Conferencia de resultados del T3 de 2026 de Check Point Software (CHKP): El crecimiento de las suscripciones compensa la debilidad de los firewalls

Puntos clave

• Check Point Software informó de unos ingresos en el T3 de 2026 de 670 millones de dólares, un 1% menos interanual, debido a que la menor actividad de renovación de dispositivos cortafuegos pesó sobre los ingresos por productos, mantenimiento y servicios.
• Los ingresos por suscripciones aumentaron un 11% hasta los 339 millones de dólares y representaron el 51% de los ingresos totales. La seguridad de correo electrónico, la seguridad de IA y la gestión continua de la exposición a amenazas generaron un crecimiento del ARR de más del 38%.
• La dirección considera que el T3 marcó el punto más bajo en los ingresos, pero señaló que la recuperación avanza de forma más gradual de lo previsto. Se espera que la mejora trimestral comience en el T4.
• El BPA no GAAP fue de 2,49 dólares, mientras que el flujo de caja libre ajustado alcanzó los 258 millones de dólares. Ambas cifras se situaron ligeramente por encima del punto medio de las proyecciones de la empresa.
• Las previsiones de ingresos para el T4 se sitúan entre 720 y 770 millones de dólares, con un punto medio de 745 millones de dólares, lo que, según la dirección, se mantendría estable en términos interanuales.
• Check Point espera que los ingresos por suscripciones vuelvan a acelerarse en la primera mitad de 2027, impulsados por la demanda de productos de IA, correo electrónico y gestión de la exposición, junto con un aumento del precio de los cortafuegos de entre el 12% y el 20%.

Datos financieros clave

Los ingresos por región se distribuyeron en un 46% de EMEA, un 41% de América y un 13% de Asia-Pacífico.

Check Point recompró 2,5 millones de acciones por 325 millones de dólares durante el T3 a un precio medio de 132 dólares por acción. En los últimos 12 meses, recompró 9 millones de acciones por aproximadamente 1.400 millones de dólares.

Rendimiento operativo y del negocio

La debilidad del trimestre se concentró en los productos cortafuegos. La menor actividad de renovación de dispositivos redujo los ingresos por productos y también afectó al mantenimiento, al soporte técnico y a los servicios profesionales. La dirección espera que los ingresos por productos comiencen a mejorar en el T4, aunque varios grandes proyectos de renovación se trasladaron a 2027.

Los productos en crecimiento siguieron siendo el principal contrapeso. La seguridad de correo electrónico, la seguridad de IA y la gestión continua de la exposición a amenazas generaron un crecimiento del ARR superior al 38% y un crecimiento de la facturación calculada por encima del 47%. El ARR de seguridad de correo electrónico superó los 200 millones de dólares durante el trimestre.

Check Point destacó varios grandes contratos con clientes, entre ellos un acuerdo relevante de ocho cifras con una empresa de energía de la lista Fortune 200 que abarca la modernización de redes y la gestión de la exposición. También cerró un contrato de seguridad de IA de siete cifras con un fabricante global de electrónica que cubre a más de 80.000 empleados.

La empresa continúa expandiéndose más allá de la seguridad de red tradicional. Entre los lanzamientos recientes se encuentran su cortafuegos de red impulsado por IA, una plataforma de gestión de la seguridad basada en agentes y un orquestador Maestro Hyperscale de última generación diseñado para centros de datos de IA, operadores de telecomunicaciones, gobiernos y grandes empresas.

La dirección también ve una oportunidad en las infraestructuras de IA soberanas e híbridas. Señaló que el mayor tráfico este-oeste, las cargas de trabajo cifradas y la demanda de ejecutar modelos de forma local podrían respaldar la demanda de seguridad de red en 2027. El cortafuegos como servicio (Firewall-as-a-Service) está destinado a satisfacer a los clientes que prefieren un modelo basado en servicios en lugar de adquirir hardware.

Check Point ha ampliado su equipo comercial de primera línea en decenas de empleados y prevé nuevas incorporaciones en los próximos meses. La dirección afirmó que la reestructuración del modelo de comercialización (go-to-market) implementada a principios de 2026 ya está asentada, pero que la contratación y la integración del personal han llevado más tiempo de lo previsto en un principio.

Previsiones de la dirección

La dirección espera que el crecimiento de las suscripciones en el T4 se desacelere ligeramente debido a que la menor actividad de renovación de cortafuegos reduce las ventas de suscripciones vinculadas. Espera que el crecimiento de las suscripciones se acelere de nuevo en la primera mitad de 2027 y afirmó que los ingresos anuales por suscripciones en 2027 deberían acercarse o superar los 1.500 millones de dólares.

Un aumento de precios de los productos cortafuegos de entre el 12% y el 20% entró en vigor el 4 de octubre. La empresa estimó que capturar todo el incremento podría añadir hasta tres puntos porcentuales al crecimiento de los ingresos totales, aunque históricamente ha materializado algo menos de la mitad de los aumentos de precio anunciados. La suscripción independiente del cortafuegos de red con IA no está incluida en esa estimación.

Riesgos y aspectos a vigilar

• La recuperación está llevando más tiempo del que la dirección esperaba anteriormente, y algunos grandes proyectos de renovación de cortafuegos se han retrasado hasta 2027.
• Los ingresos por productos, mantenimiento y servicios profesionales siguen expuestos a los tiempos de los ciclos de renovación de los dispositivos.
• Los mayores costes de memoria redujeron el margen bruto y podrían generar un obstáculo similar en 2027.
• El tipo de cambio incrementó los gastos operativos en aproximadamente 30 millones de dólares en el acumulado del año en 2026. A los tipos actuales, la dirección estima un impacto negativo adicional en los gastos operativos de hasta 50 millones de dólares en 2027.
• La contratación de personal de ventas, su integración y la mayor inversión en IA incrementarán la base de costes. La dirección señaló que los márgenes de 2027 dependerán en parte del crecimiento de los ingresos y de la cartera de pedidos pendientes al inicio del año.
• Check Point todavía necesita mejorar la adquisición de nuevos clientes y cambiar la percepción del mercado de que es principalmente un proveedor de cortafuegos tradicionales.

