Good afternoon and welcome to the Rapid7 First Quarter 2023 Earnings Call. All participants are in a listen-only mode. After the speakers' presentation, we will conduct a question-and-answer session. As a reminder, this conference call is being recorded. I would now like to turn the call to Sunil Shah, Vice President, Investor Relations. Thank you. Please go ahead.

Thank you, operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's first quarter 2023 financial and operating results in addition to our financial outlook for the second quarter and full fiscal year 2023. With me on the call today are Corey Thomas, our CEO; and Tim Adams, our CFO. We have distributed our earnings press release over the wire and it is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast, and following the call, an audio replay will be available at investors.rapid7.com. During this call, we may make statements related to our business that are considered forward-looking under federal securities laws. These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to the company's positioning, strategy, business plans, and financial guidance for the second quarter and full year 2023 and the assumptions underlying such goals and guidance. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the future results expressed or implied in these statements due to a number of risks and uncertainties, including those contained in our most recent annual report on Form 10-Q filed on February 24, 2023, and in the subsequent reports that we filed with the SEC. The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by applicable law. Our commentary today will be primarily in non-GAAP terms and reconciliations between our historical GAAP and non-GAAP results and guidance can be found in today's earnings press release and on our website at investors.rapid7.com. At times in our prepared remarks or in response to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or quarterly results. Please be advised that this additional detail may be one-time in nature, and we may or may not update these metrics in the future. With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey?

Thank you, Sunil. Hello to everyone on the call today. Thank you for joining us this afternoon on our first quarter 2023 earnings call. I am pleased to report that Rapid7 started the year with strong momentum as we work to deliver customers a comprehensive security operations platform at the most compelling economic value. Faster than expected traction from our Threat Complete and Cloud Risk Complete consolidation offerings, which together represented over 20% of new ARR in the first quarter, supported steady customer demand for our insight platform, driving 16% year-over-year growth in ARR to $728 million. Revenue and operating income both exceeded our expectations as customers gravitate towards our security operations solutions and as we manage the business for profitable growth. The customer spending environment in the first quarter was broadly in line with our expectations shared on the February earnings call. Despite ongoing complexity in customer budgets, including elevated levels of deal inspection, we saw strong underlying demand for our insight platform as we started the year. Our solutions solve a critical set of needs for security teams that are working through a complex threat landscape, constraints on talent, and worsening consequences from cybersecurity incidents. While overall demand trends were consistent with our expectations, I'm pleased to share that our teams are demonstrating the ability to execute in an environment with higher budget scrutiny and ongoing macroeconomic uncertainty. A few positive themes continue to resonate in our business throughout the first quarter. The first is that we are benefiting from a clear customer preference for consolidated security offerings. There is a persistent and crucial need to gain visibility and assess risk across traditional and cloud environments and security teams are laser-focused on improving both the effectiveness and efficiency of their programs while maximizing their budget dollars. Our solutions lean into this dynamic by offering best-in-class automated capabilities across cloud security, detection response, and vulnerability management, while being delivered through new and differentiated pricing and packaging models. As a result of this approach, we are sometimes seeing less competition for critical capabilities, given the unique scope of our offerings which, in many cases, customers are unable to consolidate on a single platform with other vendors. These dynamics highlight our unique competitive position as we look to capture wallet share in a consolidating security operations market. As customers gravitate towards vendor consolidation and our sales team ramps up on the new offerings, we are seeing the clear benefit in ASPs for our Threat Complete and Cloud Risk Complete deals, which average more than two times our overall ASPs in the first quarter. Our marketing enablement efforts around these offerings were largely completed in the first quarter, and so far, over one-third of our sellers have sold at least one of our consolidation offerings. Another theme that continued in the first quarter was the growing traction with our differentiated cloud security solutions. Insight Cloud provided customers real-time visibility into their cloud environments with a breadth of features including posture management, agentless cloud vulnerability assessment, workload protection, cloud detection response, and automated remediation. The ability to bring these capabilities onto a cohesive platform offering is increasingly resonating with customers, particularly as usability and time to value have long been core differentiators for Rapid7. Cloud security has evolved over the last few years from a niche complex market into the one we see today where mainstream enterprises show increased demand for solutions that can solve their cloud challenges in an accessible, efficient, and automated manner. Our approach to the market through a consolidated platform focused on accessibility and ease of use is making cloud security more accessible to a broader customer base. In addition, Cloud Risk Complete packages the breadth and depth of our top-ranked cloud technology alongside our enterprise-grade vulnerability management, which provides visibility to traditional environments. This comprehensive risk visibility across cloud and hybrid environments, combined with the compelling package pricing structure, is driving a strong value proposition for organizations of all sizes. A great example of the value we're bringing to customers through Cloud Risk Complete is a recent six-figure ARR deal with a mid-cap technology company. The customer was unhappy with their vulnerability management provider and searching for a replacement standalone VM solution. Our sellers were able to expand the conversation to include cloud security and application security as part of our new Cloud Risk Complete package offering. Rapid7's robust product features combined with real-time event-driven data harvesting stood out as competitive differentiators, as well as the ability to unite vulnerability data with cloud security data for more actionable alerts and more automated remediation. Ultimately, our sellers were able to bring together the customer's on-prem and cloud security teams to win this deal by combining three silo solutions into a unified platform with a single cost-efficient contract. Another first-quarter example of our expanding value proposition for customers is a six-figure ARR deal with a regional healthcare company. The customer was struggling to use a legacy SIEM solution managed by an MSSP due to the complexity of the data and reports as well as the quality of the alerts. They needed a way to identify user behavior in one unified way and define automated solutions that reduced manual work. Our managed detection and response offering combined with InsightConnect automation allowed us to win the deal based on strong underlying technology, amplified by the security expertise of our best-in-class SOC analysts. As part of our continued focus and commitment to customers, I'm thrilled to welcome Larry D'Angelo to Rapid7 as our Chief Customer Officer. This is a newly created role that oversees our sales organization and all of our customer success teams across advisory, onboarding, and support. Larry's extensive background at various software companies and private equity firms, and some of you may remember that he served as Chief Sales Officer for LogMeIn for over eight years, helping the company scale from $100 million to $1.4 billion in revenue. We're excited to have Larry on our team and believe that customers will benefit from having a cohesive customer organization to support their growth throughout the end-to-end customer life cycle. As we look out over the remainder of the year, we are encouraged by the underlying demand for our cloud-native insight platform, our ability to execute in a tighter budgetary environment, and our unique position in the customer-driven consolidation wave for security operation solutions. We're on track to meet our growth and profitability targets for 2023 and believe we're well-positioned for long-term growth as we execute on our strategic vision to bring Rapid7 to the center of our customers' security operations programs. As we refine our go-to-market strategy and invest in support innovation, we are focused on delivering better security outcomes to the large market opportunity in front of us while maintaining a deliberate focus on expanding the efficiency and profitability of our business. With that, thank you for joining us on the call today. I will now turn the call over to our CFO, Tim Adams, to share additional detail on our financial results and outlook. Tim?

