Rapid7, Inc. Q3 FY2022 Earnings Call

Hello. My name is Lisa, and I'll be your conference operator today. At this time, I'd like to welcome everyone to the Rapid7 Q3 2022 Earnings Call. Please go ahead.

Thank you, operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's third quarter 2022 financial and operating results in addition to our financial outlook for the fourth quarter and full fiscal year 2022. With me on the call today are Corey Thomas, our CEO; and Tim Adams, our CFO. We've distributed our earnings press release over the wire, and it is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast. And following the call, an audio replay will be available at investors.rapid7.com. During this call, we may make statements related to our business that are considered forward-looking under federal securities laws. These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to the company's positioning, strategy, business plans and financial guidance for the fourth quarter and full year 2022 and the assumptions underlying such goals and guidance. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the future results expressed or implied in these statements due to a number of risks and uncertainties, including those contained in our most recent quarterly report on Form 10-Q filed on August 4, 2022, and in the subsequent reports we filed with the SEC. The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements. And reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update information presented on this conference call, except to the extent required by applicable law. Our commentary today will be primarily in non-GAAP terms. And reconciliations between our historical GAAP and non-GAAP results and guidance can be found in today's earnings press release and on our website at investors.rapid7.com. At times, in our prepared remarks or in responses to your questions, we may offer incremental metrics to provide greater insights into the dynamics of our business or quarterly results. Please be advised that this additional detail may be onetime in nature, and we may or may not provide an update in the future on these metrics. With that, I'd like to turn the call over to our CEO, Corey Thomas.