Puntos destacados de las preguntas y respuestas con analistas

Recuperación de ingresos y demanda de cortafuegos: La dirección atribuyó la recuperación más lenta principalmente a factores de ejecución y plazos, más que a una menor demanda subyacente. El pipeline cualificado para el T4 sigue siendo más sólido que el del año anterior, pero su dimensión está por debajo de lo que la empresa preveía en agosto debido a que varios grandes proyectos de renovación se trasladaron a 2027.

Sostenibilidad de las suscripciones: La dirección afirmó que un crecimiento de las suscripciones a doble dígito en 2027 es alcanzable. Los principales impulsores son la seguridad de IA, la gestión de la exposición y la seguridad de correo electrónico, junto con la estabilización de los cortafuegos y las ventajas de precios.

Estrategia de precios: La empresa vinculó el aumento de precio de los cortafuegos con los mayores costes de memoria y componentes. La dirección señaló que la reacción de los clientes ha sido de comprensión en general y no espera que el incremento afecte de forma sustancial a la demanda.

Oportunidad en centros de datos de IA: Check Point espera que los centros de datos de IA, la infraestructura soberana y los despliegues de neo-cloud generen una demanda incremental. Algunas oportunidades ya están en fase de desarrollo, y la dirección prevé una contribución de ingresos más significativa en 2027.

Inversión en ventas: La empresa está incorporando ejecutivos de ventas para cuentas estratégicas, especialistas e ingenieros de ventas. La dirección prevé que el equipo comercial ampliado inicie 2027 con una capacidad sustancialmente mayor, aunque el impacto en los gastos de todo el año también será superior.

Asignación de capital: Check Point prevé mantener su ritmo actual de recompra de acciones por el momento. La dirección destacó que sus aproximadamente 4.000 millones de dólares en efectivo y más de 1.000 millones de dólares en flujo de caja libre anual le otorgan flexibilidad tanto para recompras como para adquisiciones.

Transcripción completa de la conferencia de resultados

Transcripción completa de la conferencia de resultados

Comentarios de la dirección

Kip Meintzer

Greetings, and welcome to Check Point Software's 2026 Third Quarter Financial Results Video Conference. I'm Kip Meintzer, Global Head of Investor Relations. Joining me today are Chief Executive Officer, Nadav Zafrir; and our Chief Financial Officer, Roei Golan.

Before we begin, I'd like to remind everyone that this conference is being recorded and will be available for replay on our website at checkpoint.com. [Operator Instructions] During the presentation, Check Point's representatives may make forward-looking statements. Forward-looking statements generally relate to future events or our future financial or operating performance. These statements involve risks and uncertainties that could cause actual results to differ materially from those projected in the forward-looking statements. Any forward-looking statements made speak only as of the date hereof, and Check Point Software undertakes no obligation to update publicly any forward-looking statements.

In our press release, which has been posted on our website, we present GAAP and non-GAAP results along with a reconciliation of such results as well as the reasons for our presentation of non-GAAP information. If you have any questions after the call, please feel free to contact Investor Relations by e-mail at kip@checkpoint.com.

Now I'd like to turn the call over to Nadav.

Nadav Zafrir

Thank you, Kip, and thank you all for joining us today. So let me start with the headline. In July, we said we expected the third quarter to mark the trough in product revenue, and believe it did. Our third quarter results came in within the range we expected. Total revenue was $670 million, pretty much at the midpoint of our projections. At the same time, subscription revenue grew 11% year-over-year, driven by the strong growth in our e-mail, continuous threat exposure management and AI technologies. While non-GAAP EPS and adjusted free cash flow finished above the midpoint of our projections.

The go-to-market changes that we've been talking about in the beginning of the year are now embedded. And we're making progress in sales capacity expansion that we outlined in July. Just as important, several of the leading indicators that we watch closely moved in the right direction during the quarter, including multiple wins of 7 figures or even greater across critical infrastructure and regulated industries. So as I said, we believe Q3 marked the bottom for revenue, and we expect sequential improvement beginning in the fourth quarter.

At the same time, I want to be clear that the pace of recovery is more gradual than we previously anticipated, and you'll see in our fourth quarter outlook. It reflects that a measured recovery. On the product side, we continue to redefine network security for the AI era. In July, we launched our AI network firewall, bringing visibility and control, specifically over AI traffic, directly to the checkpoint by firewalls that our customers already rely on. Our new genetic security management platform can now translate business intent into policy and specifically zero trust policies across both Check Point and multi-vendor environments per our open platform vision.

And just a few days ago, we introduced our next-generation Maestro Hyperscale orchestrator, which is designed to support neo clouds, telcos and governments as well as large enterprise to inspect AI traffic in the data center without compromising security or performance. While the recovery is taking a little bit longer than we initially expected, we believe we have turned the corner. And we expect product revenue to begin improving in the fourth quarter and beyond. I'm also very excited about the continued success of e-mail, [Indiscernible], our exposure management and AI solutions. These solutions extend Check Point well beyond the network security. And as we bring them together, they continue to deliver a strong ARR growth in Q3.

Let me start with the exposure management, which connects directly to how we are redefining network security. As you all know, security teams are now buried in vulnerabilities and the noise level is rising. And so our agentic exposure validation checks eats exposure simulating real attackers in order to enable a preemption approach. In fact, this approach proved itself in the PHP 2 shell vulnerability and provided runtime prevention for our customers. In fact, we've already started to implement this vision signing a significant 8-figure deal with Fortune 200 energy company to deliver solutions through both network modernization and exposure management.

At the same time, Security for AI obviously remains top of mind for the CISOs we work with. And we continue to grow rapidly, including a 7-figure deal with a leading global electronics manufacturer to secure their employee AI usage. In this case, we're talking about over 80,000 employees. In same with our defense -- with our AI defense plane, we're securing not just employees but applications, agents and continue to work alongside OpenAI, anthropic and NVIDIA to enable our customers' AI transformation. Of course, securing AI also means protecting the people who use it, all of us. And that starts in the inbox.

