Rapid7, Inc. Q3 FY2024 Earnings Call

Hello, greetings, and welcome to the Rapid 7 third quarter 2024 earnings conference call. All participants are currently in a listen-only mode. Later, we will conduct a question and answer session. To ask a question, please press star followed by the number one on your telephone keypad. If you would like to withdraw your question, again, just press star one. As a reminder, this conference is being recorded. At this time, I would like to turn the conference over to Elizabeth Schwach, Senior Director of Investor Relations. Please go ahead.

Thank you, Operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's third quarter 2024 financial and operating results in addition to our financial outlook for the fourth quarter and full fiscal year 2024. With me on the call today are Corey Thomas, our CEO, and Tim Adams, our CFO. We have distributed our earnings press release over the wire, and it is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast and following the call, an audio replay will be available at investors.rapid7.com. During this call, we may make statements related to our business that are considered forward-looking under federal securities laws. These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to the company's positioning, strategy, business plans, investments, growth drivers, financial guidance for the fourth quarter and full year 2024, and the assumptions underlying such goals and guidance and our expectations regarding 2025. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ material from the future results expressed or implied in these statements due to a number of risks and uncertainties, including those contained in our most recent quarterly report on Form 10-Q, filed on August 7, 2024, and our most recent annual report on Form 10-K on February 26, 2024, and in the subsequent reports that we file with the SEC. The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call except to the extent required by applicable law. Our commentary today will primarily be in non-GAAP terms, and reconciliations between our historical GAAP and non-GAAP results can be found in today's earnings press release and on our website at investors.rapid7.com. At times, and our prepared comments or in responses to your questions we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results please be advised that this additional detail may be one time in nature and we may or may not update these metrics in the future with that i'd like to turn the call over to our ceo corey thomas corey thank you elizabeth and