Thank you, Corey, and good afternoon to everyone on today's call. Thank you for joining us. Before I turn to the results, a quick reminder that except for revenue, all financial results we will discuss today are non-GAAP financial measures unless otherwise stated. Additionally, reconciliations between our GAAP and non-GAAP results can be found in our earnings press release. Rapid7 ended the first quarter of 2023 with $728 million in ARR, representing growth of 16% year-over-year, and consistent with our expectations. We continue to see year-over-year growth driven in large part by our anchor offerings of detection and response, cloud security, and vulnerability management, which represent the foundational capabilities of our Threat Complete and Cloud Risk Complete consolidation offerings. The breadth and effectiveness of our insight platform, along with our ability to drive value with our complete offerings are resonating with customers as they continue to navigate an evolving budgetary environment. We see ARR growth coming from both new and existing customers, with ARR per customer that grew 9% over the prior year to $66,000. While our global customer base grew 6% year-over-year to over 11,000 customers. As Corey mentioned earlier, over 20% of our new ARR in the first quarter was driven either by a Threat Complete or Cloud Risk Complete offering. We see traction here both with landing new customers and expanding with our current customers with new ARR for complete deals, seeing healthy contributions from each type of customer. First quarter revenue of $183 million grew 16% over the prior year and exceeded the high end of our guidance range. Over 95% of revenue in the quarter was recurring, and product revenue grew 17% over the prior year to $174 million. International revenue grew 21% year-over-year and represented 21% of total revenue, while North America grew 15% over the prior year. Turning to our operating and profitability measures for the quarter. Product gross margin was 76% in the first quarter, and overall gross margin was 73%. Both were within our stated range of expectations, which is mid-70s for product gross margin and low-70s for overall gross margin. Sales and marketing expenses represented 39% of revenue compared to 43% in the prior period. R&D and G&A expenses were 20% and 8% of revenue, respectively, compared to 23% and 9% in the first quarter of last year. We delivered strong first quarter operating income of $11 million above the high end of our guided range. Our adjusted EBITDA was $17 million in the quarter and diluted net income per share was $0.16. Moving to our balance sheet and cash flow statement. We ended the first quarter with cash, cash equivalents, and investments of $270 million. Cash flow from operations was $6 million, and free cash flow was ahead of our expectations and just below breakeven. This brings us to our outlook. We continue to believe that the largest drivers of ARR growth performance this year will be related to executional improvement, including continued momentum for our consolidated offerings, as well as the impact of the broader macroeconomic environment on customer buying behavior. We are pleased that our first quarter results track to the plan across all metrics despite a noisy environment. Therefore, we are reiterating our full-year 2023 ARR guidance of $815 million to $825 million, representing year-over-year growth of 14% to 16%. We are raising total revenue guidance for the full year to $773 million to $779 million, reflecting outperformance in the first quarter. This range represents growth of 13% to 14% with high single-digit growth contribution from our professional services revenue. On profitability, we are also raising our operating income guidance of $59 million to $63 million for the full year, which represents operating margin expansion of at least 300 basis points. The increase reflects the portion of the first quarter outperformance that was unrelated to the timing of spend. We expect full-year net income per share in the range of $0.83 to $0.89 based on an estimated 67.6 million diluted weighted average shares outstanding. For free cash flow, we continue to expect approximately $80 million for the full year, which is approximately double our 2022 level and reflects over 400 basis points of free cash flow margin expansion. Moving to our outlook for the second quarter of 2023, we expect total revenue in the range of $187 million to $189 million. We expect non-GAAP operating income for the second quarter in the range of $7 million to $9 million and non-GAAP net income per share of $0.09 to $0.12, which is based on 67.4 million diluted weighted average shares outstanding. Thank you for taking time to join us on the call today. And with that, we will open the line for questions. Operator?