Phishing is now written by AI and attackers can hide instructions in those e-mails that try to hijack the AI assistance and that actually read them. these agents. And we have to be able to stop both before they reach users or the AI workflows. Workforce security anchored by our leadership in e-mail security actually remains a very strong growth engine. We recently crossed the $200 million in ARR in e-mail security. And we believe the market potential continues to be significant. And that's the strength of our portfolio, one company that can secure the network, manages the exposures, protects AI applications and agents and defense the workforce.

At the same time, we are continuing to strengthen our leadership. Earlier this year, Adam Ely joined us to lead the AI pillar. He's now expanded his role to lead business operation as our new Chief Business Officer. As you know, Adam brings first-hand CISO experience and deep relationships across the security community. He will now own company-wide strategy and growth, working across product, go-to-market, corporate development and strategic partnerships to turn customer and market needs into Check Point's platform strategy and execution.

Now I also want to share that we launched a new marketing campaign. It's time AI had a Check Point. We're bringing this message to enterprise decision-makers in major markets with a very simple message. As AI becomes a part of every business, it's time, AI had a Check Point. So to summarize, given the growing demand in our market, our improving execution, we're cautiously optimistic about the path ahead. During our upcoming Capital Markets Day at CPX in Las Vegas on February 10, we intend to share our long-term strategy. I hope you all can make it and join us.

And with that, I'll turn it over to Roei to talk a little bit more about some of the financials. Roei, go ahead.

Roei Golan

Great. Sorry. So thank you, Nadav, and thank you, everyone, for joining the call. As Nadav mentioned, our third quarter results were in line with our guidance. Our total revenues were $670 million at the midpoint of our guidance, representing a 1% decrease year-over-year, mainly due to a lower firewall [Indiscernible] activity as expected in this quarter. Our total subscription revenue remained strong, reaching $339 million, $1 million above the midpoint of our projection with 11% growth [Indiscernible]. Our adjusted free cash flow was $258 million, $8 million above the midpoint of our projections, while our non-GAAP EPS was $2.49 per diluted share, $0.01 above the midpoint of our projection. [Indiscernible] our revenues reached $670 million. And as I indicated, declined by 1%. This was mainly as a result of decline in our product revenues primarily reflecting less refresh project of firewall plants this quarter.

This lower refresh project impacted negatively also our software updates and maintenance revenue and services revenues due to lower tax support and less revenues for professional services. This was offset by another strong quarter of subscription revenues with 11% growth in [Indiscernible]. Based on the pipeline and our internal maxes that we see today, we believe Q3 revenues will present the trough, and we expect to see the beginning of the improvement starting in Q4. We do expect, as Nadav mentioned, the recovery to be more gradual, but we are encouraged by the direction of the internal indicators we're seeing.

Our deferred revenues as of the end of the quarter were $1.992 billion, 6% growth year-over-year. Our calculated billings totaled to $636 million, represents 5% decrease compared to last year. It is important to remind you that Q3 last year benefited by approximately incremental 5 points from deal slippages from Q2 and early [Indiscernible] from Q4 more than the usual, creating a tougher year-over-year comparison. Our remaining performance obligation grew by 5% and reached $2.530 billion.

Turning into subscription revenues. So we continue to see strong performance there with 11% growth year-over-year, driven by strong demand for our growth technology. And subscription revenue today already represent 51% of our total revenues. And this brings me to the key drivers behind that performance. e-mail security, AI security and CTM continue to demonstrate strong momentum with ARR growing by more than 38% year-over-year and calculated billings growing by more than 47% this quarter. It is important to note that our email security ARR passed $200 million this quarter. These technologies are becoming an increasingly important part of our business and remain a key driver of our overall growth.

As for the next quarter, we do expect it to see slightly deacceleration in our subscription revenues due to the headwind from loyal firewall appliance refresh, both in Q3 and in the beginning of Q4, the presorted lower attach firewall subscription, but we do expect the subscription got accelerate back in H1 2027, driven by our price increase that we recently announced between 12% to 20% on our firewall products and also a continued strong demand for the new growth technology of AI, CTM and e-mail, and expect our annual subscription next in 2027 to close to $1.5 billion.

Reviewing the P&L in this quarter. So our revenues of $670 million were composed of 46% of them were revenues that came from EMEA, 41% of them came from America and the remaining 13% came from Asia Pacific. Our gross profit decreased from $602 million to $585 million, representing a gross margin of 87%, the decrease in gross margin was explained due to higher memory costs. Our operating expenses, excluding R&D grants, increased by 12%, while on a constant currency basis, our OpEx increased by 8% and was primarily as a result of -- it was primarily as a result of increase in our workforce and our investment in AI security and the investment in sales and marketing.

Our third quarter results include approximately $25 million of benefit from R&D grants to be received under the Israel incentive program law, reflecting the associated impact and -- reflected in the social depart in our financial results. Our operating expenses, net of R&D grants were $334 million and increased by 4% year-over-year. Our non-GAAP operating income continues to be strong at $251 million or 37.4% operating margin.

Turning into the FX. As we indicated last year and also during the previous quarter, we expect the currency environment to create -- we expected that the currency environment will create a meaningful headwind in our operating expenses in 2026. This has played out largely as we expected with an impact of approximately $30 million year-to-date primarily reflecting the weakening of the U.S. dollar against the Israeli [Indiscernible]. Based on the current exchange that we see today, we expect another -- we expect a greater impact in the fourth quarter and this compared to what we had in Q3. And this is already reflected in the guidance we will provide you for the fourth quarter.

When we are looking in 2027, if the currency environment remains broadly consistent with what we see today, we expect an additional headwind on our operating expenses as our hedging rates in 2027, mainly in the first half of the year are less favorable than those secured for the same period in 2026. At the current exchange rate, we estimate that the incremental impact in our operating expense in 2027 could reach up to $50 million incremental in 2027. Our non-GAAP net income reached $254 million, and our non-GAAP EPS was $2.49, while GAAP net income reached $185 million and GAAP EPS was $1.82. Our number of fully diluted outstanding shares were 101.9 million shares as of the end of the quarter. While we continue to do our buyback, we expect the number of shares for the next quarter to decrease by approximately 2 million shares.

