Palo Alto Eyes IPO, Distribution As Growth Goes Viral

Back in June 2008, when Lane Bess signed on as CEO of Palo Alto Networks, sales were modest and industry buzz was a whisper.

Bess' conversations with potential channel partners were promising, he remembers, but apart from the early adopters -- who believed in Palo Alto's firewall technology that could manage applications and content by user instead of by IP address or port -- there was nothing to suggest the industry's network security incumbents were sitting up and taking notice.

But fast forward two years, and Palo Alto has hit one major milestone after another, from its first quarter as a cash-flow-positive company to the type of industry notices and word-of-mouth that are building Palo Alto's brand equity and throwing a scare into the space's established players.

In other words, where Bess once spent days poking his head into the sales director's office in an attempt to stay optimistic about sales, he's now wrestling with the big questions of Palo Alto in two-tier distribution, adding more sales staff, and prepping the company for an initial public offering that at this point is pretty much inevitable.

"We had two dozen customers two years ago. Then you had the cold nuclear winter of a down economy, and with that you don't know what the future's going to hold," Bess said in a recent CRN.com interview. "It's not easy. I wouldn't call it a technology in search of a market. But it's a technological innovation -- disruptive -- that the market has a strong need for and in some cases doesn't know it."

After some hiccups early in 2009 -- Palo Alto hired, then let go of, channel veteran Nancy Reynolds in a move that saw many observers questioning its channel momentum -- its channel story is also thumbs-up, and Palo Alto VARs have been steady in their praise of its expanded channel program, which launched in January.

Now comes the question of two-tier distribution. After the March release of the most recent Gartner Magic Quadrant for Enterprise Network Firewalls -- in which Palo Alto was named a "visionary" -- Palo Alto saw more than 7,000 inbound customer leads almost immediately, Bess said.

"When I get to a point where my funnel is filling up and falling on the floor, my thought is, 'Do I need to be touching more VARs?' " Bess said. "It's something we need to consider."

Palo Alto is in talks with many of the "usual suspects" in distribution, Bess confirmed, declining to name names.

"It's almost a self-selecting process," he reasoned. "I didn't want to go out to a distributor because I suspected the smart distribution partners would come to us first. There are a few that haven't called me, but that to me is an indication that they don't get my business or they're so entrenched with one set of incumbents that it wouldn't be worth the energy to spend."

NEXT: Palo Alto's GlobalProtect Debuts

With an IPO on the horizon -- Bess is holding fast to his prior prediction that it will happen in Palo Alto's fiscal 2011, which begins in August -- Palo Alto is also adding to its management ranks. Recent recruits include Michael Lehman, the former two-time chief financial officer of Sun Microsystems and now Palo Alto's CFO.

Palo Alto is further determined not to slow down its pace of product development, Bess said. Earlier this week, the company introduced GlobalProtect, a remote access end-point management product that's similar to a VPN and applies a business' security policies to remote users through a persistent thin client.

The difference between GlobalProtect and most VPNs, according to Chris King, Palo Alto's director of product marketing, is that many VPNs funnel traffic through central gateways, whereas Palo Alto's offering connects automatically to the most convenient, geographically closest Palo Alto firewall available, whether it's located in a hub or a private cloud.

"A lot of the traditional approaches don't work. You've solved the inside problem, but when users leave the office, you're loading up with a bunch of client software that's difficult to manage," King explained. "Proxy management, traditional VPNs and a port-based approach slow things down. When you can redirect all network traffic to the closest gateway, however ... well, let's have that conversation."

GlobalProtect will be available in the fourth quarter of 2010, according to Palo Alto, and at launch will be able to support Windows environments, with Mac versions to follow. It'll be licensed on a per-gateway basis, King said.

For partners, additional channel program improvements are on the way, Bess added. Ultimately, he said, Palo Alto will focus on keeping its best partners close, even with two-tier distribution on the way.

"We want partners to pretty much lead with Palo Alto," Bess said. "Over the last two years, we've had some that led with a certain product and fall back on Palo Alto, and that's not the type of partner we want in our one-tier world. We want to give those partners who lead the lion's share of our attention."