Thank you. Our first question comes from Matt Hedberg from RBC Capital Markets. Please go ahead. Your line is open.

Great. Thanks for taking my question. Keep it to one here. I guess, maybe for Corey, the success on the complete offerings is really great to see. Obviously, there's clearly I think a security efficacy benefit there when customers select one of those bundled offerings. But I'm wondering if you could talk to the ROI element from a customer's perspective when they consolidate. It seems to be a big part of the narrative here. I wonder if you could talk to that part.

Yeah. You're right, Matt. I think there's two things. There's one, customers are more interested in consolidation because they have to do more. I remind you that budgets are still growing. They're just growing at a slower rate than they were in the past with a little bit more uncertainty. And so what customers are trying to figure out by and large is really two separate things: one, they want to figure out how do they actually continue the security improvements that they've committed to, that are necessary, that are critical, in a more, I would just say, a tighter budgetary environment going forward. But they also importantly want to figure out how they boost the productivity of their team. Because remember, it's not just the budgets that we talk about, it's also their teams and their teams' effectiveness and their team's productivity. The value proposition around our both the Threat Complete and the Cloud Risk Complete is really focused on how do you actually solve the problem of either managing threats or managing risk, but really doing that at high levels of efficacy and high levels of productivity. And one of the side benefits of that is that it's also cost-effective to leverage spend on a common platform. But the primary benefit is that we're driving productivity and efficiency. And the way that we actually do that with Threat Complete is providing the complete SOC stack and solution around how people collect all the data across a hundred percent of the environment to detect the attacks and then the analytics to respond, and then the automation to make sure that that response is robust. And on the Cloud Risk Complete, it's really that integration of looking at the best-in-class across both the traditional VM, but also increasingly people are migrating to the cloud and they want to find a way to actually manage the risk in their cloud environment holistically. So again, it's a productivity boost in about how do they get more out of their talent and their staff, but also by consolidating the platform, they get a direct economic boost that gives them scale by investing with us.

Thanks, Corey.

Our next question comes from Saket Kalia from Barclays. Please go ahead. Your line is open.

Okay, great. Hey, everyone. Thank you for taking my question. Corey, I want to make sure I ask this publicly. Could you provide any comments regarding the public headlines from earlier this year about a sale process? This is similar to the question I asked last quarter. Additionally, could you let us know if that process is still ongoing?