Moving into our cash flow. So our adjusted free cash flow was strong this quarter and reached $258 million in the upper end of the range we provided. Our adjusted free cash flow for the last 12 months reached $1.179 billion. If we're looking on our share repurchases, we've done. So in Q3, we also continued our buyback program and purchased additional 2.5 million shares for $325 million at an average price of $132 per share. In the last 12 months, we purchased a total of 9 million shares for approximately $1.4 billion.

So to summarize our financials this quarter, so we continue to see strong demand for email security, CTM and AI security that driving the subscription revenues -- on the other hand, we did have a decline in our revenues and our product revenues and maintenance revenues because of less firewall appliances, bookings and revenues. We do expect that Q3, from here on, we're going to see improvement on that aspect. And we finished this quarter with another strong adjusted free cash flow above the midpoint of our guidance.

Moving into our guidance for the next quarter and then the updated full year. So the guidance -- the updated -- the guidance for the fourth quarter is the range for the revenues is between $720 million to $770 million, while the midpoint is $745 million representing a flat year-over-year. Our subscription revenues range is between $351 million to $362 million. Our non-GAAP EPS will be -- is expected to be between $2.71 to $2.83, while our GAAP EPS is expected to be $0.70 less while our adjusted free cash flow is expected to be between $260 million and $290 million.

Moving into the annual updated guidance. So this is how it looks. Our total revenues will be between $2.732 billion to $2.782 billion, revenues subscription between $1.345 billion to $1.356 billion. Our non-GAAP EPS between $10.25 to $10.37 while our GAAP EPS is expected to be $2.74 less. And our adjusted free cash flow is expected to be between $1.136 billion to $1.166 billion. This is our guidance for the year, and we can move the questions to the question, Kip.

Kip Meintzer

[Operator Instructions] Today for questions will be John [Indiscernible] from Guggenheim Partners, followed by Joseph Gallo at Jefferies.

Preguntas y respuestas

John DiFucci

Nadav, listen, you say -- and Roei said it's going to take a little longer to shift back to recovery here. Check Point has always been a strong technology company. And this is sort of a high-level question. And it's great that your installed base is really loyal here. But gaining when we talk to people in the field, and we do a lot of that, so does everybody on this call, it really sounds like it's been hard for you guys to capture new customers. How do you -- and by the way, there's this sort of perception of Check Point as a really good technology company, but sort of a legacy technology company.

And I'm just like how do you actually shake that perception? Because usually when we see that happen, and it's really rare in history, it requires massive change, like dramatic change. And I know you're part of that and bringing on was really part of that. But is it enough what you're doing now like hiring these new people like I get it. But is it enough? Like do we just have to be patient this? I'm sorry for the [Indiscernible].

Nadav Zafrir

No, John, you're perfectly legit question. And obviously, this is something that I spend about 23 hours of my day planning and thinking about. I'll say the following. First of all, perception is perception, like you said. I do think it's changing, and I'll tell you why I'm optimistic. I would say 2 things. Number one is what we actually said about the Q3 numbers. If you look at our emerging technologies, right, so e-mail, CTM, AI, these are exceptional technologies that are growing at almost 40% year-over-year across the board, representing a much larger part of our portfolio.

But that's not the only thing. They also allow us to talk to new buyers, new people and new logos. And it's very, very important because they're obviously, in my humble opinion, they really provide better security. So that's one thing.

The second thing is we're no longer a firewall company, and we're no longer a network security company. We are looking at where the attackers are going, and I personally believe after 30 years in this industry, that the current paradigm, we're seeing holes in the current paradigm, and I think it won't be long between -- before many of the things that we were accustomed to will become less and less relevant. And so we have to move from a -- looking at the back mirror -- at the rearview mirror, and we have to start anticipating a tax. This is what we call preemptive security.

And we'll be talking at length about that strategy and that vision and how we're going to implement it in our February checkpoint x event. But I believe that with these emerging technologies that are becoming more and more prevalent and the new vision and as we start to implement the strategy and some of it is already happening with customers, moving from a reactive state of mind to a proactive, preemptive state of mind is where the world needs to go. And that's where I believe checkpoint will create the new perception around it.

John DiFucci

Okay. Okay. So we'll just be patient a little bit more. So we'll turn on. Listen, really, I have a quick follow-up for you. You mentioned and you gave us a little bit of a hint in the maintenance and support line. But in your line, you have that services line and the services was weak. Sequentially, that line was down about 1%. You just look at maintenance and support sequentially, what did that do?

Roei Golan

So it's -- if you're looking today on the decline that we had Q-over-Q, so half of it came from -- actually from professional services, half in terms of dollars and half of it came from the maintenance revenues. So that's the main. And again, that's -- we believe that's the trough also of Q3 in terms of maintenance because that's coming because of the lower refresh that we see -- we did see in Q2 -- and also with the guidance takes in that we see still a decline in the product revenue. So this has -- this is the impact of that we have less refresh and therefore, less professional services.

On the other hand, as I mentioned also on my deck that we did announce price increase for all our firewall products, including support attach support and subscription that will be effective -- not will be -- is effective from October 4, and that would have an impact mostly from Q1 because it's over time. So we'll see it -- we'll see, we do expect that support the maintenance line item will be improved in the next few quarters.

Kip Meintzer

Next up is Joseph Gallo from Jefferies, followed by Patrick Colville from Scotiabank.

Joseph Gallo

I want to follow up a little bit on that last part. I think durability of subscription is extremely important to the story next year. Can subscription grow double digits in '27? I mean, [Indiscernible] want both your takes, but 3Q subs decelerated a point, 4Q is implied another deceleration, current service billings declined and you have pricing and inorganic benefits this year. So just help us think about the durability of subscription next year.

Roei Golan

So just the last comment that actually we didn't have inorganic benefit this year. So it's -- there's no -- everything is organic DCL specifically. And pricing, actually, we did the price increase, which was mainly affected the H1 but less H2 back then in July. So I think definitely, it's doable. I mean we are looking on today on our business. I'll start and Nadav you want to add on that. But when you are looking on our technologies, the CEM, our AI security, which is becoming more and more significant every quarter, and the e-mail security that we mentioned that already crossed the $200 million ARR.

