Description

Thesis

F5 is an infrastructure software vendor that benefits from the enterprise transition to the cloud.  In a hybrid-cloud environment, F5 is increasingly relevant as it offers the highest level of performance, security, and customer support across applications that reside on-prem and in private and public clouds.  The average organization today manages more than 200 applications with 85% of companies running applications on multiple clouds, meaning nearly every organization must manage security and performance across multiple environments.  F5 gives customers the ability to enforce consistent policies across networks, which is a unique and valuable feature for customers that are juggling a growing number of applications.  F5’s core ADC market is expected to grow in the mid-single digit range, but the company is bundling additional security features that should lead to high-single digit revenue growth for the company.

By focusing all its attention and investment on application delivery and security, F5 leads the ADC industry with 50% market share. Its products are difficult to replace, especially for sophisticated enterprises in the midst of a hybrid-cloud transition. These products are intertwined into customers’ systems, and it would be costly, timing consuming, and risky to switch providers. This provides the company with a competitive moat, securing its position and relevance in the future of enterprise IT spending.

F5 is a high-quality software business with ~35% operating margins on essentially no net tangible capital, resulting in extraordinary returns and significant free cash flow generation. F5 consistently returns capital to shareholders through share repurchases, reducing its share count by almost 25% over the past 10 years. In addition, it has a healthy balance sheet with no debt and around 10% of its market cap is in cash.

The company has grown EPS at a 15% annualized rate over the past 15 years and I expect around 10% EPS growth going forward.  I believe fair value is at least 45% higher.

Company Background

F5 specializes in Application Delivery Controllers (ADC) that are positioned between servers and end-users to manage application traffic.  ADCs are a key component within data centers to improve availability, security, and performance of applications.  Traditionally, this technology was delivered in a hardware form to large monolithic applications in private data centers. 

As data gets moved to the cloud and network infrastructure evolves to a hybrid model, software solutions are needed, and ADCs are evolving from simple load balancers to data center gatekeepers, providing security, reliability, and performance functionality for applications.  F5 spent the past five years creating software solutions so that its technology is available anywhere, including on-prem, in the cloud, in multi-cloud environments, or at the edge. 

New addressable markets are opening up to F5 as the proliferation of applications and the move to the cloud creates security challenges for customers.  F5 is increasingly offering cybersecurity solutions for applications by targeting several niches within security that pares well with ADCs.  It built this cybersecurity capability through organic investment and acquisitions.  Today, security represents $1bn of revenue for F5, or 40% of total revenue. 

The chart below highlights how the company evolved:

F5 “Secures” and “Delivers” applications.  It secures applications by providing cybersecurity features: WAF (web app firewalls), DDoS (denial of service), and anti-fraud & anti-bot.  “Delivery” means managing traffic flow to servers to ensure high traffic websites/applications are secure, always on, and available to users.

Requirements for applications vary.  As shown in the graphic below, F5 offers a range of products.  F5 dominates the market for customers that are looking for a high level of performance, security, and customer support, but also offers solutions for modern applications with NGINX and Distributed Cloud Services.

F5’s core ADC technology, called BIG-IP, is delivered via hardware or software, and this technology is ubiquitous in legacy application architecture.  It’s used by nearly all Fortune 500 companies and is essential to industries such as retail, financial services, ecommerce, and healthcare that have hundreds of web servers to handle thousands of simultaneous customer requests.  BIG-IP powers the most mission critical applications, customer interfaces, and internally used applications.  I estimate F5 has nearly 70% market share for hardware-based solutions and view this as a proxy for the most mission critical application kept on-prem.

The modernization of applications is an undeniable trend.  This means shifting certain workflows to the cloud or building new applications in the cloud.   For most companies, this creates complexity for managing applications.  According to F5, 95% of its customers are undertaking such modernization projects.  The average organization today manages more than 200 applications with 85% of companies running applications on multiple clouds, meaning nearly every organization must manage security and performance across multiple environments.  In a hybrid cloud environment, having one vendor, like F5, that enables developers to use the same polices across the network is a key value proposition for the customer.

As the cloud proliferated, enterprises envisioned shifting all applications to the cloud. However, in practice, there has been a shift towards a hybrid environment. This is illustrated in the picture below.

Quality

F5 is a high-quality software business with 35% operating margins on essentially no net tangible capital.  75% of total revenues are from software and services.  Hardware sales boast 85% gross margins as F5 effectively deliveries its IP in a commoditized box, using off-the-shelf silicon with Flex as a contract manufacturer.

Competitive Advantage 1: Scale

F5 defends its market position through innovation and superior customer support.  This is illustrated by high level of operating expenses compared to peers shown in the table below:

F5’s consistent investment on application security and delivery makes it the leader in the market.  ADCs are a niche in infrastructure spending, representing only ~5% of total networking spend, and F5 focuses all its attention on this market.  As shown in the charts below, F5 continues to gain share in ADCs.

