On Thursday, Elastic (NYSE:ESTC) discussed first-quarter financial results during its earnings call. The full transcript is provided below.
This transcript is brought to you by Benzinga APIs. For real-time access to our entire catalog, please visit https://www.benzinga.com/apis/ for a consultation.
The full earnings call is available at https://event.choruscall.com/mediaframe/webcast.html?webcastid=mNNcw2n3
Summary
Elastic reported strong financial results for Q1 fiscal 2027, with total revenue of $478 million, up 15% year-over-year, and sales-led subscription revenue growing 18% to $399 million.
The company highlighted significant customer growth, particularly in those spending over $100k annually, and noted a strong adoption of AI features, with 37% of these customers using Elastic for AI use cases.
Strategic initiatives include investments in AI and security, with new releases such as VectorDB and enhancements in observability through Columnar Mode in Elasticsearch 9.5.
Elastic's security business is growing rapidly, driven by AI-led capabilities in threat detection and response, and the company acquired Deductive AI to enhance its AI SRE capabilities.
Guidance for fiscal 2027 has been raised, with expected total revenue of $1.998 billion to $2.010 billion and a non-GAAP operating margin of approximately 19.4%.
Full Transcript
OPERATOR
Good afternoon and welcome to the Elastic First Quarter Fiscal 2027 Earnings Results Conference Call. All participants will be in listen-only mode. Should you need assistance, please signal a conference specialist by pressing the star key followed by zero. After today's presentation, there will be an opportunity to ask questions. To ask a question, you may press star then one on your telephone keypad. To withdraw your question, please press star then two.
Please note this event is being recorded. I would now like to turn the conference over to Alex Kurtz, Vice President of Investor Relations. Please go ahead.
Alex Kurtz, Vice President of Investor Relations
Good afternoon and thank you for joining us on today's conference call to discuss Elastic's first quarter fiscal 2027 financial results. On the call we have Ash Kulkarni, Chief Executive Officer, and Navam Willyenda, Chief Financial Officer. Following the prepared remarks, we will take questions. Our press release was issued today after the close of the market and is posted on our website. Slides which are supplemental to the call can also be found on Elastic Investor Relations website at ir.elastic.co.
Our discussion will include forward-looking statements which may include predictions, estimates, our expectations regarding the demand for our products and solutions and our future revenue and other information. These forward-looking statements are based on factors currently known to us, speak only as of the date of this call, and are subject to risks and uncertainties that could cause actual results to differ materially. We disclaim any obligation to update or revise these forward-looking statements unless required by law.
Please refer to the risks and uncertainties included in the press release that we issued earlier today, included in the slides posted on the Investor Relations website, and those more fully described in our filings with the Securities and Exchange Commission. We will also discuss certain non-GAAP financial measures. Disclosures regarding non-GAAP measures, including reconciliations with the most comparable GAAP measures, can be found in the press release and the slides.
Unless specifically noted otherwise, all results and comparisons are on a fiscal year-over-year basis. Webcast replay of this call will be available on our company website under the Investor Relations link. Our second quarter fiscal 2027 quiet period begins at the close of business on Friday, October 16, 2026. We'll be hosting a virtual public webinar highlighting our improved metrics capability on September 22nd at 8:00 a.m. Pacific Time which will be made available on our IR website for viewing.
See the Elastic Investor Relations website for more details. With that, I'll turn it over to Ash.
Ash Kulkarni, CEO
Thank you, Alex. Good afternoon, everyone. Thank you for joining us to discuss our first quarter fiscal 2027 results. We are pleased to report a strong start to the year with continued strength in sales execution. We beat across all guided metrics and demonstrated the constant currency growth, acceleration in revenue, and sales-led subscription revenue that we called out last quarter. Q1 total revenue was 478 million, growing 15%. Sales-led subscription revenue grew 18% to 399 million, and we delivered a non-GAAP operating margin of 16.2%.
As we previously noted, we entered fiscal 2027 with a plan to accelerate our sales-led subscription revenue growth on a constant currency basis over the course of the year, and our Q1 results demonstrate that we are off to a good start. Customer demand was strong across all solution areas, especially in search and AI and security. We ended Q1 with more than 1,800 customers spending 100k or more in ACV. This is the highest quarter-over-quarter net additions to this 100k metric that we have ever seen.
Our 21% CRPO growth and 27% RPO growth signal that customers are continuing to make multi-year commitments to our platform. As long-term AI transformations are taking hold, AI is reshaping the stack that developers build upon. The focus is no longer on token maxing; it is on building agentic applications that leverage the reasoning and inferencing power of LLMs on a business's proprietary data. This requires the highest possible retrieval accuracy at the lowest possible cost.
That shift plays directly to Elastic's strengths, and we have invested accordingly in critical areas. First, we have invested in a highly optimized data store and retriever for AI. Our goal is for Elasticsearch to be the best store for all data that our customers care about, enabling text, vector, and hybrid search across structured and unstructured data spanning text, vectors, images, audio, video, and more. We released VectorDB, Index Mode, and auto-calibration this quarter, giving developers a high-quality vector search experience out of the box with no manual tuning required.
One platform with support for every data type AI demands. Second, in precisely accurate context, we continue to be one of the world's most powerful context platforms for AI. This quarter we brought Jina's multimodal and multilingual semantic search capabilities, including first-party embedding and re-ranker models, to on-premises and air-gapped environments. This extends the power of our first-party models to the world's most sensitive regulated and security-conscious deployments.
Our agent builder harness continues to mature as well, enabling developers to build agents directly on top of data in Elasticsearch. Agent Builder now offers advanced agent observability monitoring and enhanced human-in-the-loop approval workflows, giving enterprises the control and visibility they need to deploy AI agents with confidence at scale. Our investments are translating directly into competitive wins. A Global 2000 semiconductor company selected Elasticsearch Serverless in a seven-figure new logo win to power a personalized, AI-driven knowledge search experience for its customers.
