Thank you for your patience. I would like to welcome everyone to the Rapid7 Second Quarter 2024 Earnings Call. I will now hand the call over to Elizabeth Chwalk, Director of Investor Relations at Rapid7. Please proceed.

Thank you, operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's second quarter 2024 financial and operating results in addition to our financial outlook for the third quarter and full fiscal year 2024. With me on the call today are Corey Thomas, our CEO; and Tim Adams, our CFO. We have distributed our earnings press release over the wire, and it is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast, and following the call, an audio replay will be available at investors.rapid7.com. During this call, we may make statements related to our business that are considered forward-looking under federal securities laws. These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to the company's positioning, strategy business plans, and financial guidance for the third quarter and full year 2024 and the assumptions underlying such goals and guidance. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the future results expressed or implied in these statements due to a number of risks and uncertainties, including those contained in our most recent quarterly report on Form 10-Q filed on May 8, 2024, our most recent annual report on Form 10-K on February 26, 2024, and in the subsequent reports that we filed with the SEC. The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by applicable law. Our commentary today will primarily be in non-GAAP terms and reconciliations between our historical GAAP and non-GAAP results can be found in today's earnings press release and on our website at investors.rapid7.com. At times, in our prepared comments or in responses to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be onetime in nature, and we may or may not update these metrics in the future. With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey?