Competitive Advantage 2: Sticky Customer Relationships

As previously stated, F5’s BIG-IP technology is ubiquitous in legacy application architecture.  Between hybrid cloud ADCs and cybersecurity services, F5’s products are difficult to replace if you are a sophisticated enterprise in the midst of the hybrid cloud transition.  F5’s products are intertwined into customers’ systems, and it would be costly and time consuming to switch providers.  This provides the company a competitive moat, securing its position and relevance in future enterprise IT architecture spending.

In addition, customers are looking to invest in a single set of capabilities and deploy these policies with consistency across all applications, regardless of what environment they are in.  This trend of vendor consolidation benefits F5, which has positioned itself as a cloud-agnostic vendor to help customers navigate the realities of a multi-cloud world.

NGINX serves as top-of-funnel for F5’s traditional products.  NGINX is used to run 400mm websites and >70% of the 10k busiest websites.  A user might start using NGINX’s open-source software, but as needs increase, the customer can adopt other F5 products that improve performance and security.  F5 is bundling these services with NGINX to offer a premium (paid) subscription.  NGINX’s ability to combine a number of functionalities into one platform allows DevOps personnel to consolidate and simplify tools.

F5’s leading application security creates customer loyalty.  According to industry experts, many DDoS offerings are commoditized with 15-20% churn across the industry.  F5’s attrition is only 5% with this product given its superior protection and compatibility.  In addition, WAF retention is 98%. 

Analyzability

Concern #1: EPS growth stalled from 2018 to 2022. 

This was primarily driven by the cloud transition.

Focusing on the topline first. 

Hardware growth started to decline around 2015 as more applications moved to the cloud and hardware represented >90% of F5 product sales in FY16.  As shown in the table below, there is a large divergence between hardware and software growth.  F5 aggressively invested amid this transition.  Today, hardware represents 50% of product sales, and that should decline to 43% by 2025.  I estimate the shift from hardware to software was a ~2% annual drag on revenue growth from 2016 to 2020.

Longer-term, F5’s growth is tied to the growth in application and APIs, particularly for large enterprises since that is the majority of the customer base. At their Strategy & Product Session in February 2024, management painted an encouraging long-term picture, citing a 2023-2028 TAM CAGR of 17%. However, they reiterated 2024 revenue guidance for a flat to low-single-digit decline.

I believe this disconnect is driven by near term headwind that will abate over the next 1-2 years:

1.       The chip shortage in 2021 & 2022 inhibited F5's ability to meet end market demand. This led to a buildup in backlog that was released in 2023, therefore creating difficult comps in 2024. This is a 5-6pt topline headwind in 2024. 

2.       Legacy Silverline customers are transitioning to Distributed Cloud, creating a 1pt headwind on topline growth.

3.       General softness in IT budgets, especially for discretionary modernization projects.   

This has impacted new business spend within the software segment. As a result, software revenue for the year ending September 2023 was flat. But, underneath this, the existing business software (which is recurring) continues to grow 20%+. As IT budgets improve and new business wins strengthen, software growth should start to reflect the underlying demand trends for their products.

As these headwinds subside, F5 should again return to high-single-digit revenue growth.

This revenue transition also impacted capital deployment and margins.  Before the hardware/software transition, F5 reduced its share count by ~5% annually.  But, acquisitions were the priority in recent years to augment the transition from hardware to software/security. Now, the company has shift back towards repurchases.

This transition also led to increases in operating expense.  R&D increased to ~16% of sales vs history of 13%.  G&A increased to 8% from 5.4%.

In addition, supply chain challenges are pressured gross margins.  F5 uses lagging edge chips where the supply constraints have been most acute.  In some cases, F5 had to redesign its hardware with little notice and procure critical chips in the spot market. This has started to reverse and should continue.

Concern #2: Are hardware ADCs going away? Does software cannibalize hardware?

Five years ago, the key criticism of F5 was that it would have trouble adapting as customers moved to the cloud.  The view was that while large F5 customers would likely use its software products, smaller/newer customers would be okay without F5’s more expensive offering.  Now, a few years later, you can look back and see that F5 has successfully navigated these challenges.  Sales have grew ~5% on average from 2019-2023. This year sales dipped (as discussed above), but should rebound to mid-single-digit growth over the medium term. 

One of the reasons that F5 has been successful is because customers have generally moved more towards a hybrid on-prem/cloud environment than had been expected.  In the past, the consensus seemed to be that customers would move all their IT infrastructure to the cloud.  According to an F5 annual survey of 1,000 IT professionals, in 2018 74% of respondents planned to deploy up to half of their applications in a cloud.  In 2023, only 48% say they currently have any applications deployed in the cloud and on average organizations deploy only 15% of their application portfolio in the public cloud.  The considerations limiting public cloud deployments include concerns about data control, security, and cost.  In addition, after years of decline, the percentage of applications hosted in traditional, on-prem data centers grew two percentage points over 2022 levels to 37%.