Saket, you experienced some disruption at the end. I believe you were asking about the rumors I addressed on the last call. I'll reiterate that we do not comment on rumors. However, we have an exciting opportunity ahead of us. The momentum we've shown this quarter reflects our performance, which is why people are discussing us in this way. Our focus remains on enhancing our business performance and delivering results for our customers, which we believe will ultimately provide a great return for our shareholders.

Got it. Fair enough. Thank you.

Our next question comes from Rob Owens from Piper Sandler. Please go ahead. Your line is open.

Yeah. Good afternoon. Thanks for taking my question. Wanted to focus in a little bit around net new ARR, and obviously it's been under pressure for the last year. And I think given your holding ARR guidance for the year, does require some acceleration in the back half. So, is that a function of sales productivity? Is that a function of where the pipeline sets up at this point? Just some color to be appreciated. Thanks.

I'm sorry, I seem to be experiencing a few technical difficulties. Rob, can you hear me clearly?

I can hear you. Corey. Can you hear me?

Yes.

Yeah. We can now.

We can now. Sorry. Apologies for that. Did you hear the answer that I gave?

I did not. It went completely silent after my questions, so I don't think I caught you off guard. So, please start from the beginning. Can you provide some context around sales productivity and net new ARR?

Thank you for that, Rob. Our outlook is primarily based on two key aspects. First, the execution of the Salesforce transformation, which is progressing well, and I would say we are ahead of schedule. This is aligning with our expectations. The second aspect is our ability to build the necessary pipeline in the platform consolidation areas, and we are also ahead of schedule there, with the pipeline continuing to expand. The third aspect concerns the conversion rates in those areas, which are performing strongly as we anticipated. As we move forward with the pipeline build, the Salesforce adoption is not only deep but also wide, and the strong conversion rates position us well for the second half of the year. This success hinges on the continuation of these trends, with no significant shift expected, simply a reinforcement of the trends that underpin our core model.

Thank you.

Our next question comes from Shrenik Kothari from Robert Baird. Please go ahead. Your line is open.

Hey, Shrenik, go ahead. We cannot hear you.

Sorry, your line is open.

Sorry. Can you guys hear me now?

Yes, we can hear you now.

Thanks a lot. Quickly on the traction you've mentioned regarding inside DR and cloud security, which is driving multi-product adoption for your company. You've also mentioned the trend towards vendor consolidation, a sentiment echoed by your competitors. I'm curious about the benefits you're seeing in average selling price. Can you provide some insights on your win rates and the current competitive environment? There's quite a bit of noise in the market, so any comments would be appreciated.

I think we're well positioned when it comes to consolidation in the security operations space. There are only a few companies that really cover this area. We provide comprehensive cloud security solutions, including CSPM, cloud vulnerability management, and workload protection. Additionally, we have strong SIEM technology that serves as the foundation of our security operations platform for managed detection response and security automation. This places us in a unique position to drive consolidation in this field, and we face minimal direct competition. When considering end-to-end security operations, it’s essential to effectively manage risk across cloud, on-premises, and endpoint environments, and to detect and respond to attacks throughout the ecosystem. Our win rates are extremely high, largely because our sales team is not facing significant challenges in this area. They've adapted to focus on our consolidation solutions, emphasizing how to enhance security operations efficiency while minimizing long-term costs. This approach sets us apart in the market. The competition we encounter is mainly from specific point solutions rather than in the broader consolidation of security operations.

Corey, I just add, we know it's still early with our consolidation offerings. But in Q1, over 20% of the new ARR came from the new packages and we're seeing more and more of our sellers engage and be successful getting that sale. So that's up from what we saw in Q4. So, it's two data points that are looking very positive, but as you said, this was always intended to really gain full momentum towards the second half of the year.

Thank you for the question.

Thanks Corey.

Our next question comes from Michael Turits from KeyBanc Capital Markets. Please go ahead. Your line is open.

Hey, guys. This is Eric Heath on for Michael. Corey, just wanted to make sure I understand just kind of high level, just curious, it sounds like go-to-market execution is progressing better than you expected. And then on the macro sounds like maybe it got a bit worse in the quarter, but no more than you were kind of already factoring in 90 days ago. So, just one, curious if that's right? And then, kind of secondarily to that, if that kind of gives you some more confidence in that ARR guide for the year.