Hello, and welcome to everyone joining us on our second quarter 2024 earnings call. As previously mentioned a few weeks ago, Rapid7 ended the second quarter with $816 million of ARR, which is in line with our expectations and represents 9% growth over the prior year. Growth was led by our direct detection response business as customers continue to prioritize their ability to efficiently monitor security data across their full environment while extending their teams with our deep security expertise. The strongest demand was for our consolidated threat complete offerings, which drove over 40% of new ARR in the quarter. As we progress through the second quarter, the underlying market dynamics we've highlighted as tailwinds to our business continue to support our broad strategic plans. Security practitioners are increasingly struggling to manage visibility into their complete IT environments. Current market offerings don't tackle these challenges effectively or economically, which is particularly difficult for mainstream enterprises. As we continue to advance key investments around innovation this year, these core customer challenges remain our focus. Rapid7 is investing to build a strong security operational ecosystem for mainstream enterprises, supported by a leading data platform for contextualizing risk across fragmented complex environments. Over the past year, we've been strategically reorienting our company towards an integrated data platform, focusing on the highest value workloads in cloud and detection response and building out a more efficient go-to-market motion. We firmly believe that providing visibility across the customers' risk environment by integrating traditional vulnerability management with a broad set of cloud security solutions and pairing it with world-class detection and response SOC efficacy in one place gives customers a more effective solution and overall better security outcomes at the price value they are seeking. Our strategic plan is to capture this opportunity while optimizing our business for better long-term growth. In order to meet these strategic objectives, we start this year by sharing our intentional and targeted efforts around three key areas: detection response innovation, our partner ecosystem, and mainstream cloud security adoption. We've spoken to these critical areas on the last few earnings calls. And today, I'm pleased to update you on the progress we made in each and every one of them. Our first area of focus is innovation to deliver world-class detection response experience to our customers. Rapid7 has taken a deliberate approach in this market over the last few years, and we continue to invest in extending our capabilities with a committed focus on delivering the integrations, features, and usability that resonate most with mainstream enterprise customers. This overarching approach supports the steady growth we are seeing today in the following ways. The escalated frequency of ransomware attacks is driving security teams to favor solutions that monitor their full IT environments. We continue to focus investments towards expanding the breadth of alert coverage on our platform, which improves our ability to monitor and manage more third-party security data on our platform and sets Rapid7 apart from our peers in sales and the SDR space. Rapid7 also stands out against point vendors that lack broad expertise and capabilities across security operations. Our ability to offer integrated platforms to solve adjacent security concerns like full visibility into hybrid attack surfaces delivers better security outcomes and more compelling economic value. And lastly, we are one of the few detection response platforms that provides customers a seamless extension of their own security teams by using our managed services and the extensive expertise that comes along with it. We continue to invest in the efficiency and scale of our SOC, including leveraging AI and analytics to make these teams more effective. Our second area of focus this year is our partner ecosystem, which continues to increase in importance as we scale and prioritize efficient demand generation. Investing in our grower services and partner ecosystem to increase our capacity for service delivery as well as provide a strong source of efficient demand generation will help us deliver more sustainable and profitable growth. The sales pipeline generated across our strategic partners grew 15% year-over-year in the second quarter, which was an acceleration from Q1. Our team is seeing traction broadly as we continue to implement our MSSP partnerships, key channel relationships, and increasingly engage with customers in marketplaces like AWS. Our Comcast business partnership is progressing nicely and will serve as a steady driver of scale for our detection response business. Customer buying behavior continues to shift towards the hyperscaler marketplaces, and our ability to support this has doubled the volume of deals that we have closed year-to-date on AWS marketplace. Furthermore, we're gaining mind share and momentum with our top channel partners, which is helping to support stronger pipeline growth. Our last area, and the one that I'm most excited about today, is our focus on leading mainstream cloud security adoption. To give some context to the unique challenges and opportunities in this space, it's helpful to remember that many security teams don't exactly know what their IT environments look like. While this knowledge is foundational to protecting those environments, many customers' attack surfaces are limited by data collection, which tends to be expensive and challenging, especially as it relates to securing cloud environments. Because there are multiple sources of data to integrate. We are lowering the barrier of visibility by allowing customers to secure their attack surface by integrating a diverse set of security data, including network, identity, and cloud telemetry together on the Rapid7 demand platform. This leads me to the announcement you may have heard and seen yesterday; we introduced our new Command Platform at Black Hat. This fully integrated platform extends our traditional insight capabilities by allowing customers to integrate more of their critical security data in one place, whether that data comes from Rapid7 or other providers, giving security operations teams greater visibility that they can trust. Our flagship Exposure Command offering aims to provide integrated risk visibility across the full attack surface and optimal cost-effectiveness. This single unified view can help customers understand what their complete environment looks like and what their biggest exposures are at the core of our new Exposure Command offering. The hybrid attack surface clarity offered by Exposure Command across both traditional and cloud environments is now built into our vulnerability management and improved suite of robust CNAPP capabilities for an integrated threat-based approach to risk reduction. Exposure Command is bolstered by our recent acquisition of Noetic, which provides an integrated high-confidence view of assets across the attackers. We believe that the Noetic technology and the top-notch team will be crucial pieces of Rapid7's broader offering, and we're thrilled to have them on board. Starting officially this week, the Rapid7 team will be executing on the following opportunities for our company and our customers related to Exposure Command. Firstly, the opportunity to drive meaningful expansion from our existing InsightVM base to Exposure Command with frictionless upsell offers for customers looking to unlock better attack surface visibility and expand into the cloud. Secondly, we expect this new platform offering can enhance retention not only through Exposure Command but by offering additional attack surface management functionality as part of the existing VM offering and with minimal uplift. Third, Exposure Command acts as a second flagship land offering with disruptive market pricing to position us strongly in competitive deals and to help us expand the market to new mainstream customers. Finally, we believe accelerating cloud security adoption via Exposure Command will further support D&R growth. As customers know well, you can't effectively monitor and respond to risk without visibility into your attack surface, and having visibility into your full environment drives greater urgency around monitoring and responding to threats. As we look ahead, we believe that the long-term investments we are prioritizing this year in the three critical areas I just described, reporting the metrics, looking at our partner ecosystem, and accelerating mainstream cloud adoption, will ultimately deliver the best security outcomes and the strongest economic value for our customers. We remain steadfast in our commitment to enhancing value for our shareholders, and we are working to capture upside and opportunity through our focused strategic plan. We're currently in the market with our two flagship offerings, Exposure Command and detection response, to address the highest priority areas of the security operations landscape. We continue to innovate our underlying product capabilities and improve our land and expand motions to meet customers' needs in existing markets. We are confident that our recently streamlined leadership organization, focused on profitability and efficient growth, and a clear strategy to provide a leading security operations platform to mainstream enterprise customers will support long-term growth for Rapid7. Thank you for joining us on the call today. I will now like to turn the call over to our CFO, Tim Adams, to share additional detail on our financial results and outlook. Tim?