This together are growing very nicely. They're going above 38% in ARR, calculated billings this quarter, 47%, very strong, it's not 1 quarter. We see sustainable growth in these 3 products. And even with the headwind that we have this year specifically in Q2 -- specifically in Q3 and also in Q4 on our subscription that's coming from the lower refresh that we had this year. Even with that, we managed to go double digit. I think that we are starting to see also stabilization on the refresh, and we're going to start to see improvement also on the refresh that will also help have the subscription -- the subscription next year.

And on top of it, the price increase that I just mentioned that the pricing is on the firewall that, of course, we are not going to benefit 100% of it. But historically, we managed to benefit from this price increase. And that's something that all together, we believe that, that dribble and definitely can be -- can grow double digit also next year.

Nadav Zafrir

Yes. To add to that, Joe, the answer is yes. I will add what we've already spoken about, but it merits territory. We made a major change in the beginning of the year. It's taken us a little time to settle things, but it's now embedded. And as we've been -- as we said in July, we're also hiring more people at the front line across the board, strategic accounts, major accounts, specialist sales engineers, increasing our capacity substantially, so that when we go into 2027, we're set to start accelerating. So that's one thing.

The second thing is the market dynamic. The market dynamic is favorable, right? I mean, there's never been a bigger need for a proactive security. And I think what we're offering is extremely relevant. And I think it's on us to -- on the execution part, to have better delivery. But we're confident that we're in the right direction. And the signs that we're seeing are good signs so far. And that's why we confidently say that Q3 was a trough, and then we're going to see some improvement in Q4 and going forward into 2027.

Kip Meintzer

Next up is Patrick Colville followed by Todd Weller of Stevens Bank.

Patrick Edwin Colville

I guess I'm just going to ask a very technical one and a more strategic one. The tactical question is in terms of the price increase that, Roei, you've kind of teased a few times. Would you be able to provide some guardrails around quantifying that? And then for you Nadav, the more strategic questions around firewalls to protect AI data centers. We're going through this gigantic CapEx build-out is going to accelerate next year in terms of the amount of AI compute coming online. Just talk us through the opportunity that the Check Point has against that? And is there stuff in the pipeline? Or would that be incremental from here?

Roei Golan

So I'll start with the question on the price increase. So the full impact, I mean, if we'll manage to benefit 100% of this pricing because it can be up to 3 points equal to 3 points to our growth in total growth of revenues. So that's -- again, if we managed to benefit 100% of this price increase because I can tell you, historically, we managed to benefit slightly less than half of it. But again, we are working very hard with the team with everyone on the firewall aspect, mainly on the renewals that we'll be able to monetize more of it, but that's to quantify that. And Nadav, you can add on.

Nadav Zafrir

Yes. Look, I think it's unprecedented, right? The investment in data centers and specifically AI data centers, whether it's for training or for inference is just mind bottling. And these data centers need security. In fact, that's some of the places where we believe this is going actually to be incremental starting 2027. We're making meaningful investments to make sure that we have the capacity and the security to enable the east-west traffic in some of these data centers, which is unprecedented. And so I think these abilities are going to be a tailwind for us.

And to your question, is it in the pipeline or incremental? I think some of it is already in the pipeline. But as real revenue, we started to see it in 2026 and we hope to see this growing in 2027. By the way, it's not just the infrastructure that's being built, it's also the kind of traffic that moves east, west or north south in these data centers. A lot of it is new kind of traffic. Some of it is -- a lot of it is encrypted. It takes real [Indiscernible] capabilities. Some of it also has to do with data sovereignty and the ability to run different kind of models, not just the traditional generalist models that we all talk about, but also open weight models.

And so it's a brand-new world out there. To the question below about -- before about the legacy part. I know that this is something that we need to deal with and shake it off. But remember that in actuality have the abilities that we've built over 30 years, in many ways, are becoming more relevant, not less. It doesn't mean that we don't have to have a larger portfolio and better integration, better execution, better go-to-market, but the abilities that we have, the engineering capabilities that we have the telemetry that we have from over 100,000 customers, the fact that we are training our own small language foundational model based on the acquisition that we did in Zurich, [Indiscernible] if you remember.

All of these are coming together to make to where we believe there's never been a bigger need for what we can actually do. So this gives us the ability to be cautiously optimistic about 2027.

Kip Meintzer

All right. Next up is Todd Weller, followed by Adam Tindle from Raymond James.

Todd Weller

Nadav, you mentioned kind of leading indicators giving you confidence. Could you expand on what you're seeing there? And then related to that sales forecasting, I'm sure with all the go-to-market changes you've gone through that it's been more challenging over the last few quarters. So maybe talk about how you're feeling about that kind of confidence in the outlook.

Nadav Zafrir

Yes. So on the indicators, it's a few, right? First of all, it's the funnel and the quality of the pipeline. That's number one. Second, as I mentioned in the script that we prepared for you today. It's these large deals that we're winning with some of our new technologies, such as AI and the integration of exposure management to modern network security. These are 7 figure deals, 8-figure deals which are encouraging. And obviously, we need to do a lot more of it and we need to get into new logos much faster, but we're seeing the first indicators of that happening.

Roei, I'll let you add anything if you want to add on the leading indicators, et cetera.

Roei Golan

Well, I think you covered it. I think definitely the funnel that we do see the final -- the qualified finance specifically for the next quarter, I think we feel more confident with the what we see for the current quarter. Of course, like always, Q4 is -- there is a lot of refresh activity and more product revenues. But in the end, we do see the final -- we feel confident with the funnel we see. And I think the other leading indicators, again, we -- it's more for long term, less for the Q4. But definitely, we talked with you 3 months ago about expanding our sales capacity. I think since -- in the last 3 months, we expanded by dozens of new sellers that increased our sales capacity, and we have more of them that already signed will join us in the next few months, we'll be able to start with much higher sales capacity 2027 compared to what we had in the beginning of this year.

Nadav Zafrir

And then to add to that, Todd, to your question about the sales force, I'd say 3 things that we're doing in 2026. Number one is leadership. So getting the right leaders in the right places, so a new leader for America, a new CRO and some other very consequential leadership positions that joined us this year. The second thing is the nature of how we go to market. This is -- now that we are a portfolio, which is much more diverse. And as we're moving into our strategy of preemptive security and bringing together some of these technologies, it also takes some training for our existing people and bringing new people on board.