Thank you, Sunil, and hello to everyone on the call today. Thank you for joining us on our third quarter 2022 earnings call. Rapid7 ended the third quarter with $684 million in ARR, representing 24% year-over-year growth. While revenue was within our guided range, operating income exceeded our expectations. Our ARR results came in below our expectations for the quarter. Growth was moderated by two key dynamics. First, the impact of ongoing global macroeconomic uncertainty on customers' budgets. And secondly, further anticipated sales productivity challenges as we evolve our model towards a consolidated platform sales approach. I will speak to this in detail on today's call. But first, let's discuss the environment. We spoke on our last earnings call about how the macroeconomic environment is affecting the pace of demand, driving higher levels of scrutiny as customers and prospects manage reputations amid increased economic uncertainty. These persistent trends continue to affect us broadly, with downward pressure coming from our international region. Customers continue to squeeze time into new projects and are, in some cases, taking a more measured approach to scaling their security investments. While we have limited visibility into the macroeconomic trajectory, we continue to factor in this headwind as we look ahead to the fourth quarter and next year. Now, let me turn to the internal dynamics affecting our performance. As we successfully expanded from selling a single product to a suite of products, you may recall that we relied on product-specific sales teams to scale the business. In the back half of last year, we began to mature our sales model towards the channel itself, enabling all of our salespeople to sell the full suite of our insight products. This was a key step in the evolution of our sales force toward a platform selling motion. While we expected multiple products to take slightly longer as we scaled our teams this year, we did anticipate an increase in sales activity during the second half of this year, as they gained mastery of our product suite. Entering the quarter, it became clear that our salesforce is taking longer than we expected to effectively sell a wider set of solutions on our insight platform. Let me highlight two predominant reasons for this. First, our audience is changing. Given the breadth of our platform, sellers are increasingly engaging in high-level discussions. This requires more robust seller enablement, especially for newer representatives, to familiarize them with important products and features for selling platform solutions and outcomes. Second, this strategy requires more focused packaging compared to the previous approach, particularly in an environment where customers are under budgetary pressures. As you might expect, rapidly scaling our sales engine across multiple products while entering a recessionary spending environment exacerbated these challenges during the quarter. In hindsight, our measured transition from a product-centric sales force to a security transformation model, which has understandably been slower than expected, underestimated the amount of time and support necessary for our team to drive efficient platform adoption. We have responded quickly to address this situation. And here's what we're doing today that gives us confidence in our path forward to improve execution. We maintain strong confidence in our mid to long-term thesis to become the platform of choice for consolidated security across resource-constrained organizations. Amidst a complex and highly fragmented security tool ecosystem, security teams of all sizes are struggling more than ever to deliver the right level of security effectiveness for their spending. The bar is higher today, as these teams face increased budgetary pressure. In a recent survey of cybersecurity professionals, 75% of organizations indicated they are looking to consolidate security vendors, as opposed to only a few years ago. We believe the platform investments we've made in recent years position us exceedingly well to help customers achieve more consolidated risk and threat visibility, response, and automation across their expanding digital footprint and growing cloud environment. A great example of how we're delivering on this consolidation value proposition at scale is a seven-figure ARR deal signed in the third quarter with an enterprise healthcare provider. This customer struggled to effectively and efficiently manage their expansive security environment with a leading team offering managed services from a large global consulting firm, experiencing challenges at multiple levels throughout the organization. Rapid7's solution with embedded automation stood out among the competition for its rich detection capabilities. However, a huge differentiator for this customer was our ability to consolidate their SecOps back onto a single platform. By leveraging our DNR threat complete package, this customer was able to solve their most urgent detection and response challenge, while also displacing their existing vendor, all at a better overall economic value. This ability to consolidate parts of their security ecosystem onto our insight platform not only solidified Rapid7 as the platform of choice but also expanded the value of our relationship. In an increasingly challenging landscape, our offerings continue to resonate with customers of all sizes, including our growing enterprise customer base. Customers continue to look to Rapid7 for detection and response solutions amid this dynamic threat landscape for its expert-driven, intelligent, and extensive detection capabilities that deliver market-leading time to value. Rapid7's risk visibility platform is resonating with customers expanding rapidly into the cloud, as we provide more consolidated risk visibility across cloud and on-prem environments. This underpins the sustained growth we've seen in our security transformation solution, which recorded another quarter of 40% year-over-year ARR growth. Let me share how we're optimizing our go-forward sales approach by focusing on specific customer opportunities. As we look to the fourth quarter and early 2023, we're activating more focused, customer-centric sales motions organized around customer needs. This will simplify and consolidate the sales motions that our teams will leverage. Many customers began to separate in Q3 as we started to categorize them alongside security transformation projects. However, we're accelerating this path in the fourth quarter as we plan to anchor our customer engagement around their most critical needs related to detection, response, and cloud risk visibility. This is an obvious next step for two distinct reasons. First, as we engage with customers today, we see the strongest and most urgent customer challenges centered around detection, response, and cloud security, especially regarding our visibility in the cloud while supporting on-premises activities. Second, this aligns directly with the natural progression we've seen in our business, as security transformation has scaled to represent over 70% of our year-to-date land motion. Over 50% of our land ARR is derived from detection and response specifically. Thus, we expect to focus our sales efforts around two core platform packages optimized to address our customers' most pressing security needs. Our threat complete package enables customers to consolidate best-in-class, expert-driven threat detection and response offerings alongside comprehensive coverage of our market-leading vulnerability management on a single platform. A cloud risk complete offering is our cloud-centered risk visibility solution that consolidates unlimited visibility across customers' on-prem, cloud, and external environments at all stages of cloud transition. It enables a comprehensive security experience with unlimited coverage of cloud and application security all within one platform subscription, providing comprehensive coverage of their cloud and traditional infrastructure environments. In addition to this, we plan to refine our pricing and packaging over the next quarter, intending to sharpen our enablement and drive focused marketing efforts around the detection and risk complete value proposition as we leverage our opportunity to help customers manage and respond to threats in their modern cloud environments. We expect these efforts to gain traction over the next few quarters, with improvements in growth starting in the second half of 2023. We will pay close attention to sales productivity as we monitor the success of our packaging efforts with both new and existing customers. Over the past few years, we've developed a best-in-class suite of products across the platform. We firmly believe that the fundamentals of our business remain healthy, and our growth opportunities are strong. Honing and operationalizing our pricing, packaging, and overall go-to-market strategy remains essential for the next phase of our growth. We've enjoyed success with thoughtful investments in the past, and this gives us confidence in our trajectory towards a more effective and efficient platform-centric sales motion. While these changes may be moderately disruptive in the short term, we believe they will better position us for growth in the latter part of 2023 and beyond. Rapid7 continues to benefit from strong secular tailwinds, and the underlying drivers of digital transformation and prioritization of security spending are very much intact. Our plans to improve sales execution while navigating macroeconomic uncertainty are aligned with our overall strategy to provide a compelling value proposition for customers. As we work to help organizations close the gaps in their security environments, we remain highly focused on addressing critical customer challenges. Looking forward, our updated outlook incorporates near-term macroeconomic and productivity-related headwinds, with the latter expected to start normalizing over the next few quarters. We anticipate gradual benefits from the changes we're implementing, which should translate to a modest sales execution tailwind in the latter part of 2023 and into 2024. In early 2021, we shared our expectation to become a rule of 40 company with over $1 billion in ARR by 2025. We remain confident in reaching those targets, though our expected path has shifted. Let me provide some context on how we view that today. Despite execution challenges, which we are actively addressing, we still see an attractive path to a 20% ARR growth CAGR through 2025. We do, however, expect that 2023 may be modestly below 20% as we navigate the short-term impact of our sales optimization efforts. Ultimately, this means we now anticipate a relative balance of growth and profitability to achieve our rule of 40 status leaning more towards profitability than previously expected. Our strong Q3 profitability underscored by our elevated full-year non-GAAP operating income demonstrates our deliberate focus on margin expansion and underpins our confidence in achieving our mid-term targets, which Tim will elaborate on. We remain committed to our long-term strategic goals to support customers in securely transitioning to the cloud, expanding the capabilities and value of our best-in-class insight platform, and balancing our dual mandate of sustainable growth and strategic investment to stimulate overall growth.