Thank you, Corey, and good afternoon to everyone on today's call. Thank you for taking the time to join us today. Before I turn to our results, a quick reminder that except for revenue, all financial results we will discuss today are non-GAAP financial measures unless otherwise stated. Additionally, reconciliations between our GAAP and non-GAAP results can be found in our earnings press release. Rapid7 ended the second quarter of 2024 with $816 million in ARR, consistent with our expectations and growing 9% over the prior year. Our Q2 ending ARR result reflects continued strength in our detection and response business, particularly for our threat complete offerings. As Corey shared, this consolidated offering drove over 40% of new ARR in the quarter and underscores the customer demand we are seeing for broad, effective, well-integrated solutions at compelling price points. Trends in the rest of the business during the second quarter were in line with our expectations as we work towards the launch of our Exposure Command, our new integrated risk management offering. ARR growth in the second quarter was weighted towards our sales expansion, as ARR per customer grew 7% over the prior year to $71,000, while our total customer base grew 2% year-over-year to end the quarter with nearly 11,500 customers. We continue to see growth in our higher-value platform customers that is partially offset by a decline in lower-value non-platform customers. Second quarter revenue of $208 million grew 9% over the prior year and exceeded our guided range. Recurring product subscription revenue grew 10% over the prior year to $200 million, which was better than expected on favorable linearity in the quarter. Professional services revenue declined sequentially as we continue to actively deemphasize certain lower-value services. Our revenue mix continues to shift towards international, which grew 19% year-over-year and now represents 23% of total revenue. I'll turn now to our operating and profitability measures for the second quarter. Profit gross margin was 76% in the quarter, and total gross margin was 74%, both of which are in line sequentially and with the prior year. Sales and marketing and R&D expenses were 33% and 15% of revenue, respectively, compared to 39% and 21% in the prior year. G&A expense was in line with the prior year at 7% of revenue. Operating income of $39 million was above our guided range and represented a roughly 19% operating margin, approximately 12% higher than the second quarter of last year. Adjusted EBITDA was $45 million in the quarter, and net income per diluted share was $0.58. Moving to our balance sheet and cash flow, we ended the second quarter with cash, cash equivalents, and investments of $494 million compared to $464 million at the end of the first quarter. We generated $29 million of free cash flow in the quarter, up from the $28 million we reported last quarter. This brings us to our guidance for the remainder of the year. We continue to expect full year ending ARR to be in the range of $850 million to $860 million, which represents growth of 6% to 7% over the prior year. Our second quarter was broadly in line with our expectations. And as we look out at the rest of the year, our assumptions for the second half have not meaningfully changed since we updated guidance in May. While the demand environment continues to be challenging, we expect relative stability in customer spending trends to continue. And while we expect improving pipeline momentum exiting the year, only a modest contribution from Exposure Command is assumed in the fourth quarter. Lastly, we continue to expect that our detection and response business will remain healthy. Similar to the comments we made last quarter, given the ramp of ARR in the second half of the year and the timing of our recent Exposure Command launch, I would like to share some directional commentary on our ARR expectations for the third quarter. We expect a high single-digit sequential increase in millions of net new ARR dollars similar to the increase in the second quarter. We are raising and narrowing our full year revenue range to $833 million to $837 million representing growth of 7% to 8%, up from the $830 million to $836 million. On profitability, we are maintaining the midpoint and narrowing our full year operating income range to $152 million to $156 million. Our updated operating income range is the result of better expense control in the second quarter that is offset by new incremental costs in the second half of the year related to the Noetic acquisition as well as higher advisory and legal fees. We expect full year net income per share in the range of $2.15 to $2.20 based on an estimated 74.7 million diluted weighted average shares outstanding. Our full year expectation for free cash flow is now $150 million to $160 million. While we remain strongly committed to expanding profitability and continue to see a reasonable path to our original target of $160 million, our updated range reflects the new incremental costs in the second half of the year related to Noetic and higher advisory and legal fees. Moving to quarterly guidance, for the third quarter of 2024, we expect total revenue in the range of $209 million to $211 million, representing growth of 5% to 6% over the prior year. We expect non-GAAP operating income in the second quarter in the range of $36 million to $38 million and non-GAAP net income per share of $0.50 to $0.53, which is based on 74.9 million diluted weighted average shares outstanding. Thank you for taking the time to join us on the call today. And with that, we will open the call for questions.