Elasticsearch will serve as the context layer, transforming the company's vast product catalog into real-time grounded AI context. When a customer queries a chip specification, compatibility requirement, or part number, Agent Builder returns an accurate answer with per-user document-level security, ensuring each customer sees only what's relevant to them. In a competitive RFP against pure-play vector databases and other platform players, our hybrid semantic retriever and natively integrated agentic capabilities were the decisive differentiator.
AI is also changing the arena of observability. As organizations build and deploy more agents, it requires more scalable monitoring of the entire application stack at a lower cost, and the speed and scale of AI deployments is requiring more automation for SRE teams to streamline the process of detecting, investigating, and remediating issues. We are pushing the frontier in these areas through targeted investments. This quarter we relaunched our metrics offering.
We released Columnar Mode in Elasticsearch 9.5, now in Technical Preview. Columnar Mode is an entirely new index mode purpose-built for time series data. It delivers extremely efficient compression for storage and querying of time series in a columnar data structure, pushing storage costs down 20% to approximately 3 bytes per metric sample while still using the same ESQL query language. With these innovations, we are now an optimized engine for multiple types of data, including documents, vectors, logs, metrics, and more.
Columnar Mode makes the Elastic platform a highly competitive solution for metrics and infrastructure monitoring, an area where we historically have not had a major presence. Additionally, we now support native Prometheus ingestion with PromQL support, simplifying the migration from Prometheus into Elastic. No new tooling or retraining is needed. We are giving teams full visibility across metrics, logs, and traces in one unified platform, all at a very compelling price compared to incumbent competitors.
We also acquired Deductive AI, a leader in the emerging space of AI SRE. Deductive has built a reinforcement learning (RL) harness that automates the task of complex investigations. It pairs upstream data like code repositories and Elastic alerts with downstream signals from Slack, PagerDuty, and ServiceNow to dynamically construct the decision trees as it learns from past and ongoing investigations. It then uses these to drive automated investigations for new incidents based on past learnings.
This allows SRE teams to significantly reduce the time to investigate and remediate problems to achieve the goal of an AI-led SRE organization. By integrating Deductive's reasoning capabilities into our observability platform, we are building a true agentic SRE, one that can autonomously detect, investigate, and guide remediation across the full signal stack. This quarter Gartner recognized Elastic as a Leader for the third consecutive year in the Gartner Magic Quadrant for Observability Platforms, reflecting the strength of where we already stand.
Illustrating the power of this unified platform approach, a leading global insurance company added Elastic Observability to its existing security deployment in a seven-figure expansion win. The customer had been running a fragmented environment with application logs in Elastic and metrics and traces in another incumbent solution, preventing effective root cause analysis across tens of thousands of annual incidents, half attributable to application issues.
The deciding factor was Elastic's newly released native Prometheus ingestion and PromQL support, which met their heavily metrics-driven environment where it was and, combined with our migration tooling, enabled full consolidation onto a single OpenTelemetry-first platform without any costly rip and replace. Looking ahead, the ability to apply Elastic AI agents across all signal types to intelligently identify root cause was a key driver of the expansion.
In a post methos world, organizations are facing an increasingly challenging landscape where vulnerabilities are being discovered at an alarming rate and weaponized at machine speed. This requires cyber defenders to detect, investigate, and mitigate at speeds well beyond human capacity alone. To bridge this gap, AI-driven automation has become an absolute necessity for cyber defenders. Accordingly, we have invested in several areas to help our customers achieve their end goal of an AI-driven SOC.
Attack Discovery reached a new milestone this quarter. It now investigates and validates threats autonomously, allowing SOC teams to move at machine speed. Attack Discovery turns a wall of alerts into a prioritized list of real attacks and moving security teams closer to Alert Zero. Alert Zero is the SOC's version of Inbox Zero, a queue worked down to the attacks that actually matter, with agents and analysts operating together. This quarter we were named a Leader in the IDC MarketScape for Worldwide SIEM and a Strong Performer in the Forrester Wave for extended detection and response.
Forrester specifically recognized that Elastic's strategy envisions an open agentic SOC that will automate operations. Elastic XDR integrates seamlessly with our SIEM and Attack Discovery capabilities, enabling protection and remediation on affected systems to counter AI-scale threats, and on endpoint protection, Elastic Security is the only vendor to achieve 14 consecutive months of 100% detection rates in AV-Comparatives independent testing. Our strength in security is also allowing us to rapidly grow our footprint in the U.S. public sector through the CISA SIEM-as-a-service offering. This relationship continues to serve as a powerful channel across the U.S. Government, opening new opportunities. A large U.S. public sector agency chose Elastic Security and Observability to begin unifying its fragmented data estate onto a single platform, replacing disparate SIEM data. Elastic's newly achieved FedRAMP High authorization unlocked the opportunity, and our ability to monitor both on-premises and multi-cloud environments from one managed deployment made us the strongest candidate.
Where the agency's previous vendor had stalled on innovation, Elastic's pace of development and LLM-agnostic AI integration gave them a clear path forward for modern threat detection and response. Our efficiency and AI features were key drivers of this win. What is exciting about this customer is that we were able to migrate their very complex data platform from their incumbent solution onto Elastic in under one month, taking advantage of all of the automated migration tooling that we have built for this purpose.
We see the same momentum in the private sector. A global semiconductor manufacturer chose Elastic Security Serverless as its security analytics platform to protect against insider threat and secure its intellectual property. Using our AI capabilities, the customer intends to move hundreds of dashboards from an encumbered solution into Elastic to leverage our natural language search and analytics capabilities. Now, moving away from manual workflows, the customer is adopting our agent capabilities across their full data estate.
Where competitors offered AI as an add-on, Elastic's fully integrated platform gave the customer exactly what they needed: one product built for the age of AI. All of these innovations combined with the consistent sales execution are driving rapid growth in AI usage within our customer base. Over 37% of our 100,000-plus ACV customers are now using Elastic for AI, up from approximately 21% a year ago. That is more than 670 high-value customers now using Elastic for AI use cases, with 70 net additions quarter over quarter in Q1.
