings from new customers which is expected to grow

￮ Positive cumulative impact of new customer billings results in growth even if new customer billings flat

• Revenue: High level of visibility

￮ 53% of FY16 revenue from deferred revenue on the balance sheet at the start of the period; current year

billings in the main benefit future periods

￮ Revenue growth rate has been moving closer to billings growth rate and we expect this to continue

87

Finance: Key Points (2 of 2)

• Cash EBITDA margin: Improving and now a solid proxy for unlevered free cash flow

￮ Investments set to drive billings growth

￮ Cash EBITDA (billings less expenses) has grown over the past three years; yet adjusted EBITDA (revenue

less expenses) has declined with significant subscription billings deferred to the balance sheet

￮ Inflexion point imminent

• Unlevered Free Cash Flow: Expected to approximately double in FY17

￮ Working capital expected to be a more normal year in FY17; specifically creditor movements

• FY17: Confident on key metrics for FY17

￮ The year when all key metrics start moving “up and to the right” – billings, cash EBITDA and unlevered

free cash flow; statutory metrics of revenue and adjusted EBITDA also expected to move positively

88

Finance Q&A Session

Summary and Wrap UpKris Hagerman

Chief Executive Officer

Summary and Wrap Up

• Strong market and demand environment

• Focused and differentiated mission and strategy

• Solid and consistent execution across product, go-to-market, and operations

• Innovative product roadmap led by synchronized security platform and Sophos Central

• Solid foundation for continued strong financial performance driven by billings growth in existing customers and new customers

91

End Notes

(1) Source for c.$38Bn IT security market (hardware + software) is IDC WW IT Security Products 2015-2019 Forecast: Comprehensive Security Product Review (December 2015, IDC #US40709015) and represents expected market size in 2016. Growth of 7% represents2015E-2019E CAGR.

(2) Like-for-like billings represent billings on a constant currency basis excluding disposals and including acquisitions from the point of acquisition plus the pre-acquisition billings of any acquired companies on a reported basis. Like-for-like billings are presented to enhance comparability. Key constant currency rates for the period were: USD vs. Euro of 0.931; USD vs. GBP of 0.674; and USD vs. Yen of 119.9.

(3) Billings represents the value of products and services invoiced to customers after receiving a purchase order from the customer and delivering products and services to them, or for which there is no right to a refund for undelivered items. Billings does not equate to statutory revenue.

(4) Cash earnings before interest, taxation, depreciation and amortisation (“cash EBITDA”) is defined as the Group’s operating (loss) / profit adjusted for depreciation and amortisation charges, any gain or loss on the sale of tangible and intangible assets, share option charges, unrealised foreign exchange differences and exceptional items, with billings replacing recognised revenue.

(5) Constant currency billings excluding Cyberoam.

(6) Estimated, excluding acquisitions and OEM.

(7) $98.1 million of hardware revenue relates to FY16 hardware billings, difference to total FY16 hardware revenue of $100.9 million and FY16 hardware billings of $99.0 million due to release of deferrals from earlier periods and deferral into future periods of certain minor legacy hardware items as well as Email and Web hardware.

(8) Unlevered free cash flow (“uFCF”) is defined as cash EBITDA, less capex, less change in net working capital, less cash taxes.

93

© Copyright 2016. Sophos Group plc. All rights reserved.Sophos Group plc (Company Number: 09608658) is Incorporated in England and Wales, with registered offices at The Pentagon, Abingdon, OX14 3YP, United Kingdom.

Sophos is the registered trademark of the Sophos Group.All other product and company names mentioned are trademarks or registered trademarks of their respective owners.

95

Date post:	09-Feb-2017
Category:	Documents
Upload:	phamdieu
View:	237 times
Download:	3 times

Sophos Group plc Capital Markets Day

Documents