Thank you, Corey. Good afternoon, everyone. And thank you for joining us on the call today. Before I turn to the results, a quick reminder that except for revenue, all financial results we will discuss today are non-GAAP financial measures unless otherwise stated. Additionally, reconciliations between our GAAP and non-GAAP results can be found in our earnings press release. Rapid7 ended the third quarter with ARR of $684 million, growing 24% year-over-year. ARR growth continues to be led by security transformation solutions, which sustained 40% ARR growth during the third quarter despite the macroeconomic challenges and sales productivity issues mentioned by Corey. New ARR was driven by our detection and response, cloud security, and threat intelligence solutions as customers prioritize around these crucial categories. The value proposition of our platform resonates with security teams looking to consolidate their spending. Larger new customer deals and expansion with existing customers drove ARR per customer to $63,000, marking a growth of 14% year-over-year. The total customer count benefited from healthy growth in platform customers; however, we did see a modest impact from the macroeconomic dynamics previously discussed. We ended the quarter with approximately 10,800 global customers, growing 9% over the prior year, achieving the upper end of our previously stated long-term growth range of 5% to 10%. Our third-quarter revenue of $176 million grew 26% year-over-year, falling within our guidance range. Product revenue grew 27% to $166 million due to momentum in our security transformation offerings. International revenue grew 36% year-over-year, comprising 21% of total revenue, while North American revenue increased by 23% over the prior year. Regarding operating and profitability measures for the third quarter, our product gross margin sat at 76%, with total gross margin at 73%, both within our expected ranges and improved modestly from the last quarter. Sales and marketing expenses accounted for 38% of revenue, compared to 40% in the previous year, while R&D and G&A expenses were 20% and 8% of revenue respectively compared to 21% and 8% last year. Broad-based and disciplined expense management resulted in an operating income of $13 million in the third quarter, reflecting a 7% operating margin as we proactively focused on achieving our profitability targets amid macroeconomic uncertainty. Our third-quarter adjusted EBITDA stood at $18 million, with a non-GAAP earnings per share of $0.14. Turning to our balance sheet and cash flow, we ended Q3 with cash, cash equivalents, and investments of $268 million. Our solid operating income and working capital management drove third-quarter operating cash flow of $20 million and free cash flow of $10 million. Moving to our guidance for the remainder of the year, as Corey mentioned, we expect that the optimizations we are making to our platform go-to-market strategy will gain traction over the next few quarters, providing meaningful growth support starting in the second half of 2023. However, it's prudent to maintain a moderate level of near-term performance disruption, exacerbated by ongoing macroeconomic pressures. Given these dynamics, we now expect full-year 2022 ARR to range between $711 to $717 million, representing a growth of 19% to 20% over the prior year. In terms of revenue, we are narrowing and lowering our full-year 2022 outlook to between $680 million and $682 million or 27% year-over-year growth, driven by our revised ARR expectations for the year. We remain committed to scaling profitability in our business moving forward and have multiple levers to achieve that. Therefore, we are raising our full-year operating income outlook to between $25 million and $27 million, reflecting our third-quarter profitability strength that we expect to carry on. Non-GAAP earnings per share is expected to fall between $0.17 and $0.20 for the year, based on an anticipated diluted weighted average of 59.9 million shares outstanding. For free cash flow, we are adjusting our full-year outlook slightly lower to a range of $36 million to $40 million, just below the lower end of our previous range. This new range represents our continued focus on cash generation and profit expansion, partially offset by lower billing expectations associated with reduced ARR estimates for the year. Our outlook for the fourth quarter of 2022 indicates revenue will range between $179 to $181 million with operating income between $14 million to $16 million. Non-GAAP earnings per share are expected to be between $0.17 to $0.20, based on an anticipated diluted average of 66 million shares outstanding. We are confident in navigating the macroeconomic backdrop and successfully transitioning our sales force to a more focused and streamlined platform-selling motion. As Corey emphasized, we continue to see a pathway to 20% ARR growth CAGR as we work towards our goal of becoming a rule of 40 company by 2025. Moving towards this goal, we expect steady improvement in free cash flow margins, ramping up by at least 400 basis points yearly over the next few years, which aligns with our vision from our previous investor day. We have the right strategy in place to meet these targets. Thank you for joining us on the call today. We will now open the line for questions.