Our ability to deliver all of this with an open platform across both cloud and self-managed deployments is proving to be an enduring advantage as AI adoption grows across AI natives, enterprises, regulated industries, and government agencies around the world. This includes our support for both proprietary models and open models like GLM from ZAI, our adherence to standards like OpenTelemetry, our ability to support sovereign deployments through our self-managed offering, and our partnerships with Nvidia and Dell around their AI Factory and with Google Distributed Cloud.
We entered this fiscal year with seven successive quarters of strong sales execution and continuing momentum for our platform. Our pace of growth in search and AI and security has continued, and with our most recent innovations in the areas of metrics and AI SRE, we are excited about the prospects of our observability business. As AI adoption grows across the enterprise, we expect to continue driving acceleration of our business toward our midterm revenue and profitability targets.
I also want to take a moment to recognize a board transition. I want to thank Karen Moroney, who will be stepping off our board after a long tenure. We are grateful for her partnership, and she will continue to be a friend to Elastic. I am pleased to announce that Julia Liuson has been nominated to join our board. Julia has seen Elastic grow as a leader in the areas of search, AI, observability, and security in her prior role as President of Developer Tools at Microsoft.
She brings a unique perspective around AI and at-scale infrastructure development that will be invaluable as we continue to execute on our strategy. I want to thank our customers and partners for their trust, our shareholders for their continued partnership, and our employees for their focus and execution. With that, I will turn the call over to Navam.
Janesh Moorjani, Chief Operating Officer and Chief Financial Officer
Thank you, Ash. On our last earnings call in May, we expressed confidence that our commitments we secured in fiscal '26 combined with our continued sales execution would drive revenue acceleration over the course of fiscal '27 on a constant currency basis. While it's still early in the fiscal year, our Q1 results put us on track to achieve this goal. Our total revenue in the first quarter was $478 million. We grew approximately 15% as reported and on a constant currency basis.
On a constant currency basis, Q1 growth accelerated quarter over quarter, up from 14% in Q4. Sales-led subscription revenue in the first quarter was $399 million. We grew 18% as reported and 17% on a constant currency basis. Similar to total revenue, sales-led subscription revenue accelerated quarter over quarter in constant currency, up from 16% in Q4. Our CRPO in the first quarter was $1.2 billion, representing 21% growth as reported and 20% on a constant currency basis.
Our constant currency CRPO growth sustained 20% growth for the second consecutive quarter. Our RPO for the first quarter was $1.9 billion, representing 27% growth both as reported and on a constant currency basis. As Ash mentioned, the continued strength in RPO reflects customers deepening their long-term commitments to Elastic as a core part of their AI infrastructure. Our Q1 revenue acceleration on a constant currency basis both for total and for sales-led subscription revenue, as well as our second straight quarter of 20% constant currency CRPO growth, provides validation for our acceleration trajectory.
Three core dynamics are powering our fiscal '27 sales-led subscription revenue growth. First, our strategic investments in sales capacity over the past year are driving the pipeline improvements we expected. Building on seven quarters of go-to-market improvement, we continued to see year-over-year gains in both ramp sales headcount and productivity this quarter. Additionally, the strength in our second quarter pipeline and buildup of out-quarter pipeline reinforce our confidence in securing new and expanded commitments as well as achieving our planned renewals.
Second, as we discussed last quarter, a portion of our fiscal '27 revenue is made up of commitments from fiscal '26 now being consumed and converted into revenue. We are pleased with the healthy consumption activity we saw this quarter. The net expansion rate, or NER, remains strong, though it moved from 112% to 111% this quarter. As a reminder, our NER is a four-quarter trailing metric impacted by historical growth. The NER we reported in Q1 reflects the lower constant currency growth rate in the trailing four quarters as compared to the four quarters preceding it.
We expect NER to improve within four quarters as constant currency revenue acceleration builds through fiscal '27. Third, we saw continued improvements in our new and expansion commitments as seen in our greater-than-$100K customer count, a segment now contributing 90% of sales-led subscription revenue, up from 87% a year ago. This quarter we added more than 80 net new customers to this tier, our largest increase to date. This reflects the effectiveness of our sales team in both winning new logos and expanding within our existing base.
Now turning to Q1 margins and profitability, I will discuss all measures on a non-GAAP basis. We delivered subscription gross margins of 81%, total gross margins of 77%, and an operating margin of 16.2%, exceeding our guidance from last quarter. The improvement in margins reflects the operating leverage in our model as revenue scales. We achieved an adjusted free cash flow margin of 30% despite one-time charges related to organizational changes we announced in June.
These amounted to $13 million of cash paid for restructuring and other charges. As a reminder, adjusted free cash flow fluctuates quarter to quarter due to booking seasonality and we manage free cash flow on a full-year basis. During the first quarter, we returned approximately $40 million to shareholders, representing purchases of approximately 800,000 shares. Since the $500 million share repurchase program launched in October 2025, we used $380 million and repurchased 5.2 million shares cumulatively as of the end of last quarter.
Now turning to our outlook for the second quarter and for fiscal '27. Building from the momentum we experienced in Q1, we're raising our previous guidance for the full year. For the second quarter of fiscal '27, we expect total revenue in the range of $486 million to $487 million, representing 14.9% growth at the midpoint, or 15% constant currency growth at the midpoint. We expect sales-led subscription revenue in the range of $407.5 million to $408.5 million, representing 16.9% growth at the midpoint, or 17.1% constant currency growth at the midpoint.
We expect non-GAAP operating margin for the second quarter to be approximately 19%. We expect non-GAAP diluted earnings per share in the range of $0.80 to $0.82, using between 108 million and 109 million diluted weighted average ordinary shares outstanding. For fiscal '27, given our strong Q1 results, we are raising our outlook for the year. We expect total revenue in the range of $1.998 billion to $2.010 billion, representing approximately 15.2% growth at the midpoint, or 15.3% constant currency growth at the midpoint.