I believe that’s an accurate description. We anticipated a bit of pressure this year, and it turned out to be largely in line with our expectations. This is why I feel that the market expectations align with ours, which we are pleased about at this point. Regarding Salesforce, two key factors give us confidence looking ahead: the broad participation and retention on the Salesforce. Additionally, Salesforce relies heavily on confidence. The fact that we have people actively building and converting the pipeline, even though it’s early in the cycle, enhances the broader team's confidence and provides us with better visibility and predictability moving forward. Therefore, our successful execution of the plan so far this year indeed boosts our confidence. You start with a high-confidence plan, but it’s essential to see that you are implementing it effectively, and we have demonstrated solid execution against that plan as we've progressed.

Great. Thanks Corey.

Our next question comes from Gregg Moskowitz from Mizuho. Please go ahead. Your line is open.

Hey, thank you for taking the question. It's great to hear about the traction with Threat Complete and Cloud Risk Complete including that ASPs have been showing more than a 2x uplift. Is it fair to assume that you're seeing more of an uptake for these packages from enterprises as opposed to mid-market? And secondly, now that you have a few more months of data, do you have a sense of whether or not this strong ASP uplift could be sustainable? Thanks.

Yeah. It's a great question. As you would expect, yes. We do see early on, a bit more of the bias around the consolidation offerings come from more enterprise-oriented or larger customers in the mix. That said, we do expect that to change. We have high resonance and excitement on our mid-size team. From an expectations perspective, the mid-market is in line with what we expected, but our team has lots of excitement about the pipeline that they're actually building there. The conversion rates while very early are healthy there. And so, we do expect that to span and we actually think the case for consolidation is extraordinarily strong, not just in the enterprise, but also in the mid-market space.

Yeah. That's helpful. Thanks Corey.

Our next question comes from Brian Essex from JP Morgan. Please go ahead. Your line is open.

Hi, good afternoon. Thank you for taking my question. Corey, could you provide more insight into the setup for the second half of the year, particularly regarding macro conditions and sales productivity? Specifically, what are your expectations reflected in the guidance for the remainder of the year? On the sales side, can you share any information about the hiring trends from last year and whether there's an anticipated level of maturity that you're factoring in regarding the Salesforce? Additionally, from a macro perspective, do you expect the situation to remain stable, worsen, or what does the overall outlook look like?

That's a great question. I will break down the balance. On the Salesforce side, our biggest assumption was that we could retain the critical parts of Salesforce and that they would remain productive. We expect productivity to be where we need it to be. The Salesforce piece is set up well. We have a favorable year-over-year comparison, with a more experienced sales team that has had a ramp period for the new offerings. The offerings are competitive, and the conversion rates are stable. We feel very strong about the Salesforce setup for the latter part of the year. There's still work to do, but we feel quite positive based on both a comparative and outlook basis. The second part of our assumptions for the second half of the year is based on the first half of the year and our ability to build the right pipeline. We are still in the process of building that pipeline, which is increasing at a good rate. We believe we will have sufficient opportunities even in this challenging environment for the latter half of the year, and we expect the conversion rates to remain consistent with what we experienced in the recent quarter. However, it's important to note that our expectations for the second half of the year are based on the understanding that the environment will remain pressured. We do not anticipate an improvement in the economic outlook and expect ongoing volatility and pressure. I am confident because our sales team has demonstrated their capability to navigate this environment. This is why we are adjusting our pipeline requirements to account for potential noise and fluctuations. Our sales teams need to adapt to changing deal cycles, and we expect longer sales cycles, all of which are aligned with our assumptions. Our current trends are set up to continue what we observed in Q1 and carry those trends into Q2, Q3, and Q4.

Corey, it's important to highlight that our sellers are really adapting to this environment. We recognize that there is budget scrutiny among customers everywhere, and they truly value and are learning how to sell more effectively in this context.

Absolutely. Thank you for the question.

Super helpful color. Thank you.

Our next question comes from Brad Reback from Stifel. Please go ahead. Your line is open.

Great. Thanks very much. Corey, last quarter you talked about international retention rates being a bit of a headwind. Maybe you can talk to where they were this quarter and what the expectations are for the rest of the year? Thanks.

Yeah. I'll tag team that with Tim, but what I would say is that in general, from our expectations are the international team is performing in lines even slightly better than what I expected. And so, we feel pretty good about the outlook for the year going forward as far as our international teams go.