And finally, it's the underlying, I would say, structure and execution. As you already know, we -- these changes slowed us down in 2026, especially until now. But we think these changes are embedded. And again, are cautiously optimistic that we'll now start harnessing some of the outcomes so that we can go back to growth.

Kip Meintzer

Next up is Adam Tindle from Raymond James, followed by Shrenik Kothari from Baird.

Adam Tindle

Just one [Indiscernible] a follow-up for Nadav, I'll ask them at the same time. I think really I caught in the script that you talked about annual subs over $1.5 billion for 2027. And if so, I was just wondering if you could break apart the drivers of that, whether that's maybe the maintenance portion versus the subs portion, it sounds like there's a pricing contribution to that as well. So just a little bit more granularity on that build, and so it will be important for investors to hang on to.

And Nadav on that pricing point, I just wanted to double-click on the decision and impact expected from price increases. We're in a situation, obviously, hopefully troughing here, but product has been down double digits. It's an accelerating decline. Just a little uncommon to see a company raise price when demand is deteriorating so much. Would love to understand when that was announced and goes into effect, feedback and fear that, that could lead to further deceleration?

Roei Golan

So I'll start with the subscription. We talked about 1 point -- the $1.5 billion subscription revenues in 2027. Again, that's coming from several items. First, sales driven by our product by AI security [Indiscernible] equity and [Indiscernible] that keep growing very nicely and becoming more and more significant to our total business, they are already less today, almost 30% of our total ARR subscription ARR and that's a long growing 40%. On the -- of course, we take into account some benefit from the price increase that we did in Q4. Of course, we didn't take into account 100% benefit. This $1.5 billion if we take into account the trends that usually we got that we've seen historically when we did the price increase.

And second, back to stabilization. I think we already start to see it in Q4 stabilization in terms of -- you asked to about the product revenues to start looking at better and stabilization and back to growth in product revenues. So all of that together put us in a position that we believe that we should be able to cross -- we should cross the $1.5 billion. I'll touch base only on the 1 sentence on the pricing increase because you asked about the let Nadav to -- so I think, of course, it's a very, very good question to asking how come we are increasing pricing when we see this decline in our product revenues.

And then, we are -- when we -- before we decided on increasing the pricing, it was back then and we announced it back then -- in the beginning of September, we increased our pricing. It was not because, again, there are several factors there. One, I think the most important one is the memory cost. The memory cost is inflated. I mean it keep increasing. We paid this year, we said that it's going to impact our margin by approximately 1 point. Next year, probably we're going to have a similar effect. Again, it's too early to say because the memory costs keep changing all the time. So definitely, that's the first thing.

And second, we looked on the market. We're looking at everyone right now hardware, even if it's not security, everyone is increasing now because of the components. Everyone increasing. I mean you've seen our competition, if it's [Indiscernible] I think they both announced in the same time that we announced the price increase. So I think in the market, the customer also understand, I can tell you that base -- I'm talking with our sales leaders. And the customers understand the price increase because of the memory cost. I mean everyone is paying more now because of what's going on with the memories. So that was the thought around it.

And Nadav, you want to add something about it?

Nadav Zafrir

What I would say, Adam, is that we are doing this after carefully analyzing. And so when you say it's accelerating, -- it's -- what we see now in Q3 and some of what we see in Q4 is obviously still a part of the funnel that we created in H1, now we see the improvement. And so we believe that not only we've reached the trough, but that we're reversing sort of the trend in our appliances in our product revenue. This will already improve in Q4 and continue to improve throughout 2027, but also take into consideration that the demand is high, not only for the traditional enterprise data center, but just as we spoke a little bit before, the -- when we look at where the market is going and when we look at where the attacks are coming from, where the dollars are going into infrastructure.

A lot of these technologies that we've built in the last few years are very relevant as we augment them. And augmenting them also means that we're making huge investments. I can tell you that in 2026 alone, the investment in security for AI and in AI for security in order to simplify everything that we deliver to our customers. Because remember, the future is about anticipating that future is about simplifying and the future is about automating. So there's a huge amount of investment that goes there. And we do expect to see some of that coming to fruition in 2027 with new capabilities, new products, like we said, we just announced the new AI firewall, our Agentic management system that is maturing, is becoming much more relevant and much more to come after that.

And so we believe that it's a very reasonable price increase that won't hurt the demand.

Kip Meintzer

All right. Next up is [Indiscernible] followed by Joshua Tilton.

Unknown Analyst

Nadav a related note, with the recovery now taking longer and then you did touch upon it a little bit. But could these extensions and delays and the refreshes, represent a more structural change? Just wanted to understand a little bit about how much of this sort of refresh backlog or expansion is attributable to the budget constraints versus sort of broader architectural decisions for modernization. And since you mentioned about all these AI-centric product [Indiscernible] how much confidence do you have at this requirement, high inspection will ultimately [Indiscernible] moderization.

And just a very quick follow-up on that front, like the introduction of the firewall and a service, can you talk a little bit about that? Does it potentially reduce the upfront capital? Is that a factor and gives customers more flexibility in this modernization [Indiscernible].

Nadav Zafrir

No. So great question, [Indiscernible]. I'll tell you, it's a little bit ironic. But when you think about where network security is going, it's not the same trend that we've seen until about a year ago, especially when you talk about AI focused data centers and infrastructure, some of it is actually becoming a sort of changing the reverse trend that we've seen in the last few years. Again, it goes back to some of the customers around the globe that are focused on data sovereignty. It's the fact that what goes on in these data centers is a little bit different, a lot more east-west traffic, especially when you're doing training for these new models, and we're seeing more and more demand for that.

And so there are different trends that we're seeing. At the same time, obviously, we also need to think about the traditional modernization trajectory that we've seen over -- almost a decade. And that's why firewall as a service for sort of the traditional and it sounds funny that I call it traditional, but it is now the traditional in the AI era. Some of our more traditional enterprise customers would just rather consume their security as a service rather than having the hardware.