We expect sales-led subscription revenue in the range of $1.682 billion to $1.694 billion, representing 17.4% growth at the midpoint, or 17.5% constant currency growth at the midpoint. We expect non-GAAP operating margin to be approximately 19.4%. We expect non-GAAP diluted earnings per share in the range of $3.29 to $3.37, using between 108.5 million and 109.5 million diluted weighted average ordinary shares outstanding. We continue to expect our fiscal 2027 adjusted free cash flow margin to be 21.5%.
We are growing revenue efficiently while maintaining disciplined investments and are making progress towards the Rule of 40. Before I close, a few more financial items worth highlighting related to this year. We incurred approximately $20 million of restructuring-related charges during the first quarter, and we expect to incur an additional $2 million to $5 million of restructuring charges for the remainder of the fiscal year. We expect our GAAP operating margin to be positive in the second quarter and for the full year.
We also expect to maintain GAAP operating margin profitability going forward. And last, as we said last quarter, we expect total revenue and sales-led subscription revenue growth to accelerate in the second half, with Q4 having the highest year-over-year growth for the year. To summarize, we are executing well across our fiscal year priorities and are firmly on track to meet our medium-term financial targets of both accelerating our sales-led subscription revenue growth to 20% plus and improving our Rule of 40 as measured as a sum of revenue growth and adjusted free cash flow.
The sustained progress we see in CRPO, sales productivity, pipeline, and operating leverage reinforce our confidence in our revenue growth and margin expansion plans. Elastic continues to be the essential platform for enterprises looking to derive value from their data, and we look forward to the opportunities ahead. Thank you for your continued support and for joining us today. With that, I'll open it up for Q&A.
OPERATOR
We will now begin the question and answer session. To ask a question, you may press star then one on your telephone keypad. If you are using a speakerphone, please pick up your handset before pressing the keys. To withdraw your question, please press star then two. Our first question today comes from Matt Hedberg with RBC Capital Markets. Please go ahead.
Matt Hedberg, Analyst at RBC Capital Markets
Great. Thanks for taking my question, guys. First of all, congrats on the quarter. The acceleration, especially after Q4, was impressive. You know, Ash, there's a lot of things that stood out to me. The strength in 100K customers—I think you said the largest sequential add you've ever seen—was impressive. And I guess you talked about a lot of things on the call about execution and product traction and just better sales capacity. But I'm wondering if you can put a finer point on success there.
Why now? And just kind of the sustainability of that large customer growth would be great.
Ash Kulkarni, CEO
Matt, thank you very much for the question. And like you said, it was a great quarter in terms of the net adds. We added 80 customers to that cohort, the highest ever number of additions that we've had. You know, fundamentally the way I think about it is that our new and expand motion, especially in our enterprise and mid-market high-propensity customers, is working really well. If you remember, about two years ago, a little over two years ago, we made a change to the way we did segmentation within the organization, within the sales organization.
And since then you have seen us continue to improve in this area. And what you're seeing is customers are making bigger commitments, customers are making longer-term commitments, and that's resulting in this cohort really growing very nicely. By the way, this 100K cohort now represents 90% of our sales-led subscription revenue. So it just gives you a sense both of how important this cohort is, but also how well they are doing. And the thing that excites me the most is the AI penetration in this cohort.
So 37% of this 100K cohort is now using our AI features. That number was about 21% in the past. And like we explained even at our financial analyst day, the more this high-value customer cohort uses our AI capabilities, the more they use more and more solutions within our platform. That really becomes the enduring growth driver for us. So very excited about it, and it just shows that the go-to-market motion is working and the platform strength and differentiation is holding very well.
Matt Hedberg, Analyst at RBC Capital Markets
If I could, as a follow-up, the 37% of those customers using it was another thing that stood out to me. Is there any way to think about, you know, what that means from an NRR perspective? You know, I'd have to imagine it's obviously additive and maybe it's part of the NRR re-acceleration. But just any way to think about what that means from, like, a customer ACV or NRR perspective.
Ash Kulkarni, CEO
Thanks for that question. So NRR is obviously a strong metric across the board for all our 100K customers. But when you think about the cohort of customers that are using AI, the dynamics that we talked about during the financial analyst day still stand, which is they have a higher growth propensity compared to customers not using AI. So that dynamic exists today among that AI cohort group the same way it existed when we talked about it in the financial analyst day.
Thanks, Matt.
Alex Kurtz, Vice President of Investor Relations
Next question, please.
OPERATOR
The next question comes from Tyler Radke with Citi. Please go ahead.
Tyler Radke, Analyst at Citi
Can you guys hear me?
Alex Kurtz, Vice President of Investor Relations
Okay, we can now.
Tyler Radke, Analyst at Citi
Sorry about that, was on mute there. Can you just talk a little bit—obviously really strong cloud performance, and I know you alluded to the strength in the cloud bookings last quarter—but any one-off dynamics we should be mindful of? And can you just comment on sort of the bookings mix this quarter, how that cloud sort of looked relative to historicals, and just any color on how we should be thinking about the growth of cloud from here.
Janesh Moorjani, Chief Operating Officer and Chief Financial Officer
Yeah, thanks, Tyler. It's Janesh here. So look, we're very pleased with the way cloud has been performing in the quarter, both in terms of the commitment volume and also, more importantly, the consumption against the annual commitments we have, the aggregate annual commitments we have. And as a reminder, cloud's not a guided metric and there's always going to be quarter-over-quarter variability because it's consumption. But our annual cloud growth improved to 27% this quarter, up from 26% last quarter.
On the monthly cloud side, that number, we expected it to remain flat and it remained roughly flat for the quarter. So the dynamics are roughly the same in terms of the growth on the sales-led cloud side and the SMB, smaller customers remaining flat. At the end of the day though, we win because we have flexibility in our deployment model, and we meet the customers where they are and where they want to deploy our software, and we are one of the very few players that can actually do that.
And that's the reason we continue to focus on sales-led subscription revenue. In terms of bookings dynamics, we expect to, like I said, meet customers where they are. There isn't much to call out this quarter in terms of one-offs. We talked about the mix in Q4 being a good cloud quarter. Q1 remained a solid quarter with no unusual activity one way or the other.