welcome to everyone joining us on the call today rapid 7 ended their quarter of 2024 with 823 million dollars in ARR while delivering revenue and operating income above our guided ranges. A threat detection response business which remains an area of strength and durable double digit growth continue to drive the majority of our growth in the third quarter as our robust capabilities deep expertise and investment innovation continue to support a proven world-class detection and response experience for our customers. There is positive momentum across our business and this is a key pillar that undermines our compelling opportunity to re-accelerate growth. Our Q3 ARR results also reflect customer budgets that remain in flux, especially around the time it has been. We saw deal cycles continue to elongate with additional levels of approval for the release of budget dollars, particularly for larger deals in North America. These longer deal cycles remain broad-based across mid-market and large enterprise customers. This change put modest pressure on new AR in the third quarter, driving an ARR result slightly below our expectations. We have extrapolated these dynamics into the fourth quarter and coupled with the growing mix of large deals that we expect towards the end of the year, we're lowering our 2024 ARR outlook to a range of $835 to $845 million. Now, I'd like to give a broader overview of where our business is and the great progress we've made this year on product and service experience for our customers. Vendor consolidation continues to be a strong secular theme across software, especially in security operations where the market remains fragmented. Our consolidated offerings are addressing this market-wide customer pain point as security teams look for better outcomes and stronger value propositions. We continue to see strong demand for our consolidated offerings across both threat detection and risk management, which together have scaled to make up over $175 million of ARR. Additionally, the average ARR per customer for customers who own one of our consolidated offerings is roughly $150,000, highlighting the meaningful revenue opportunity for both new and existing customers that expand across our broader SecOps platform. Exposure Command, our recently launched consolidated risk management solution, has also shown encouraging early progress. We introduced the command platform at Black Cat Conference in early August, and with less than two months in the market, we have generated over 70% more pipeline for the overall risk management business compared to the second quarter of this year. When I refer to the risk management business, that includes our full suite of cloud security, vulnerability management, and attack surface management solutions, including Exposure Command, that help customers manage and prioritize risk across their attack surface. As expected, Exposure Command is gaining steady traction as customers seek to improve visibility across their attack surface while consolidating on an integrated platform at a compelling price point. Over time, we expect the average ARR from risk management customers to grow, driven by product expansion within the category, as well as expanding scope of coverage of their environment. As an example of the early success we're seeing in Exposure Command is a six-figure ARR deal that we closed during the quarter with a technology company looking to track all of their cloud assets in a centralized automated way. Rapid 7.1 against three well-known cloud security players based on our proven use cases, added business context where the customer's attack surface and the ease of use of the command platform's user experience rapid 7 was able to offer the customer multi-cloud data in one place and the single source of truth is critical in removing constant manual workload for an under-resourced security team we started 2024 with a clear set of priorities and three primary focus areas innovating to deliver world-class detection response experience to our customers expanding our partner ecosystem for scale and efficient demand generation and accelerating cloud security adoption. We knew this would be a product investment year for us and an opportunity to establish leadership in future growth markets for security operations. We made the decision to prioritize our investments in customers' product and services experience while being more measured on investments in sales and marketing. As we near the end of the year, I am pleased with what we accomplished in these areas. The work we have done this year provides a critical foundation to our success, and we continue to believe these investments will position us for better long-term and durable growth. First, our detection response business continues to drive healthy momentum, particularly for customers looking to extend their SecOps capabilities with our managed services. Our commitment to driving innovation within Insight IDR is creating a stronger value proposition for our customers who increasingly need a centralized, actionable view of the environment. There are a number of specific reasons that security teams are choosing Rapid7 to better pinpoint threats driven by our vetted and expanded detection library which provides relevant and timely insights from Rapid7 security operations center open source community and threat intelligence teams for better ability to scale and reduce manual attacks with embedded automation and ai for stock efficiency particularly during the alert life cycle and for the ease of use of our integrated platform with growing coverage and ability to ingest and analyze third-party security data. Additionally, the breadth and depth of the Rapid7 platform continues to be a competitive differentiator in a market that is still quite fragmented. Our leadership in the space was validated by recent vendor assessments by IDC, which positioned Rapid7's Insight IDR solution as a market leader in SEM solutions for both SMB and enterprise. Security teams of all sizes are leveraging our core SEM capabilities as part of our broader detection and response platform to gain comprehensive and contextualized view of threats across their environment. The second major area of focus for this year has been on expanding our partner ecosystem for scale and efficient demand generation. We've made substantial progress, and there's still a long runway of opportunity here. In the third quarter, 90% of new ARR bookings were sold through our partner ecosystem. This achievement marks a significant milestone and underscores our dedication to collaborating with our partner community, aligning with purchasing channels many customers already use to source their security solutions. As we remain committed to advancing our partner programs and experience, this quarter we introduced the Rapid7 Partner Academy, which equips our partners with technical expertise around the command platform. This program is designed to educate our partners quickly as we innovate and is particularly beneficial as we've recently delivered a series of important launches. We're also enhancing the partner experience through the recent launch of our channel partner portal, which supports streamlined engagement and a smoother sales process overall the progress in this area demonstrates our dedication to seamless interaction collaboration and business growth for our rapid 7 partners lastly our push to accelerate cloud security adoption is well underway our strategy is resonating strongly with customers by bringing cloud security capabilities into a broader platform that provides customers a high quality integrated view of their broader attack surface the launch of our command platform, including Exposure Command, has been extremely well received. As I mentioned earlier, we increased our quarterly pipeline creation by over 70% on a sequential basis for risk visibility and exposure management. The positive early feedback we're hearing from the market is concentrated around a few major themes. The command workflows and user experience stand out from the current market offerings, particularly by our ability to aggregate diverse range of of third-party security data into a single source of truth. This integrated platform experience for cost-effective management of an organization and a tax service is a clear differentiator for Rapid7. Second, customers like our improved cloud risk prioritization and visualization tools, which allow them to assess risk in the context of prevention gaps, including allowing security teams to monitor toxic combinations, provide guardrails for secure AI development, and view executive level risk reporting. And thirdly, many customers lack a firm grasp of the assets across their hybrid IT environments, with Gartner estimating that less than 20% of organizations can clearly identify and inventory a majority of their assets. Our integrated asset discovery capabilities bring crucial visibility for attack surface management and speak to a common pain point for customers of all sizes. Additionally, our MSSP partners, which have historically been focused mainly on detection response, have shown strong interest in our new exposure management offerings. Though we had a slow start to 2024, we've since taken the right steps to focus on our strategic priorities. I am proud of how our team has executed over the last six months to improve the foundational aspects of our business, and we see clear signs of progress and momentum, particularly around the command platform. As we look out to the next year, there are plenty of promising indicators on the horizon. The investments and focus areas of this year have made a meaningful impact in our ability to go to customers with the best possible security operations platform, and we are already seeing tangible proof points of distraction. We expect to start 2025 with a stronger pipeline than last year based on how demand generation is currently trending and we continue to believe that our risk visibility and exposure management offerings will be meaningful long-term drivers of growth for us we also have more work to do to successfully convert positive customer feedback and early pipeline traction for the command platform into material contributor of new arr as we look ahead to the next year we're taking a measured approach with respect to both the timing of when that contribution materializes and when we will see customer budget stability and consistent deal cycle timing. While we expect to provide formal guidance on our February earnings call, our early expectation for 2025 is that our total ARR growth rate for the year should show flat to mild acceleration in growth from our 2024 exit growth rate of ARR. That view assumes continued longer deal cycles particularly for large deals in managed detection response and relatively stable demand environment. The strong fundamentals of our business are intact and we are creating a broad-based platform of integrated security operations solutions that will have long-term product relevance in a dynamic market environment. In the meantime, we plan to continue making shifts in our business model amidst slower near-term growth by evolving our products to be leaders in their specific categories, by evolving our pricing model to align to customers' priorities and budget capacity in these areas, and by remaining focused on scaling free cash flow across our business. Thank you for joining us on the call today. I will now turn the call over to our CFO, Tim Adams, to share additional detail on our financial results and outlook. Tim? Thank you, Corey, and good afternoon to everyone