But we're seeing 2 trends happening at the same time, right? So I think they'll even off each other. And obviously, we want to take advantage of both trends. And so that's why we're also launching this firewall as a service. But beyond that, I truly see that customers are looking for something more. In a nutshell, it's about don't -- when I speak to [Indiscernible] tomorrow, we're off to unique to have our leaders point where we're going to have dozens and dozens of the leading [Indiscernible] in Europe with us for 3 days.

And I'm sure I'll hear a lot more of that. Something that they're telling us more and more is stop telling me about my problems, fix them for me. You need to -- and you need to do it in an automated way because they're really drowning. Like if you take only the last weekend with the new vulnerability that came out, the PHP to sell, it means that instead of doing their actual work and making sure that they're safe, they need to sort of chase these vulnerabilities around the network, and we have to automate that and we have to do it in a preemptive way.

And I am proud to say that when you look at our customers in the last weekend, they were protected before they needed to do anything. So instead of telling them go and fix that, we told them there was a problem, but we already fixed it. And that's where preemptive security is going.

Kip Meintzer

Next up is Joshua Tilton from Wolfe Research, followed by [Indiscernible] from Truist.

Unknown Analyst

A lot of moving pieces that I'm hearing on the call I'm just trying to understand all of them at once. It sounds like in the beginning you opened up what the quarter was in line with expectations, but you're also trying to give us this message that the recovery that you're expecting is taking a little bit longer than you initially anticipated. So I'm trying to understand what exactly changed if we just had an in-line quarter that the recovery is now taking a little bit longer? And then maybe to put kind of a finer point on [Indiscernible] question, is the recovery taking longer because you guys are just executing at a slower pace than initially anticipated? Or is the recovery taking longer because priorities are changing in real time and maybe the demand for firewall is not as be as you initially thought it would be?

Nadav Zafrir

Well, I'll start with the second question, and Roei, you can take the first. So absolutely the latter. -- we don't -- we actually see demand rising. Now it's on us to be more competitive, to be out there. and to execute better. So to your question, we -- in July, we spoke about hiring a couple of hundred even more new salespeople. The process itself is taking a little bit longer than we wanted it to take. And then you have the onboarding.

But we have hired dozens of new positions. We are continuing to hire dozens of new positions as we speak, and we will continue to do that into Q1 of 2027. So it's the -- from where I sit, it's absolutely the ladder. I think we know what our customers are looking for. I think we have more relevance in terms of the portfolio, and going forward, as we start implementing and making our vision and strategy come to fruition around the connectivity and going into preemptive security, I actually think that it will become easier for us to grow faster.

Roei Golan

And to your question on the recovery that will take longer than what we anticipated. So I'll remind you, when we talked back then in beginning of August, when we announced our earnings, we did say that we do see very strong funnel, qualified funnel for Q4 back then when we announced earnings. When we are looking today, so still, we do see qualified funnel stronger than what we had last year, but the magnitude is slightly lower, again, because of several factors. One, we -- this funnel included a lot of significant large deals, there's several of them being pushed to next year. I can tell you that these are mostly with existing customers that working with us closely.

We're engaging with them. They had a very significant refresh project that was supposed to be this year and was decided to move into next year. They renewed their business with us. Everything is in line by just in terms of doing the refresh, they decided to do so in 2027. So that's how we see, of course, also Q4 is a more back-loaded quarter. So there is a back and loaded quarter which involve a lot of product bookings and revenues. And we took into economy provided you the guidance.

Kip Meintzer

Next up is [Indiscernible].

Junaid Siddiqui

Nadav, you touched about data sovereignty and we're hearing increasing demand around sovereign architectures, particularly where customers want security and AI workloads to remain under their control. How meaningful is that becoming for Check Point across network security and SaaS? And does this shift towards sovereign or hybrid deployments structurally favor your appliance and private cloud footprint?

Nadav Zafrir

I believe so. I think that, again, this is sort of the irony of the situation, some of the -- there's still the trajectory that the traditional trajectory that few years. But AI sovereign around data, independence around using models is shifting and also take into consideration that cost the cost that's attached to using these amazing technology is also becoming a huge factor.

And so I do think that the trend is changing. I do think that network security, modern network security doesn't necessarily mean what it meant a couple of years ago. It also means a sovereign data center. It also means running open weight models locally sometimes because of sovereignty sometimes because of the need to remain independent. And many times for a lot of our customers, it's about the cost that comes with it. And traditionally, that's where we have a lot of strength. And now as we're moving into the preemptive security and bringing exposure management and modern network security together, I think we can prove that they're very, very relevant.

And to add to that, we can do it in the cloud, but we can also implement a lot of this, and we're seeing more and more demand for that, which is kind of again, ironic, but to do these things on-prem for different reasons. Sovereignty is one of them. So I do think this should be a growing a growing demand. And I do think Check Point has a big play to play here in terms of what we already have and what we're building.

Kip Meintzer

Next up, [Indiscernible] followed by Brad Zelnick.

Saket Kalia

I'd love to dig into just some of the moving parts as we think about margins for next year. I'm not looking for guide here, but go with me for a second. Very helpful detail on FX, right? I think incremental $50 million in headwinds from the [Indiscernible] was something that we were all wondering. You'll also presumably have a full year's impact of the sales investments next year as well. So maybe beyond FX. How do you think about the impact of sales investments for next year, whether it's on expenses or margins? And just as importantly, how do we think about maybe the returns that those investments could generate?

Roei Golan

So again, margins wise, in terms of specifically margin we're going to share with you, of course, in February when we're going to announce also, we have -- we're going to have an Analyst Day in Vegas, but we're going to announce our earnings close to this Analyst Day, so we're going to announce also our guidance for next year. But you're right, in terms of the -- I mentioned the FX the FX, the FX has incremental impact. Again, according to the current FX rates, I mean, it's keep changing. Of course, we are hedging, we have a rolling hedge, but still it can be changed, but it's right now around $50 million incremental for next year.