Your first question comes from the line of Matt Hedberg with RBC Capital Markets.

Great, thanks for taking my question, guys. Corey, for you, I guess on the sales execution or the sales productivity. It sounds like you guys are looking at a variety of ways to improve that, and it obviously makes sense long-term as a platform sale. I'm curious, as you look at the composition of the Salesforce today, is it the right people in place, or is it more of a process improvement that needs to happen?

Thanks, Matt. It's a good question. We believe we have the right people. I think there are two core elements we need to focus on. First, we have to make it more direct and easier for people to sell the platform. We are correcting and adjusting this by enabling our sales team to sell platform packages rather than individual products. The second element is more about process and seller enablement. We've seen more momentum selling higher in organizations, which Rapid7 has not traditionally done. We are training our sales team to engage effectively at the CIO level, which is a critical advantage, allowing them to sell platform capabilities across the organization. These two areas are our main focus as we enhance Salesforce enablement, and we anticipate improvements by the end of this year and into the first half of next year.

Thanks a lot, Corey.

Your next question comes from the line of Jonathan Ho with William Blair.

Hi, good afternoon. I wanted to understand a little better the guidance. Can you discuss the additional conservatism you've baked in, if there was any? How should we think about that as we contemplate 2023? What assumptions around the macro and your ability to improve sales productivity are embedded in the guidance?

Yes, Jonathan. There are two factors to consider. First, our changes are primarily based on customer demand. This is the opportune time for consolidation, as customers are operating under constrained budgets. Having platform capabilities positions us well to respond to where customers are. Therefore, we are accelerating our sales efforts around consolidation. Secondly, we want to de-risk the macro environment. We believe there will be increased pressure in the mid-market as we enter a potentially recessionary environment, which is why we've adjusted guidance for the fourth quarter. The macro assumptions we have going into next year indicate there's a possibility of a recession impacting results. We also remain focused on accelerating optimization around our platform selling motion, which we expect will yield benefits in the second half of next year.

And Jonathan, this is Tim. I would just add to Corey's comments. We both reiterated our commitment to being a rule of 40 company by 2025. We remain confident in a 20% growth CAGR for ARR over that time. While it may dip slightly below 20% next year, I believe we will see recovery in the second half of next year based on all the improvements discussed.

Thank you. I’ll get back in queue.

Your next question comes from the line of Rob Owens with Piper Sandler.

Hey guys, this is Justin Roach on behalf of Rob. Just wanted to ask on the cloud security side; given this as a significant priority moving forward, how would you characterize this area? Are you seeing success with new opportunities or are you primarily displacing other platform or point vendors? What are the primary differentiators between your platform and that of your largest competitors?

We view this space as predominantly greenfield in nature, with a growing urgency over the last couple of years. We're moving from an on-prem focus to a cloud-centric world, which has become increasingly important as critical assets migrate to the cloud. As the primary driver for asset management is now often in the cloud, we aim to establish ourselves as the default platform for visibility and risk analytics. Our shift has led to easier integration of on-prem and cloud solutions within our offerings. While we face competition, it's largely in the form of point solutions, rather than direct competition with vendors like Palo Alto. For us, we believe our comprehensive platform providing unlimited visibility and risk analytics across environments is resonating with customers.