Ash Kulkarni, CEO
And by the way, Tyler, just to put a finer point on what Janesh said, the fact that we can deliver all the capabilities that we provide through the platform, whether it's for AI, whether it's for security, whether it's for observability, in environments ranging from commercial cloud to people running it in their own data centers to air-gapped environments—you know, we mentioned last quarter that Google Distributed Cloud has OEMed our capability as well.
So that flexibility, that range, is a significant, enduring moat. Because if you think about the markets that we play in, there are very few vendors that have that ability to deliver across all of those form factors. And that is a big advantage for us. And that's the reason why, as Janesh said, sales-led subscription revenue is a very important metric. And by the way, cloud, self-managed—all of those are things that we look at and we are very happy about the performance overall.
Tyler Radke, Analyst at Citi
Great. And Ash, maybe just a follow-up for you. Obviously some pretty remarkable events going on in security as it relates to some of the new attack vectors and agents going rogue. Can you just talk to us about the Elastic Security business? How do you see it participating in some of these new agentic security fronts?
Ash Kulkarni, CEO
Yeah, our security business is something that we are very, very excited about. Even in my prepared remarks, Tyler, I talked about several customers that are using us in security. I talked about the semiconductor company, I talked about the very large government agency. We've talked to you in the past about CISA SIEM as a service. I just mentioned Google Distributed Cloud. All of these are already driving our SIEM business and our XDR business. And what's great about this is we are able to help our customers because it's never been harder to be a CISO.
Vulnerabilities are being discovered faster. Threats are being activated faster. So working at human speed is just not sufficient. You have to figure out how to use AI on the defender side to be able to detect, investigate, and remediate at machine speed. And you know how early we invested in the AI-led capabilities like Attack Discovery and so on, and the maturity, the continuous innovation that we are driving there. We are already seeing all of this turn into strong commitments and you're seeing now the consumption against those commitments.
So I expect the momentum to continue for us in security. Thanks, Tyler.
OPERATOR
Next question please. The next question is from Miller Jump with Truist Securities. Please go ahead.
Miller Jump, Analyst at Truist Securities
Hey, great. Thank you for taking my question and congrats on the strong results here. You mentioned customers choosing you for flexibility and highlighted some of the enhancements to GenAI on-prem capabilities this quarter. I'm wondering if you can give any more color on how you're seeing the distribution of customer AI deployments developing, specifically across cloud, on-prem, and hybrid, and if there's any difference versus your other use cases.
Ash Kulkarni, CEO
Yeah, so what we are seeing is that the majority of customer deployments tend to be first and foremost in cloud. That's where they typically start because that's the fastest way for customers to get started. But enterprise customers and government agencies—and when I say enterprise customers, I'm specifically referring to customers in regulated industries, whether it's banking, whether it's telco, especially in international markets for us outside of the Americas—what we are seeing there is a greater desire to not just have data sovereignty, but also to have operational sovereignty.
And in those environments they want solutions where they can run these capabilities within their own enclaves, within their own control. And again, that's where we have such a great strength because there aren't too many companies that are able to provide that kind of functionality. In the past, our GenAI models—you had availability of those commercial GenAI models through our inference service, which was cloud-only. But there was no way, if you're an air-gapped customer or a customer running things within your own enclave, to take advantage of the GenAI models.
We didn't have a pricing model in place for the commercial capabilities there. So that's what we launched, and there's a lot of interest. We launched it because we are seeing a lot of interest. So going forward, what I would expect is AI deployments are going to be based on factors like the criticality of the data, the sensitivity of the data, the kind of customer, and their geolocation. So those will be bigger factors. But you're going to see AI adoption both in cloud and in self-managed.
Miller Jump, Analyst at Truist Securities
Really exciting. If I could just squeeze in a follow-up for Janesh. You all highlighted the strength in the CISA deal, but just given that we're coming up on the anniversary, I'm wondering if you can give any more color on how the Fed vertical is being treated in the Q2 guide and if there's any headwinds or tailwinds we should consider this year.
Janesh Moorjani, Chief Operating Officer and Chief Financial Officer
Nothing specific at this point in terms of guidance for the Fed vertical, Miller. The global public sector remains an important sector for us. When we think about our guidance, we obviously look at a prudent, risk-adjusted view as to the forward numbers. Very pleased with how the CISA contract is performing and the continued activity there. So we expect that to continue to gain momentum as more agencies come on board. But nothing specific to call out in terms of a big tailwind coming in or a big headwind coming in from the federal segment.
Miller Jump, Analyst at Truist Securities
Awesome, thank you.
Janesh Moorjani, Chief Operating Officer and Chief Financial Officer
Thanks, Miller.
OPERATOR
Next question please. The next question is from Brian Essex with J.P. Morgan. Please go ahead.
Brian Essex, Analyst at J.P. Morgan
Good afternoon. Thank you for taking the question, and congrats from me as well on the results. It's great to see that acceleration. Maybe, Ash, for me, I'd love to get your view on how you see your customers deploying AI—coding around AI—specifically around leveraging your platform to build their own harness and context windows to get more control around the ability to protect that context, IP, and proprietary data, as opposed to using OEM harnesses and coding platforms, and how you're positioned for—or your view on how that portion of the market's going to evolve over the next few years.
Ash Kulkarni, CEO
Yeah, thanks for the question. And the first thing to appreciate is, at the end of the day, when you're building any kind of agentic solution, the most important element in that is always going to be the large language model—the model that does reasoning, that does inferencing, so on and so forth. But that model, unless the agent that you're trying to build only depends on external data—only depends on publicly available information—is going to need to somehow be coupled with your proprietary information.
Now, if you think about any enterprise, you think about any large agency, the biggest challenge is now you're talking about many, many petabytes, if not exabytes, of information—information that's constantly being created, information that's constantly changing. And so this really ends up being a situation where you have to bring the model to the data. The data is just too much to take to the model. And more importantly, that data is your secret sauce.