Yeah. No, Corey, that's right. Look, we've made that investment internationally. We're starting to see signs that it is paying off. Internationally, the retention has improved, let me say modestly in Q1. Overall retention is in line with our expectations and continues to be stable in North America. But something that's very important. We put a lot of effort into it and pay a lot of attention to it.

Thanks for the question.

Thanks very much.

Our next question comes from Matt Saltzman from Morgan Stanley. Please go ahead. Your line is open.

Hey, team. Good afternoon. Thanks for taking the question. So, fully appreciate the ARRs, the key top line metric that we want to focus on here. But just in thinking about how that all flows through the model, can help but notice that billings were a little bit lighter than expected in Q1. So, I'm curious what was the driver of that was? And kind of where you expect to make that up over the course of the year to still achieve the updated revenue guide? Thanks.

Yeah. Hey, Matt. No, I appreciate the question. Look, ARR is the core metric that we share with everyone, which embeds a lot of different things to get to that number, the new, the expand, retention, etc. I think you do have to be a little careful when you're looking at a quarterly billings number. We do look at that, but I do think a better way to look at it is on the last 12 months worth of billing. And if you do that, you'll see that that growth rate is more in line with the growth rate that we're seeing in ARR. There can be some anomalies. There's not a lot of those in terms of timing of billings with certain customers, but I would encourage you maybe to take that longer-term view and I think it's probably the more indicative view that's going to link to ARR.

Thanks for the question.

Our next question comes from Adam Tindle from Raymond James. Please go ahead. Your line is open.

Okay. Thanks. Good afternoon. Hey, Corey. Coming off of RSA, cloud security was certainly a big theme. And on one hand, kind of viewed as a hidden asset within the Rapid7 model. On the other hand, there were some private companies with very healthy funding suggesting that they're taking share in cloud security and coming out with hybrid and runtime capability in the back half of this year that'll go after some of the more traditional vulnerability management players like Rapid7. So, I just wanted to give you the floor, the truth behind some of those fears and competing with Wiz and how you're thinking about potentially defending that threat in the back half of this year. Thanks.

So, first of all, I actually think it'll be great. It'll help the market for customers that the way they should think about it across their complete environment. And when you have customers that say, I want to look at risk across on-prem endpoint and the cloud, we will actually dominate in that space. And there's a couple different reasons: one, I think we as any other player will find us an incredibly long tail on vulnerability management. You can do some of the easy Windows pieces, but when you think about what customers are looking for in enterprise-grade vulnerability management, you have to be able to collect all the data, look at all the content, assess that and look across that. That's not a 12-month engineering effort. If it was this market would have been disrupted a long time ago. Most importantly is we've been investing in the maturity of the cloud security. We've been under-marketing and underselling it. So from a head-to-head perspective, we actually have quite a compelling capability in cloud. And now we've been ramping up our focus on these sales and the marketing of that. Now, when you combine all that together, it benefits us to actually have the market think about the way that we think about it that you should manage your risk holistically, whether it's hybrid, whether it's on-prem, whether it's at the endpoint, or whether it's at the cloud. And the faster that the market thinks about that, the easier it will be for Rapid7 to actually execute a strategy. In that model, I think that we will be anyone head-to-head from a technology comparison basis. So, we welcome any competitor in the market helping us frame the way that customers should think about it holistically from an end-to-end perspective because these things that benefit us. And we're certainly going to be investing in helping customers understand that they should be investing in those end-to-end risk management platforms.

Great point. Thank you.

Our next question comes from Joel Fishbein from Truist. Please go ahead. Your line is open.

Thanks for my question. Corey, I have one for you. I know it was a small acquisition, but I'd like to understand how Minerva fits into the overall strategy moving forward. Will it be fully integrated and how will it be sold in the future? Thank you, I appreciate it.

Great question. It's a tech and team deal and it really enables us to unlock our Threat Complete strategy. As you're aware is that we have lots of demand for customers to actually help them manage from the endpoint to the cloud the ability to detect, respond, and remediate threats. Now, one of the things that our customers asked us for is that they had a wide range of endpoint technologies and antivirus. The ones that could actually sort of like afford to or focused or had advanced endpoint protection technologies. We integrate with those, we'll continue to integrate with those and we're happy with a partnership or cooperation approach. But for those that actually truly just had simple AV and they relied on us to provide their end-to-end detection and response capability, Minerva allows us to actually do advanced in-memory protection on those endpoints. That allows us to make sure that when we detect the threats, those customers are empowered to stop those. The same way our automation and our SOAR technology allows them to actually orchestrate the across the environment and stop, the same way that we actually are able to stop processes, isolate resources, and contain users. That same mentality is what actually has us actually helping our customers respond to their need for cost-effective detection response. And frankly, customers shouldn't have to make the trade-off between spending lots of money to actually have a highly effective and efficient end-to-end detection response capability. So again, our focus is meeting customers where they are, from endpoint to the cloud and providing the capabilities that they're asking for to deliver a robust detection response platform.