Your first question comes from the line of Matt Hedberg from RBC.

Corey, nice to see the stability in the results. I guess I wanted to drill down a little bit on some of the go-to-market changes that you talked about a month or so ago. Maybe just a little bit more of the rationale there? And how do you think about that potentially impacting second half performance?

Yes. No, it's a great question, Matt. The primary drivers are gearing up for the evolution of our go-to-market motion as we really focus on both the Command and Exposure Command launches. A big part of that is upgrading our VM customers to our new Command Platform, which we think is going to be more relevant to the future than traditional vulnerability management, and we had a higher urgency around that. We had three established leaders who have a strong track record and tenure with the company that we're ready to take over integrated roles across each of the regions. The second part of it is, I've been spending the last several years really focused on our product and R&D. I really wanted to spend more time with our sales leaders as we were making this transition, and as we were looking to accelerate the business going forward.

Got it. That makes a lot of sense. Regarding the second question, you mentioned in your prepared remarks that the sales pipeline from partners has grown significantly, including MSP and AWS among others. As you consider the evolving go-to-market strategy, how critical will partners be, particularly with new product launches and overall distribution?

Look, I think it’s critical. If you just take a step back, remember, we have two big things that we’re really focusing on: one, making sure our products and services are relevant for the next five years, not the past five years. We’ve had a lot of focus on the product strategy around detection and response, managed detection and response, and now sort of integrated Exposure Command with our new attack surface management offering. So, we’ve been highly focused there overall. But the second part is how do we actually set ourselves up for efficient growth as we actually go forward? And as you know, we have to make some sort of hard but important decisions to actually look and say how do we become the growth-oriented security operations company over the next five years, and we see partners as critical to that. We think we’re making good traction there. We’re still in the middle of the transition there, but we’re seeing the signs point in the right way. Partners like our offering. We’re increasing our investment. We’re increasing our service around it. We think it’s good for partners and good for our customers.

Your next question comes from the line of Fatima Boolani from Citi.

This is Joel on for Fatima. So maybe just first one to follow up on the go-to-market conversation. In relation to some of the changes from earlier this year, could you just talk about how sales productivity and attrition levels have trended relative to your internal expectations? And then also from that perspective, what's embedded in your guidance for the year?

Yes. I assume you are referring to the sales team. We have observed strong retention among our sales personnel, which aligns with our overall expectations for the maturity of our sales force. Our sales team is very enthusiastic about the new Command launch and the upcoming products we are bringing to market. I have not witnessed this much momentum in a long time. We believe this enthusiasm is contributing to retention, and overall, despite a challenging macroeconomic environment, we are experiencing significant excitement and momentum as we move into the second half of the year.

Got it. And then maybe just a follow-up for you, Corey. On the CRC D2, any shareable anecdotes from customers and maybe how early momentum is tracking relative to your expectations?

Yes. The biggest difference is that we launched our new Command Platform. The Insight Platform was a Rapid7 platform that provided a common set of products. The Command Platform, on the other hand, integrates all security data platforms and includes Rapid7 data. Importantly, customers want visibility into all their security data regarding their attack surface without it being siloed by system integrators. The Command Platform and Exposure Command solve this problem by offering the most cost-effective and effective view of the overall attack surface while integrating all security telemetry from the entire ecosystem. We are seeing significant early interest, although it's still early to assess fully. However, pre-launch we noticed a strong pipeline build, and our sales have reached the highest levels of any launch in Rapid7's history. We've already secured our first deals because we are meeting a real customer need. That said, we are realistic about our expectations for this year. Our main goal is to build the pipeline to prepare for acceleration next year. If sales cycles close sooner, that would be great, but it's not something we are factoring into our overall plans.

The next question comes from the line of Jonathan Ho from William Blair.

Can you hear me, okay?

Yes.

Yes, John.

Just wanted to get a sense for how you're thinking about this Command Platform upsell, and perhaps how you're seeing the market change, whether there's any shift in terms of customer spending behaviors that are maybe moving more towards the CTEM or attack surface management value proposition?