So you never want to have it completely exit your organization anyway. And so that's really why, as you think about what people are building with harnesses and so on, the most important element in that is the data retrieval or the context layer. And when you are trying to get that context for your LLM, for your agent, you have to worry about accuracy, you have to worry about speed, and you have to worry about cost. And what that means is you really want to try and pre-compute as much of that context ahead of time as possible, so your model isn't just constantly trying to sift through all of the data every single time, which is a very expensive, very inefficient, very slow approach. And that's what we do. That's where we fit in. That's the reason why customers turn to us—because we're able to make their agents perform better, we're able to make their agents more secure in how they operate, we're able to provide just the right context to their agents, and we are able to reduce cost and give them that balance of both using proprietary models where it makes sense, using open models where that's the best approach.
So that flexibility, that deployment choice—all of this is how people are using us today. And that's why we believe that this is something that's an enduring motion for us; it's an enduring area for us to grow on.
Brian Essex, Analyst at J.P. Morgan
Maybe—that's super helpful color—and maybe just for a follow-up, security as a percentage of total revenue, and in a post-Mythos world, how do we think about contribution from that business relative to the rest of the Elastic platform? Thank you.
Janesh Moorjani, Chief Operating Officer and Chief Financial Officer
As a percentage of revenue, we don't disclose that, Brian. But in terms of growth, security remains a very strong growth vector for us, and we've highlighted this in the past earnings call as well as the contracts and the customers that we have on the security side. So very pleased with how that's performing, and it remains a high-performing, high-growth segment for us even this quarter.
Ash Kulkarni, CEO
I might just add to what Janesh said. Security grew incredibly well. The order roughly was security, AI/search, and then observability. And with observability, with what we're doing around metrics—you know, the Deductive acquisition—that's the third pillar of the stool, if you will. That's what gives us a lot of optimism in the future. So really, we feel really good about the way our platform story is evolving here.
OPERATOR
All right, thanks, Brian. Next question, please. Thank you. The next question is from Rob Owens with Piper Sandler. Please go ahead.
Rob Owens, Analyst at Piper Sandler
Thanks for the question, Alex. And good afternoon, everybody. In your prepared remarks early on, you talked about success in the quarter—you talked about search and AI and security. And I know you've got new capabilities in observability, Ash, and you just mentioned some of them, but maybe you can drill down relative to the metrics opportunities, some of the new pricing dynamics that you offer, and just what customer feedback or acceptance has been at this point.
Ash Kulkarni, CEO
Yeah, thanks for the question. And you know, Rob, the way we have built our observability business over the years is starting with logs. As you know, log analytics was where we started because the messier the logs, you know, the more capable our solution has been in giving you the ability to do full‑text search through those logs, to do analytics on those logs. And so our strength in log analytics continues. It's been a huge area for us, and over the years, we've continually made our platform more efficient for log analytics, which is another reason why we continue to do well in that area.
But sort of expanding from there has been an area where, as we looked at the market, what we realized was metrics, because of AI and what's been going on in terms of people building these agents, that's an area where we didn't have that same kind of strength. We didn't have that same kind of performance. And so about a year and a half ago or so, we started working on a completely novel backend to Elasticsearch that allowed us to have not just the regular document store model that we had in Elasticsearch, but also a columnar store backend, and all accessible through the same API, because again, we want to make it easy for people to adopt this columnar backend. And this columnar backend has been really tuned for basically all kinds of time‑series data, so metrics and even simple logs. And this columnar approach makes it possible for us to store the data in a much more efficient way. So the storage efficiency is massively higher, the ingest performance is better, the query performance is better. So we get a ton of benefits and it's going to show up most in metrics. And you know, in the past it used to take us double‑digit bytes to store metrics.
We are now able to store a single metric in around 3 bytes, which is a huge difference. And now we are incredibly competitive in the market. This is going to allow us to really take on this area head on. And we are early, like I have to say. But the early feedback that we've gotten from customers, because we are going to our existing log analytics customers and upselling there, has been very good. So we are excited about the feedback that we are getting.
But the way I see it is if we do this right over the next year, multiple years, this is going to be a pretty significant and meaningful area of growth for us.
Rob Owens, Analyst at Piper Sandler
Great. And speaking of early, you mentioned a number of autonomous innovations this quarter across both security and observability. So curious, just early feedback from customers. Obviously the security landscape is changing rapidly. So for those on the bleeding edge, how are they consuming? What does overall consumption look like? Or what's that relative state of change for those that are moving to some of these autonomous capabilities? Thanks.
Ash Kulkarni, CEO
Our AI SOC capabilities on the security end have been a big reason for our success in security. So you've been seeing us do very well in security for the last many quarters. And I attribute a lot of that to the investments that we made and the differentiation that we have in our agentic capabilities when it comes to security. And you know, the biggest differentiation that I still hear from our customers is not only do we have a very, very complete set of capabilities out of the box, but unlike others who have a black box approach to AI, we have more of an approach where we allow you to see what's under the covers.
You can see the skills, you can see the tools inside the harness, inside the security harness that we built. So you can complement it, you can enhance it, you can do more with it. That is a big differentiator. Because at the end of the day, you know, we believe that models are going to keep getting better and for different tasks, you know, some tasks you're going to prefer to use Claude. For others you're going to prefer to use Gemini. For something else, you might use an open‑source model also.
Skills will continue to evolve, harnesses will continue to get better. And we believe that giving that openness and choice to our customers will be an enduring differentiator. And that's what we are seeing so far.
Alex Kurtz, Vice President of Investor Relations
Thanks, Rob. And just as a reminder about our metrics webinar on September 22, that information is going to be posted on the IR website. And with that, let's go to the next question.
OPERATOR
The next question is from Raimo Lenschow with Barclays. Please go ahead.
Raimo Lenschow, Analyst at Barclays
Thank you. Congrats from me as well. A great quarter. A couple of weeks ago you launched Kubernetes capabilities on the observability side. Can you speak to the importance of that? Because that seems to be closing a really important gap in the offering, and maybe just speak to what's possible now. Thank you.