on today's call. Thank you for taking time to join us today. Before I turn to our results, a quick reminder that except for revenue, all financial results we will discuss today are non-GAAP financial measures unless otherwise stated. Additionally, reconciliations between our GAAP and our non-GAAP results can be found in our earnings press release. Rapid 7 ended the third quarter of 2024 with $823 million in ARR, representing 6% growth over the prior year. This ARR result reflects the continued strength in our detection and response business, as well as elongated deal cycles, particularly for large deals in North America. ARR growth in the third quarter was weighted towards sales expansion as ARR per customer grew 4% over the prior year to $71,000. And our total customer base grew 2% year-over-year to end the quarter with over 11,600 customers. Third quarter revenue of $215 million grew 8% over the prior year and exceeded our guided range. Recurring product subscription revenue grew 8% over the prior year to $206 million, which was better than expected on favorable linearity in the quarter. Our revenue mix continues to shift towards international, which grew 17% year over year and now represents nearly a quarter of total revenue. Turning to our operating and profitability measures for the third quarter, product gross margin was 76% in the quarter and total gross margin was 74%, both of which are in line with the prior year. Sales and marketing expense was 31% of revenue, down from 34% in the prior year. R&D and G&A expenses were in line with the prior year and made up 16% and 6% of revenue, respectively. Third quarter operating income of $44 million dollars was above our guided range and represented a roughly 21 percent operating margin. The outperformance was driven by higher than expected revenue and the timing benefit of a few million dollars in professional services and marketing spend which we expect to incur in the fourth quarter. Adjusted EBITDA was 50 million dollars in the quarter and net income per diluted share was 66 cents. Moving to our balance sheet and cash flow, we ended the third quarter with cash, cash equivalents, and investments of over $500 million, slightly above the $494 million at the end of the second quarter. We continue to ramp up our free cash flow generation with $39 million in the quarter, up from $29 million we reported last quarter. This brings us to our outlook for the rest of the year. We now expect full year ending ARR to be in the range of $835 million to $845 million, which represents growth of 4% to 5% over the prior year. We have adjusted our outlook for the remainder of the year based on the elongated sales cycles we saw in the third quarter and have carried forth our assumption that these customer budget dynamics will continue through the rest of the year. For full-year revenue, we are raising and narrowing our range to $839 to $841 million, representing growth of 8%. This increase from our prior guidance of $833 to $837 million reflects revenue outperformance in the third quarter. On profitability, we are raising and narrowing our full-year operating income range to $157 to $159 million from our prior guidance of $152 to $156 million. Our updated range represents an implied operating margin of 19%, growing over 550 basis points from the full year 2023. We expect full-year net income per share to be in the range of $2.28 to $2.31 based on an estimated 74.7 million diluted weighted average shares outstanding. For free cash flow, we are updating our full year expectation to a range of $145 to $155 million based on our updated ARR range. We remain strongly committed to expanding profitability. Moving to quarterly guidance, for the fourth quarter of 2024, we expect total revenue in the range of $211 million to $213 million, representing growth of 3% to 4% over the prior year. Non-GAAP operating income for the fourth quarter is expected to be in the range of $33 to $35 million, reflecting an implied operating margin of 16%. We expect non-GAAP net income per share of $0.48 to $0.51, which is based on 75.7 million diluted weighted average shares outstanding. I would like to thank our team for the great work they have accomplished so far this year, especially on the foundational improvements across our detection and response business, our partner ecosystem, and our push to drive cloud security adoption. The early traction for Exposure Command is encouraging, particularly as it relates to the pipeline growth we saw in our risk visibility business during the third quarter. As always, we remain focused on balancing these growth initiatives with profitability improvements in what continues to be a dynamic market environment. With that, we will now open the call for questions. Operator? Just as a reminder, for