Yes. It's a great question. Look, we've been worried about this for a while. We started investing several years ago. We've been accelerating the investment. That was a big part of the restructuring that we did last year because we really want to position ourselves for future customer needs. Right now, our customers' biggest challenge is that you ask almost any customer, they do not have a clear understanding of the overall attack surface. Vulnerability management has done a decent job, but it's still providing a silo of data about parts of the attack surface space with a lack of context. What we heard from lots of customers is they wanted to actually have a high-confidence view of their overall attack surface. They wanted to actually integrate data from all of their security telemetry, not just from one vendor. That supplies many asset inventory systems. They actually want to lower the cost of actually understanding the overall attack surface, which is one of the challenges you have on the cloud side. We are seeing a shift to CTEM or what Gartner calls the exposure management space. It's not just sort of packaging vulnerability management together with cloud; it's the ability to ensure you have end-to-end visibility across the environment. The investments we made with Noetic’s innovation is about integrating all that data to have the highest confidence view of the state of the overall attack surface at any moment in time and then being able to drive, investigate, and prioritize across all the data.

The next question comes from the line of Joel Fishbein from Truist Securities.

Congratulations on the launch of the Command Platform. Corey, could you provide more details on the pricing, packaging, and go-to-market strategy for the Command Platform? Additionally, it would be helpful to know what features it will include and what it will not include.

Yes. So while it’s early days, what I would just say is that, look, similar to what we did in detection and response, our goal is to actually make having 100% visibility with confidence into customers’ environments affordable and achievable. So it will be an uplift, but it's a relatively reasonable uplift for existing vulnerability management with customers. If we actually do that, it will not just improve sort of like net revenue retention expansion growth; it will also lock customers in for longer and make them stickier because we’re solving a bigger, better problem. The second thing that we've actually enabled by taking that approach is when customers better understand their attack surface, there’s more to monitor, and we can monetize it with our detection and response offering. So you can expect it to be a small uplift from the incremental vulnerability management perspective, but we really are pricing this to give customers complete visibility into their overall attack surface. From there, we actually have several different offerings on top that we can actually monetize, but it all starts with every customer gaining 100% confidence in understanding their attack surface.

Your next question comes from the line of Alex Henderson from Needham.

Yes, before I ask a question, I wanted to clarify something. Did you mention that your pipeline increased by 15% for the entire company, or was that just for the bar channel?

Yes. So that was our overall partner ecosystem; it was up 15%. The commentary on the company is just that we have seen pipeline stabilize and improve, but we want to see that improvement continue as we build our momentum for next year.

Okay. So if I were to look at the two major products that you've got now, what you're calling your two foundational platforms, if I was a new customer say in the June quarter of next year and I acquired these two product lines simultaneously for a reasonably sized company. What would be the relative sizing of the two acquired properties? Would one be larger than the other? Is the Exposure Command product larger or smaller than the detection and response platform?

Yes. The way to think about it is that Surface Command is designed to sort of be very low cost and give you complete coverage of the environment, so people can integrate data across the environment. Exposure Command combines the integration capabilities of Surface Command with all of the raw capabilities. It’s meant to drive adoption by being affordable and providing overall coverage in the environment. Detection and response is going to be at a premium price point and is going to be more customizable based on the customers’ needs. We have a wide range of price points from technology-only deals, managed services through partners to customer learning. We have a wider range of price points with detection and response, which is also super strategic for customers. Part of why we take this disruptive approach on Surface Command and Exposure Command is that the more people understand their attack surface, the easier it is for us to monitor and secure the attack surface with the customers.

So should we be thinking about this as somewhat of a loss leader entry product that then allows you to upsell the detection and response platform and therefore, is a much smaller contributor to revenues but does drive the overall business proposition over time? Is that the right way to think about...

Yes. The way that I would think about it is it will be a contributor. We expect it to be a contributor to growth, but I would say it’s probably a smaller contributor to growth than detection and response, but it’s still a net positive contributor to growth, just to be clear. I think that is disruptive in terms of packaging and pricing. It doesn’t disrupt growth; it does set up for higher expansion in growth in the detection and response business. That’s true. But we’re not pricing it where it negatively affects growth. It is accretive to growth. We expect it to be accretive to growth, but we expect detection and response to be a larger growth driver. That’s true.