Ash Kulkarni, CEO
Yeah, a lot of it has to do with our focus on having a great end‑to‑end experience and, you know, the areas that we want to make sure customers adopt us increasingly for is using us for metrics, using us for infrastructure monitoring. And as you know, a lot of agents are being deployed on Kubernetes environments, and getting that right with a great end‑to‑end experience with dashboards that light up out of the box, with sort of native support not just for OpenTelemetry‑based ingestion and analytics, but also support for Prometheus data and PromQL.
Like these are areas where we've invested a lot. Even in the prepared remarks, you know, the customer that I talked about that chose us for metrics, you know, that customer moved to us because we made it so easy for them to bring their Prometheus data directly into Elastic without having to transform things, without having to change things. And that's a big differentiator. So you're absolutely right to look at that and see that that is a key element.
It is one of many investments that we've been making on the observability side, and we find that to be quite exciting for the days ahead.
Raimo Lenschow, Analyst at Barclays
Perfect. Yeah, no, thank you. Yeah, same view here, and another one for you. Like, it's like you only had your Q1 but you raised the full year by more than the beat in Q1. You know, nowadays in software everyone is very conservative, etc. What gave you the confidence there? What are you seeing in terms of pipeline, etc.? Thank you.
Janesh Moorjani, Chief Operating Officer and Chief Financial Officer
Yeah, thanks, Raimo. You know, I don't think the guidance philosophy has changed much compared to what we've done in the past. We've always taken a prudent and risk‑adjusted view to guidance. But like you said, it is only Q1, but it was a good start to fiscal 27 and we got some strong data points from that quarter. Our CRPO obviously, which was a good number, and the RPO number, as well as the 100k adds. Apart from that, there were three specific drivers that we saw internally as well.
First is the strong pipeline build both for the second quarter and the full year. The out‑quarter pipeline build's looking good. Second is the consumption against the CRPO committed. CRPO number performed well. And then third, we expected a certain productivity and capacity increase given the hiring that we did. And we're seeing that and that's allowing us to have the confidence on the go‑get number that we need to do for the net new revenue side for the rest of the year.
So that's the reason we guided the way we did and we're encouraged about the revenue trajectory for the year. So it hasn't changed, the philosophy hasn't changed, but we feel good about what we need to go achieve for the rest of the year.
Alex Kurtz, Vice President of Investor Relations
Thanks, Janesh. Next question please.
OPERATOR
Next question is from Howard Ma with Guggenheim. Please go ahead.
Howard Ma, Analyst at Guggenheim
Great. Thanks for taking the question. And I want to add my congratulations too on a strong quarter. My question is, is the acceleration that you're seeing, would you say that that's directly attributable to higher multi‑product adoption driven by the realization that Elastic is an attractive solution for both context engineering and managing the agent‑driven proliferation in telemetry data as opposed to point solutions? And does your guidance factor in material acceleration in cross‑sell among various use cases?
Ash Kulkarni, CEO
Yes, maybe let me touch upon that, and then Janesh, I might let Janesh talk about all things related to guidance. But you know, just if you think about our motion, it's always how it's been very similar, right? So we have a platform that allows customers to do multiple things. And what we focus on is making sure that our platform is incredibly good in each of those areas. So each of our solutions, our focus is on making sure that those solutions are able to be differentiated and stand on their own and win on their own.
And that becomes the tip of the spear for us. It's our land and then expand strategy. Because once we land with one solution, then the goal becomes how do we get the other solution in there and the third solution in there. And obviously, like we had talked even at our analyst day, our last analyst day, the customers that grow the fastest are the ones that adopt us for all three solutions. So that land and expand motion has continued. And it's not that necessarily that that has inflected in any way, but this is—what you're seeing here is just the right kind of progression.
This is a motion that we've been driving. Probably the biggest thing that has happened is, as our focus on our enterprise selling motion, you know, the segmentation change that we did two years ago, as that has matured, we are seeing the benefits of that play out very, very nicely. So our land and expand is working in all three solution areas. We are seeing the right kind of movement. And look, it comes down to making sure that you are positioning your platform, your product in the right way.
And then our sales teams know how to position the multiple product strategy within that platform. And that's why we feel so good about what this is going to mean for the future in terms of the guidance.
Janesh Moorjani, Chief Operating Officer and Chief Financial Officer
Howard, there's nothing different implied in how our land‑expand motion works. Obviously a lot of our revenue comes from expand more than land. Land is the entry point and then expansion is where the dollars come in over time. And that dynamic comes from both expansion of the existing product that you bought and also cross‑sell. So there isn't anything in the guidance that we've taken into account a different behavior from our customers from what we currently see.
Alex Kurtz, Vice President of Investor Relations
Okay, thanks, Howard. Next question please.
OPERATOR
In the interest of time, please limit yourselves to one question. The next question is from Radi Sultan with UBS. Please go ahead.
Radi Sultan, Analyst at UBS
Awesome. Yeah, thanks for taking the question. Ash, in your prepared remarks you called out a SIEM migration, which I believe you said got done in under a month with some of your automated migration tooling. I just wanted to ask, how much of a benefit are you seeing to cloud consumption from AI accelerating migrations on the SIEM side, but also maybe just more broadly.
Ash Kulkarni, CEO
Yes. So the consumption that we saw—the strength in consumption that we saw this quarter—was broad based. It was not related to any one customer. But what I talked about there, which is really important to understand, is at the end of the day, SIEM has never been sort of greenfield, right? SIEM as a space has been around for a long time, and our motion has been to displace the incumbents who are not innovating at the same rate. What's really changing there, to be honest, is the environment.
People are really worried about what it means to protect your environment, protect your agencies, and so on in a post methos world. And it's not just mythos. There are so many very, very capable models out there—not just commercial models, but open source models—that give you the ability to really discover vulnerabilities and then act upon them. So you have to assume that people who are trying to do harm now have the ability to access these models.