A hybrid environment is better for F5 because its services can be consistently applied across different data centers.  In other words, they are cloud-agnostic.  This view of a hybrid environment is consistent with what is heard from many different IT infrastructure players.

New modern applications are being built around traditional applications because data still resides in some of these legacy applications.  Moving those applications to the cloud or shifting only certain workloads to the cloud is expensive and often too difficult.  In many ways these new modern applications are still tightly coupled with BIG-IP technology.  Customers do not trade hardware for software, rather, they deploy software in addition to the hardware they already have.   Unlike some other vendors, the transition has not been a “to/from” but an “and.” This is depicted below:

In addition, many of the recent multi-year subscription agreements include both BIG-IP and NGINX as complementary technologies. The fear that existed a few years ago that NGINX would be cannibalizing BIG-IP has not materialized because these are complementary in terms of deployments.

Concern #3: Can public cloud companies offer these solutions?

Yes, but with significant caveats.  Cloud provider offerings are very basic compared to what F5 does.  If an application is born in the cloud and it’s going to remain fairly basic, AWS can offer a solution that is good enough.  The moment the requirements become more complex, then capabilities of a specialist like F5 become important, which is why a large number of applications continue to opt for F5 load balancing and security.

In addition, use of cloud native services means that any application utilizing them, and the data associated with that application, is siloed in that cloud.  This approach creates fragmentation in the network, leading to inefficiencies, inferior performance, and security risks. Also, customers do not want to be locked into a single infrastructure.  Customers facing the reality of multi-cloud architecture are turning F5 to help them simplify by deploying a consistent toolset and security posture across all environments.

F5 has made it easier to consume its solutions on the public cloud, including integration with AWS, Azure and GCP, as well as making it available on those respective CSPs’ marketplaces, and more recently launching Distributed Cloud Services, which enables solutions to be consumed as SaaS.

Concern #4: With security being a larger part of the business, is F5 facing new competitors? 

As applications move to the cloud, requirements for ADCs dramatically change and the lines blur between ADCs and security.  In a complex, hybrid network architecture, data security is a must have and security is now a key catalyst for winning business.  According to F5, application security is the biggest source of security incidents and breaches (shown below):

Application security is a large and rapidly growing market.  The TAM is expected to increase from $12bn in 2020 to $32bn in 2030.

F5 is targeting several niches within security that pares well with ADCs.  Traditional security solutions protect on-prem networks or endpoint devices against cybersecurity or insider threats. Often, these solutions protect “data at rest.” However, with the rise hybrid cloud environments and as the number of internet-connected devices continues to increase at a rapid pace, there is an increasing effort also to protect “data in motion,” which flows outside a traditional network.  Given F5’s focus on network and application traffic, it is in a unique position to protect both data at rest and in motion against threats.

Content Delivery Networks (CDN) such as Akamai or Cloudflare offer similar security features.  These networks were initially created to cache content at the edge of the network, thereby improving end-user experience by reducing latency.  Today, there is an increasing overlap with areas that are historically served by ADCs.  But, these companies compete with F5 at the edge in SaaS, and do not compete on-prem or in virtual appliances in a public cloud.  F5 improved its cloud and edge delivery capabilities through acquisitions of Volterra and Lilac, and recently launch Distributed Cloud Services in February 2022 to play in this rapidly growing part of the market.  F5 wins against these players due to its best-in-class security efficacy by offering “on-prem grade” security and flexibility of consumption models (CDN players are SaaS only) which gives customers the ability to use the same policies across the network.  In addition, CDNs are siloed environments and confinement to a single hardware network creates limitations.  Bottom line, application security is a large and rapidly growing market, and no one solution fits all use cases given complexity and variation of network architectures. 

Today, there are significant cross-selling opportunities as a result of the portfolio expansion into security.  The average organization uses 21 different application security and delivery technologies.  This is untapped potential for F5:

AI Optionality

AI mania resides in the hardware layer today (NVDA, VRT, DELL, MU, etc), but as AI penetrates the software layer, I think F5 can stand out as an AI winner. I am not suggesting that F5 has AI products, or needs to develop an AI platforms, rather, customers will need more of F5's current offerings as they embrace AI. F5's current portfolio (e.g., high capacity load balancing, API management & security) is well positioned to meet many of the needs of enterprises adopting AI. Enterprise adoption of AI will lead to a rapid increase in Apps and APIs and F5 is a key vendor to help manage the complexities of a hybrid cloud environment. F5 is the only solution provider that secures, delivers, and optimizes any app, any API, anywhere.

I believe F5's stock is seeing no benefit from AI enthusiasm given it is trading for <13x NTM with double-digit EPS growth.

Resiliency

Significant cushion to absorb a weaker economy:

-          Zero debt and $800 million of cash.

-          Operating expenses = 52% of sales

In 2020, sales increased 6%.

Valuation

5 Year Forward EPS: $24

Fair Value: $250

P/E at the low end of the 10-year range: currently 12.6x NTM vs range of 9-21x.  Reached 9x in March 2020.

Catalyst

earnings growth and revenue growth