Next question comes from the line of Joshua Tilton from Wolfe Research.

Can you hear me?

Yes.

We can hear you just fine.

Look, I just have one for me. And I guess I heard the prepared remarks, especially around the guidance. But just maybe help us get a little confidence around your confidence interval on the applied second half net new ARR. I understand you guys talk to strength in consolidated offerings, which was 40% of net new ARR this quarter. But we're talking about pretty small numbers for net new ARR in the first half versus what's implied in the second half. It kind of feels like the rest of the business needs to pick up to hit the numbers you're talking to. So just maybe help us gain a little bit more confidence around your decision to reiterate the full year's ARR outlook today.

That's great. If you really look at it, I think while you're right on the first-year half of guidance, Q1 was really poor in terms of performance. Our big question was to stabilize in Q2 and have a stable outlook for Q3. We feel very good about that. In addition, in Q4, we have just more longer-term deals in there. We have a little bit more in the bank going into Q4. But really, what you're talking about is getting back up to a little bit above a flat year-over-year net ARR from last year. We feel good about that trend line. Frankly, from the Q1 spot to the Q2, even though it was a small number, getting that momentum back and having that outlook be stable for Q3 was the trend that we're actually looking to achieve. That puts us in the guidance range, and actually, we feel comfortable about landing in the guidance range right now.

Yes. Corey, in your prepared comments, you talked about the strength in the partner pipeline build up 15%, which year-over-year, was up from Q1. So we are seeing the momentum on that side. We know that Q4 has historically always been a strong quarter for us, and we anticipate that again this year.

But even that, we expect it to be relatively stable from last year, and we're seeing enough momentum and build for that.

Just a very quick follow-up on my end. Can you guys provide an update on the IDR business? Has that kind of been a shining light for you guys over the last two quarters?

Yes. IDR is much higher in the preference stack, and it’s been the biggest contributor to overall growth this year. We see demand there, and in fact, we are working to expand our IDR services. Customers are looking for us to do more from a detection response perspective. We see that as a big opportunity, not just now, but over the next several years.

Yes, Corey, we didn’t break it out this quarter, and maybe we have in the past. But we both said in our prepared comments, it’s really been an anchor for us, a very strong positive anchor, and it grew very nicely in the quarter.

Your next question comes from the line of Charlotte indiscernible on for Brian Essex.

I know you gave some color in the prepared remarks, but could you expand a little bit about the platform customer count versus your total customer count and how that's trending? And if you're seeing better traction in the enterprise and different aspects like that, that would be really helpful.

Yes. I think in the past, we've broken it out. Look, we continue to see fall off of our small dollar transactional customers. Our platform customers grew faster than that. You can think about mid-single digits in terms of that, which was in line with expectations and healthy. We always want to grow customers, but we're happy that the growth is coming on the platform side. We think that sets us up for better long-term growth.

Yes. Corey, it was up sequentially and year-over-year on the platform side, and it’s the lion’s share of the customer base, and it’s performing well.

Your next question comes from the line of Rob Owens of Piper Sandler.

Corey, I wanted to ask about the overall VM space. Do you perceive the growth challenges you and your peers are experiencing as cyclical or more as a longer-term trend?

Yes. We have been focusing on enhancing our platform for some time because we recognize the pressure and strategic importance of vulnerability management. It is essential to intentionally elevate our value proposition, starting with detection response and now expanding to our overall Exposure Command offering to address the most critical challenges for our customers. Ultimately, our priority is the customer. While vulnerability management addresses a problem, its significance is diminishing in strategic terms, which is evident in the market. Although we remain concerned about this shift, we still regard vulnerability management as a vital component of our solution, though it is not a stand-alone offering. We anticipate that stand-alone solutions will continue to face challenges. However, by addressing broader visibility, risk, and understanding of the attack surface, we believe customers will find value. We are witnessing positive initial momentum and are closely monitoring its progress.

The next question comes from the line of an anonymous caller from Morgan Stanley.