Got it. Thanks, Corey.

Question comes from the line of Mark Cash with Raymond James.

Yes, thanks for the question. I was just wondering if you could discuss the ARR outlook, which was lowered by about $31 million. Can you delineate how much of this was driven by productivity issues versus customer service needs or FX headwinds?

Tim and I would tag team this question. Roughly, I would estimate that it's half productivity issues and half external factors such as FX. While we believe we can significantly improve productivity moving forward, the macroeconomic pressures, including recessionary trends in Europe and the mid-market, warrant caution.

I agree, Cory. The impacts have been roughly 50-50. We've acknowledged opportunities for improvement, while also recognizing external factors, including FX headwinds of approximately $7 million for the year.

Your next question comes from the line of Michael Turits with KeyBanc Capital Markets.

Hi, this is Ashley Owens on behalf of Michael. I have a quick question. Last quarter, you mentioned VM ARR slowing to the mid-teens. I'm curious if you saw it hold steady or if there was any further slowing this quarter?

It's a good question. We did miss expectations. There was some pressure on our VM segment this quarter. As we look forward, it's increasingly challenging to isolate VM metrics since we are running it as part of our broader platform package. Our belief is we will gain unit share in the vulnerability management market due to our more complete solution.

Great, thanks.

Your next question comes from the line of Hamza Fodderwala with Morgan Stanley.

Hey guys, it's Matt on behalf of Hamza tonight. Thank you for taking my question. I just wanted clarification on guidance. It looked like a nice beat in Q3 for operating income; you raised the full-year operating income guide, but it seems slightly less than the Q3 beat. Is that related to fixed costs associated with the fourth quarter or directly tied to some of the investments you're making to improve Salesforce productivity? Just trying to understand the juxtaposition between growth versus profitability outlook.

Yes, Matt, it's a good question. We remain focused on finding leverage in the business while investing thoughtfully across the organization. We stay committed to the balance of growth and profitability. The revised guidance falls within that framework. We did lower our full-year revenue guidance, which does create some pressure in the operating income line. However, we rolled most of the revenue impact through to the operating income figure, but there is some headwind due to the reduced revenue estimation.

That makes sense. Thank you.

Your next question comes from the line of Fatima Lulani.

Hi, this is Joel on behalf of Fatima this evening. A quick question on discounting levels. Can you discuss any trends you've observed in customer pushback, especially concerning core VM pricing? Going forward, what is your approach to concessions and flexibility in pricing?

It's an insightful question. Customer budgets are constrained at this time, as many customers are engaging in recessionary planning. We expect to see increased negotiation around deals, particularly in the mid-market. To address this effectively, we're focused on how to address customer needs by providing value without relying solely on discounting. Our approach is to promote our threat complete packages that offer value through comprehensive solutions. We are shifting the focus from individual product packages to integrated solutions that deliver exceptional value, encouraging customers to invest meaningfully in our offerings without the need for heavy discounts.

Thank you.

Your next question comes from the line of Robert Galvin with Stifel.

Hi, this is Rob Galvin on behalf of Brad Reback. Thanks for taking the question. Can you review how VM pricing for the new package bundles will be structured?

Certainly. The packaging approach will emphasize the customer dynamics. Customers are transitioning their environments and do not want to lock up dollars exclusively in one area over another. Additionally, they are frustrated by 'nickel and diming' from vendors. We are moving to a model where we can provide unlimited visibility without unnecessary restrictions or billing complexities, helping our customers manage their security operations efficiently. This streamlined packaging structure will not only enhance the customer experience but also align with their budgeting needs.

The next question comes from the line of Mike Walkley with Canaccord Genuity.

Guys, good afternoon. This is Daniel on behalf of Mike. Thanks for taking my question. I wanted to delve deeper into the sales execution challenges spanning your operations. Was it particularly pronounced in international markets?

As previously mentioned, international markets, particularly in Europe, faced significant challenges this year. We encountered more pronounced execution issues in those regions. Moving forward, we expect the mid-market to experience heightened pressure due to tighter budgets. We are taking steps to mitigate risks as we see the potential for these macroeconomic challenges to impact our results.

At this time, there are no further questions. This concludes today's conference; you may now disconnect.