Looking at our margin next year, I can tell you that, again, are going to be -- we're going to be a very high margins in the -- we're going to have high margins. It's very tough to tell you now. It's going to be what margin it will be. It really depends also -- let's be honest on our top line, how we finished Q4, I would say what's going to be the backlog for next year in terms of top line. So it's -- and in the end, the margin is also as a result of the growth in the top line. So all of these factors will take into account when we will share with you the guidance for next year, and we'll talk more about the margins on that aspect in February.

Nadav Zafrir

And just to add to the [Indiscernible] taking consideration that the way we make our investments is also changing. Many of the things that we used to do in one way are now being automated. So we can also shift investments all right? And being a -- one of the things that we want to do is become an AI first company, one, because it's the right thing to do and change the culture and move ahead of the game, but also because we really, really need to using AI to understand the security implications and to understand what it means to have a real AI transformation with security for our customers.

And so the blend is also changing. But you're right. On the sales side, we're going to -- the investments are going to take us to the full year next year, and we have to take that into consideration in our margins.

Kip Meintzer

All right. Next up is Brad Zelnick, followed by our last questioner, which will be Richard Poland from Wells Fargo.

Brad Zelnick

Thanks very much for sneaking me in here, Kip. Following Saket's question about investments and [Indiscernible] comments about having flexibility. You've made nearly $300 million in acquisitions the last few quarters. You're on track to spend what looks like about $75 million or more in R&D versus last year adjusting for tax credits. What's the timing and magnitude of the returns you expect on all this spending? Or maybe asked differently, what kind of growth does Check Point aspire to deliver, and when might we see all this investment get us there? And I have one for Roei as well and follow up.

Nadav Zafrir

One thing that I will say is that we're looking at sustainable and gradual growth. right? The investments that we made this year, for example, we're going to double down on next year. Security for AI is one example of a capability or a product that we believe is almost existential for our customers and hence for us. And it goes into 2 buckets, right? The first one is a product that is security for AI. So for example, the one we spoke about the electronics company, right? So to deploy AI security for over 80,000 employees with the best-in-class security is not easy. It takes a lot of investment, and we expect that to grow as a pillar or a solution in itself.

But at the same time, these capabilities become a part of everything else that we do. And so a lot of these investments are just there to keep up with what the attackers are doing. Again, going back to last weekend's vulnerability around the PHP 2 cell. We -- if we are going to stay in the reactive mode, I think we're going to lose. Remember, at the end of the day, it's a competition between offense and defense. And what we're seeing is a vulnerability, apocalypse, if you like.

The only way to stay ahead of that is to be able to thin the stacks, and proactively, on the one had dramatically lower the probability that it will happen. So when there is a vulnerability, when there's a new attack picture, some of them are almost unimaginable, we already have the mitigation in place. And second is to hold the line to make sure that when the attack does come, we can block it in run time, in real time. And so a lot of these investments are going there. Obviously, the proof is in the pudding, and we are expecting to see some of that putting in 2027 and beyond.

And to your question about acquisitions, it's also a strength, right? The fact that we can continue to make these acquisitions. The fact that we are in the epicenter of the cyber global innovation is sort of an advantage that we need to take advantage that -- we constantly want to leverage.

Brad Zelnick

Definitely makes sense. And maybe related to that, as we think about capital allocation, Roei, with comments for Q3 being the bottom, the stock is at somewhere around the 10% free cash flow yield. How do you and the Board think about leaning in maybe using the $4 billion cash balance and the $1 billion plus in free cash flow that you generate to buy back shares more aggressively?

Roei Golan

So that's something that we are assessing every quarter with the Board. Actually, if we want, again, regarding our buyback, it's something that again, to increase the credit is to keep the same level right now. We -- right now, we are not doing any changes. We are continuing at the same level. Definitely, we have a very strong balance sheet with $4 billion in cash and more than $1 billion in free cash flow. So we have more flexibility, not by -- not only buyback and of course, M&As to do more M&As. But right now, we are continuing with the same levels on buyback. And if we do any change, of course, we're going to announce it. But right now, we are counting with the same levels.

Kip Meintzer

Our last caller, Richard Poland take it away.

Richard Poland

I guess, one, just kind of on the AI firewall capabilities. When we think about how that kind of converts to the subscription line. I think the way we've understood it is that's a bit of an upsell motion. Is that captured in just kind of the 3 points that you alluded to on the pricing side? Or would we consider that as kind of separate? And how do we think about some of the early traction on that side?

Roei Golan

I'll take the first one, and then if you want to talk about the traction. But no, it's not part of the 3 points. Actually, the AI network -- the Firewall is a different package subscription package that it's an absent that we can be sold to our customers. But that's not part of the 3% increase. The 3% increase is the price increase, so that we are talking about specifically for firewall fire subscription packages that we have to do, not related to this AI firewall, which is not part of that.

And that we want to touch based on the [Indiscernible].

Nadav Zafrir

I'll say that there are a few things that we need to do in parallel, right. Number one is -- and we've spoken about this extensively, and that's one of our still biggest challenges is going out to the traditional network security and beyond with our full portfolio and going on offense to start getting a much bigger portion of new logos, right? That's one thing that we're focused on. And that's one of the reasons that we did the rehaul or the change to our sales -- to the way that our sales is structured.

The second thing is more on the product side. And here, to your point, it's -- some of these are relatively new capabilities that are built upon, obviously, a lot of what we already have, but a lot of them are different. So for example, if you think about Neo clouds that are competing with the traditional hyperscalers as an example, they're offering different capabilities. It goes a little bit back to -- sometimes to what we spoke about before about sovereignty and running open weight models, et cetera.

And it also means that you need to run different capabilities. I think in one of our talks, we spoke about the fact that in some cases, it actually means that we need to be a part of the hardware level. So that's some of the collaboration that we're doing with NVIDIA because we're talking about massive amounts of data moving east, west, especially when you're talking about training and different kinds of data that is moving a lot of it is AI related. A lot of it is encrypted. So new capabilities are something that we need to build for network security, but way beyond that. That's what we're focused on.

Kip Meintzer

All right, guys. Thank you very much. it was great. We'll look forward to seeing you all through the quarter. All right. Thank you.

Roei Golan

Thank you.

Nadav Zafrir

Thanks, guys.