I want to dig in a little on your commentary on pipeline generation by partners. Nice to see that it was up 15%. Last quarter, you indicated that the contribution from the new focus was not yet making up the contribution lost from you deemphasized. I was just wondering if you can comment on how that trended this quarter, and to what extent that gap was closed compared to last quarter. As we look ahead, how should we think about maybe the timeline for that to sort of breakeven?

Yes. As part of the – some of the changes we actually made, it's something that I’m paying a lot of attention to. I’ll say that we saw it stabilize and grow better than it has in a while in the quarter. But we are looking to manage it to grow faster. The partner stuff takes time. That’s a core sort of part of the transition period, and we feel we’re on the right trajectory there, enough so that we’re actually increasing our investment allocation to the partner ecosystem because we’re seeing the yield and the results there. Really, what we’re focusing on is how do we execute against this year’s targets but also how do we build that momentum entering next year. I’ll just say it’s trending the right way. Of course, like everyone else, we want to see more sooner, and we’re managing our investments in pursuit of that path, but we’re seeing the right direction.

The next question comes from the line of Mark Cash of Raymond James.

This is Mark on for Adam. So Corey, if I could start with you. Some exciting changes on the product front are happening. While those just move to regional go-to-market structure are not reflected in your overall results – so are those changes related? Or was the move to regional sales structure something that's already being worked on? And why move to that structure?

Yes. The changes to actually the regional sales structure were being worked on before. We have been looking at how to align land, expand, retain businesses, and drive not just efficiency but especially since we have more partnership business, to make sure we’ve actually had more alignment there. So that work was already underway, and our previous Chief Commercial Officer did lots of homework working with the regional sales leaders to help bring that plan forward and make it a reality. The reason for it was not just an efficiency thing; it was also execution on how do we actually make sure that we're upgrading our installed base to the new Command Platform in a timely fashion while working and expanding our partner ecosystem.

Okay. And Corey, if I could ask – I’m sorry, maybe actually for Tim, if you don’t mind. I guess you generate $150 million to $160 million of free cash flow this year, substantial margin improvement year-over-year. So how are you now thinking about rank ordering the uses of cash that you have this more durable statement of cash coming to the business?

Yes. In terms of capital structure use of cash. Our first priority is to make sure we always have enough cash to run the business; which has never been a problem; I would call that a couple of hundred million that you'd leave on the balance sheet. Corey and I have talked very publicly about one acquisition per year to have the room to do that, similar to the acquisition, we welcomed the Noetic team to Rapid7, which is a tech and team, a smaller-sized deal. So I would call all of that priority number one. Our second priority is we’re very mindful of the debt stack that we have, and we have plenty of time to manage that accordingly but ultimately, to repay the debt. I’d put it in that order of priority.

Our next question comes from the line of Michael Romanelli from Mizuho.

Yes, this is Mike on for Greg. Maybe two for me. I guess, just firstly, from your perspective, have you seen any change in customer behavior since the CrowdStrike IT outage very recently? And then just on average discounting rates. So what do they look like in Q2? Were there any changes sequentially?

Look, the CrowdStrike was a big deal for our customers and for the security industry in general. It took a lot of time, and people put heroic efforts in to get their business back online while they were staying secure. We have overlapping customers, and we were trying to ensure that we supported our customers. While systems are back online, I think that took a lot out of security teams. I think that was probably the bigger pressure point. I think it's too early to know anything else. But security and IT teams put in herculean efforts, and I think it really matters, and they should be appreciated. Your second question, remind me what it was again?

Just on relative discounting and...

Relative discounting. I don't think we saw anything material on the relative discounting.

Our next question comes from the line of Kingsley Crane.

This is Zach Schneider from Baird. I wanted to ask about upselling to existing customers and how you plan to maintain that momentum despite budget constraints and longer sales cycles. Could you discuss any specific initiatives being put in place to enhance customer engagement and increase upsells? Also, how are you addressing customer concerns about pricing and return on investment?

Yes. Absolutely. Look, we have what I think is a very high ROI story. We saw a big problem for our customers with relatively modest and reasonable incremental spending cost. We think that formulation has the impact of making it easier for customers to say yes, making it easier to secure existing renewals because we’re prioritizing a lot of incremental value for what’s a relatively modest incremental price point. We’re taking that out to all our customers. The initial feedback has been good, but we’re in the early stages of taking that strategy out, and we think we’re set up well for success. But again, we want to make it really compelling. That’s why we did not pick like others a purely monetization strategy, which is about the company, we make how we solve the biggest possible customer problem at the most reasonable economics.