Great. Thank you.

Our next question comes from Gray Powell from BTIG. Please go ahead. Your line is open.

Thanks for taking the question. It was encouraging to see the complete mix increase to 20% of net new ARR, up from 10% last quarter. Can you clarify whether that improvement was primarily driven by cloud security or the Threat Complete products? I'm curious about what contributed to that growth.

We have gained momentum in both areas, and the pipeline development has been strong for each. Therefore, we will maintain our focus on both. While I cannot provide specific line item details, we have indeed made progress across both portfolios.

Yeah. Gray, and you're right, it was 10% of new ARR in Q4, so it's up significantly in Q1.

Got it. All right. Thank you very much.

Our next question comes from Jonathan Ho from William Blair. Please go ahead. Your line is open.

Hi. Thanks for taking my question. And this is Garrett Burkam for Jonathan Ho. So, you mentioned the sales transition is ahead of schedule, so can you just expand on that a little bit? Maybe what specifically is progressing well there and maybe where there's still room for improvement? Thanks.

I believe there is an opportunity for improvement as we need to adhere to our plan. While we are currently ahead of schedule, it remains essential to effectively manage the plan. There isn't a significant gap between our expectations and reality. Specifically, some of the key areas we've been focusing on include ensuring a smooth transition while retaining our sales team, which we have successfully achieved. Additionally, we need to build a robust pipeline that spans a wide range of team members, and I’m pleased to report that we are seeing consistent growth in our pipeline across a more diverse segment of our sales force. Furthermore, as Tim mentioned, it’s crucial for a larger group of representatives to be successfully closing deals, as moving from 10% to 20% and beyond is significant. In Q1, we observed progress exceeding our targets, and we must maintain that momentum in Q2. Our outlook for Q2 is based on the assumption that this progress will continue, supported by our pipeline and observed conversion rates. The key factors for our sales force include motivation, building the pipeline in strategic areas, and the capacity to close deals. So far, we are meeting or surpassing our expectations across all these metrics. Thank you for the question.

Got it. Thank you. Yep, thanks.

Our next question comes from Joshua Tilton from Wolfe Research. Please go ahead. Your line is open.

Hey, guys. Thanks for taking my question. I know there's been a lot on it, but I kind of just want to come back to the guidance. It does imply that you guys have to kind of triple your net new ARR by 4Q. So assuming that this all does go to plan and you achieve that, what percentage of net new ARR by the end of the year is going to come from these complete consolidated offerings? And I'm only asking because it does feel like in addition to just these bundles ramping, you sort of see a pretty meaningful improvement in the rest of the business. So one, am I looking at this the right way? And two, can you maybe just unpack for us the other 80% of net new ARR, what's driving that and how will that trend for the rest of the year?

The main factors driving the other part of the business's Annual Recurring Revenue (ARR) are what you might expect. This includes our traditional detection and response services without the consolidation factors. Think about the standalone SIEM category, vulnerability management, and standalone cloud services. What you can see is that this area is less efficient, as indicated by the Average Selling Price dynamics compared to the packages. Efficiency increases as we develop these packages. To clarify, we do not expect the platform consolidations to make up a hundred percent of our sales. It's not included in our base model and doesn't come close. We still need to succeed in securing traditional SIEM, Managed Detection and Response (MDR), vulnerability management, and cloud security, which means we need to focus on upselling and cross-selling. This involves adding threat intelligence and other components as part of our business strategy. For the year, it's important to consider both the current setup and how it compares to last year. We faced challenges at the end of last year, but now we have year-over-year comparisons with a stronger, more prepared sales team and an enhanced product portfolio. Therefore, the overall setup is more favorable than what your analysis suggests. Additionally, we need a strong pipeline, which we are developing and trending towards for the second half of the year, and we must execute on our packages. While we anticipate growth over 20%, we still need to perform well in other business aspects. Our cloud performance is improving, and while our vulnerability management is consistent with market expectations, we will still close business. Most importantly, we will continue our cross-selling and upselling efforts. The expansion of our install base remains a significant part of our strategy. Considering the total setup, the packages, the upselling and cross-selling, and our run rate execution on other business parts, I believe we are well-positioned for the second half of the year and Q4. I agree with your numerical analysis.