So defenders are having to move faster and so on. So that is driving the momentum for our business and the ability with our tooling, with our automated tooling, to migrate these customers from their incumbent solution to our product, our platform. We have gotten really, really good at it. This was a very significant-sized agency, and we were able to move their massive real estate over in one month, in under one month. And that is just the thing that gives our field a lot of confidence.
It is what gives our customers a lot of confidence because as they see these things happening over and over again, it gives them confidence that they can safely move to Elastic and that we will be able to make them successful quickly. All right, thank you.
Alex Kurtz, Vice President of Investor Relations
Next question please.
OPERATOR
The next question is from Srinak Kutari with Robert Baird. Please go ahead. Mr. Katari, your line is open on our end. Perhaps you have it muted on yours.
Alex Kurtz, Vice President of Investor Relations
All right, I think we need to go to the next question then.
OPERATOR
The next question is from Mike Sikos with Needham. Please go ahead.
Matt Galitri, Analyst at Needham (for Mike Sikos)
Hey guys, this is Matt Galitri on for Mike Sikos over at Needham. Thank you for taking our questions. And you gave some great color on that 100K cohort and some of the AI adoption, which we appreciate. Are there any other clear underlying expansion trends you can share regarding older cohorts versus newer ones or smaller customers versus larger ones? Or is it more so just expansion across the board? And you're waiting for that trailing twelve-month net expansion number to catch up, as you mentioned on the prepared remarks?
Janesh Moorjani, Chief Operating Officer and Chief Financial Officer
Yeah, thanks, Matt. So the trailing twelve-month number on the NER side is impacted by the trailing of twelve-month constant currency growth. So that's a separate factor. And as constant currency growth improves alongside guidance that we've provided, it's going to take a lagged effect for the NER to catch up. So that's the comment on the NER side that I was making. But on the cohort behavior, the cohort behavior that we talk about is basically a durable land-expand motion.
So we get our customers in, and there's a long period of durable expansion that we expect from every one of those cohorts, and that's continuing. And we also expect to see, and we see, the AI cohort show a differential in our growth, meaning the customers who are using our AI features are effectively expanding at a slightly higher rate than the ones that aren't. So those are the two dynamics that we see in our expansion rates. And those trends are continuing.
And as I mentioned, NER—which is trailing—ticks up alongside the revenue growth rate that we expect to post for the year.
Alex Kurtz, Vice President of Investor Relations
All right, thanks, Mike. Next question, please.
OPERATOR
The next question is from Asanjit Singh with Morgan Stanley. Please go ahead.
Sanjit Singh, Analyst at Morgan Stanley
Yeah, thank you for taking the questions, Ash. I see a lot of the passion on the SIEM side and obviously throughout the other core parts of the business as well. I wanted to come back to the AI search part of the business. We have a lot of data platform players trying to solve that context semantic problem. I think Palantir's done it in a proprietary way. So from the Elastic perspective, in terms of getting that agent performance and building that map for that agent, why is Elastic able to do that better than some of the other data platform peers that are trying to solve that similar problem?
Ash Kulkarni, CEO
The simple answer, Sanjeev, is because we've always been optimized for dealing with messy data, for dealing with unstructured data. Most of the data platforms that you're talking about, that you might be thinking about, were all designed to work with structured information. And fundamentally, although they might have had a sort of NoSQL view of the world, it was still designed with strict schemas—structure in mind. Elastic has always been different in that sense.
If you think about Elastic, we started as a document store with an inverted index that allows you to put any and all kind of information in it, which is why we were always used for search, which is why we then moved into log analytics. Because all of these things end up being very unstructured. The schema keeps evolving, and if you think about the kind of information that is being used primarily, a lot of it in AI is this kind of unstructured data.
So our strength in terms of being able to bring in this data, being able to then analyze it, search across it—you know, the capabilities that we built not just with vector search, but also around hybrid search, the harnesses that we've built on top of it, all of this, the GINA models, our ability to do re-ranking, and so on—we are way ahead of the competition, especially when you look at things from this unstructured lens. And frankly, Sanjeev, we feel that we are still very early in this overall phase of AI adoption.
Most organizations are only now starting to really deploy things in a meaningful way. So as that grows, as we have more penetration within our customer base, I think that's going to be what really helps us continue this momentum for a very long time.
Alex Kurtz, Vice President of Investor Relations
All right, thanks, Sanjeev. Next question, please.
OPERATOR
The next question is from Ryan McWilliams with Wells Fargo. Please go ahead.
Ryan McWilliams, Analyst at Wells Fargo
Hey, thanks for taking the question—one for Navam. How should we think about the gross margins in the quarter? It looks like they were just slightly lower versus the previous quarter. I mean, perhaps some impact from the mix shift from cloud here, but anything else worth pulling out? And maybe how should we think about gross margins for the rest of the year? Thanks.
Janesh Moorjani, Chief Operating Officer and Chief Financial Officer
Yeah, look, we're very pleased with how our subscription gross margins are performing. It's remained above 80%. There's nothing specific in terms of a trend that emerged this quarter, but over the longer term what we expect is that these gross margins are expected to improve as we see benefits from things like serverless as it gets to scale. So there's going to be fluctuations quarter over quarter, but nothing specific this quarter from a trend perspective on margins.
OPERATOR
This concludes our question and answer session. I would like to turn the conference back over to Ash Kulkarni for any closing remarks.
Ash Kulkarni, CEO
Thank you very much for joining our call today. We are pleased to report a strong start to the year. We are extremely proud of our results and very excited about the opportunity ahead. Lastly, please join us on September 22nd for our public webinar on metrics. Have a great day.
OPERATOR
The conference is now concluded. Thank you for attending today's presentation. You may now disconnect.
Disclaimer: This transcript is provided for informational purposes only. While we strive for accuracy, there may be errors or omissions in this automated transcription. For official company statements and financial information, please refer to the company's SEC filings and official press releases. Corporate participants' and analysts' statements reflect their views as of the date of this call and are subject to change without notice.
Login to comment