Our next question comes from the line of Trevor Rambo of BTIG.

This is Trevor on for Gray Powell. Congrats on some nice results. Maybe dovetailing off a question before, but what needs to happen for ARR growth to improve back to double digits over the next year or so in terms of growth, what levers do you guys have at your disposal to get there? Is that something more of Exposure Command gaining traction? And when should we think about that becoming a possibility at this point?

It's still early to discuss specifics for next year, but I can address the levers we have. We have unmet demand in detection response that we need to communicate to our customers. Our team has worked on expanding our offerings and customers are expressing their needs. One focus has been the Command Platform, Exposure Command, which we believe positions us to tap into higher-value areas, much like cloud services and attack surface management, where customers are willing to invest compared to traditional vulnerability management, which is less of a priority. We are in sectors where customers are ready to spend, and we offer strong overall value. We're also introducing some add-ons for our existing customers. This aligns with our ongoing investments in the partner ecosystem to enhance scale and improve alignment across our business. With the proper strategic focus on detection response and our updated Exposure Command, we are becoming more strategic in managing risk and visibility. We have good momentum in that area and will continue to increase our investments. We’re seeing positive traction and are dedicated to empowering our team, which is well-equipped to handle this. These factors can help us gain traction as we approach next year; it's still early, but we are optimistic about our setup. However, we need to capitalize on the favorable pipeline trends we observed that stabilized and improved in Q2.

Our last question comes from the line of Rudy Kessinger of D.A. Davidson.

I want to come back to just some slides net new ARR in the second half. I mean, it's 4x as much net new ARR basically implied in the second half versus the first half, at the midpoint of the ARR outlook. I know you've given a few comments, Marketplace pipeline up 15%. They get 4x the net new ARR. So just can you give some commentary on the overall pipeline for the second half relative to the first half? Is there any other assumptions in the outlook such as maybe improved gross retention that might be helping drive some of the sequential improvements here? Or just any other color you could provide would be very helpful.

Yes, two quick things. One, it's a primarily Q1 dynamic, not the linearity exiting Q2. I would just point out that you talk about 4x in the second half; it was 7x in Q2. When you have the Q1 that we had, the numbers don't make any sense. You could have said 7x in Q2 was going to make sense either. It's the traction and the rate of improvement. We're back on a healthy rate of improvement. Yes, Q1 was bad, but I think we actually normalized and stabilized things in Q2. And to get to your quarter question, which is actually really good is that we didn't leave the guidance range the same just to leave it the same. We took a very detailed look at our pipeline. We believe from the pipeline and the data that we're seeing today that we're going to be in the guidance range that we indicated. Those are the two considerations I wanted to share. Thanks for the question.

Yes, okay. And then just as a quick follow-up, if I could, just on the new logo side. Yes, on the new logo side, I saw it looked back to positive quarter-over-quarter. I guess, just any comments on new logo bookings in Q2 relative to expectations?

So I would just say with any expectation, look, Q2 was a quarter that we expected to normalize. We saw normalization. I would not say it was a whole quarter. I’d just say that Q1 was a bad quarter; Q2, we expect it to actually get back to business and normalize it, and it normalized. We saw very healthy traction and normalized traction on the platform side. We gave the number about mid-single digits. We saw us getting back to positive net overall customer growth. That’s kind of where we expect it to be in a healthy normalized environment. The primary thing I'm focused on right now is introducing the product to our customers, our new products to our customers, and building pipeline not just for the back half of the year, but as we go forward. Thank you very much. And operator, are there any other questions?

There are no more questions.

All right. With that, I want to thank everyone. I know there are lots of dynamics happening, but I really appreciate the questions and the support. I think we're in an exciting time. We've been executing our product strategy. We're taking that out to our customers. We've been intentionally focused on investments that are going to set us up for the next several years, not the past three years. So I appreciate everyone's time and attention. Thank you all.

Thank you.

Ladies and gentlemen, that concludes today's conference call. Thank you all for joining. You may now disconnect.