Yeah. Corey, I would just underscore. We know the market opportunity. It's over $30 billion, so it's huge. We know the demand environment is there. Yes, there are some challenges from macroeconomic budgets being tightened, but security is still critically strategic for all of our customers and our prospects. We see the pipeline, we see the conversion rates, we have the mature sellers, and we have the breadth of products, and we have the packages. And now it just comes down to execution, which we said will be heavily oriented toward the second half of the year. We're off to a good start, but we have more work to do.

Absolutely. Thank you for the question.

Our next question comes from Alex Henderson from Needham and Company. Please go ahead. Your line is open.

Great. Actually, pretty good follow up to the question that was just asked. And I thought that was a good question as well. But I was hoping you could give us some sense of what a success trajectory would look like for the new ARR from these packages. If it's 10% going to 20%, is it 35% or 40% next quarter and 50%, 60% in the out period, what portion of new ARR should be coming from it to hit your model as we go through 2Q, 3Q and into 4Q?

Yeah. So, it's a good question. It's directionally up. We're not going to provide a specific number at this time and at this stage. But what I would say is we would expect it to continue to expand. And most importantly, keep in mind it's not just the packages. We also expect to continue to be doing cross-selling and upselling. And so when we think about our ARR and expansion, there's a number of different elements that are involved there. But I would say we absolutely directly expect it to continue to expand, but it's too premature to provide you a specific number of what it's going to be like per quarter by quarter right now.

If you're not going to answer that, can I ask another question? Can you share if there was any disruption related to the financial situation that affected your customers' CFO behavior in late March or caused any hesitations?

Yes. I'll give you a quick response. Like many others, some people took a moment to reflect on what recent events meant for them. We did observe some impact, with a few customers pausing to consider the implications, wondering if this marked the beginning of a banking crisis. However, from both our sales team and customer perspectives, this hesitation was brief. They quickly returned to their business, and we ended the quarter on a strong note overall. It was just a moment of pause. Thank you for the questions, and let's keep moving forward.

Our next question comes from Mike Walkley from Canaccord Genuity. Please go ahead. Your line is open.

Hey, good afternoon. It's Daniel speaking on behalf of Mike. Thank you for taking my question. I wanted to know if you could share some insights on the productivity trends of your sales representatives, particularly now that they are selling the two complete bundles. Is this aligned with your earlier expectations, or are they exceeding those projections?

It's in line with what we were expecting. And I would just say the progress goes a little bit to the earlier questions about the mix shift and the pipeline build. That's where we're actually ahead. And frankly, the sales of the new packages and bundles, that's where we're ahead. But I would say the overall productivity is in line to expectation. Again, our expectations assumed that there was going to be a ramp based on training, which we're seeing and we're expecting and we're delivering against. And we are seeing some of the larger deals that we actually talked about earlier, which do have slightly longer deal cycles in addition to the environment. So, I'll say productivity is exactly what we expect it to be. And so as we look forward, that actually gives us the confidence that we are building pipe tech actually close at the productivity rates we expect in the back half of the year.

Our last question will come from Shebly Seyrafi from FBN Securities. Please go ahead. Your line is open.

Yes. Thank you very much. So, your 10-K showed that your sales marketing employee headcount grew by 16% in 2022. What kind of headcount growth in S&M do you expect in 2023?

Yeah. I think Tim sort of like conveyed earlier. I think we're looking for pretty modest growth there. I think we expect more productivity increases. We have the good benefit of actually having the people in place. It was allowing them to get more tenured, to get the training, the enablement, and the ramping. So I would expect modest growth, and it's really a focus on the productivity. And I think we're trending well there.

Yeah. Shebly, as you know, we've doubled our profitability guidance from a year-over-year and free cash flow, and we are certainly very committed to that. We got in front of the headcount hiring curve over a year ago, and it's something that we're just going to watch very carefully along with all of the expenses, the way we invest in the business.

Absolutely. Thank you for the question.

Thanks.

We have no further questions. I would like to turn the call back over to Corey Thomas for closing remarks.

Well, thank you all for spending time with us this evening. And I hope you all have a great rest of the day and a good week.

This concludes today's conference call. Thank you for your participation.