Q&A, if you'd like to ask a question, simply press star followed by the number one. Our first question comes from Satima Bulami from Citi. Please go ahead. Oh, good afternoon. Thank you

for taking my questions. Koli, you talked at length about some of the external dynamics that are contributing to, you know, improved customer feedback and receptivity to the launch of the command portfolio and then just general, you know, strong feedback. But I wanted to reconcile that with, you know, the results and some of what you're baking into the guidance, right? And specifically, I wanted to ask you on internal dynamics, do you now have had a full quarter of that organizational streamlining that you undertook in terms of the organizational structure. So can you give us a sense of what some of the proof points of success are there and why maybe that's not moving the needle and overcompensating or at least counterbalancing some of these external dynamics on sales cycle elongation? Thank you.

Yeah, thanks for the question. So look, there's two focus areas internally that we actually had. And one of them was just to make sure we have rigorous processes so that we can actually forecast and deliver consistently and well. The second one was making sure we executed our launch of the command platform and Exposure As you know, we've been relying on this year on this legal sort of like focus around DNR, which is reformed very, very well, but at the same time, we need to actually launch our updated strategy for the risk management business with our integrated risk strategy. So the launch of that has been a primary focus area, and I would just say the execution's going well there. If you zoom out, you say, all right, how does that translate into results is that we built back up the pipeline, frankly exceeded the targets that we actually wanted to see. But most of our pipeline for this year, we told you that the core thesis was going to be around the D in our business, of which we have substantial pipe, but there are larger I think this is maybe the first time in our history where we've had over half of our pipeline deals before that are over the hundred thousand dollar mark and so with the elongation of the scale cycle a higher mix of larger deals and what we saw both in q2 and q3 is our primary focus was making sure that we were actually being thoughtful about what sales cycles were for the pipe and then you know sharing that information can move you off i think i got all of you thank

And our next question comes from Aked Kalia from Barclays. Please go ahead.

Awesome. Thanks for taking my questions here, Corey and Tim. Thank you very much. Corey, maybe just – hey, guys. Corey, maybe just to start with you, you know, in your prepared remarks, you talked about higher ARR per customer for those that buy bundled or rather consolidated offerings. Could you just dig into that a little bit? I think you mentioned 150,000 number. I'd love to just dig into that a little bit. And maybe more broadly, can you just talk about what percentage of the base is sort of on that kind of consolidated type of offering?

Yeah, it's roughly, you know, $150K, as I say in the prepared remarks. It is, frankly, led by DNR. So if you think about so far, like lots of the consolidation strategies have been led by the detection and response business. It's an area where we actually have robust hype. Now, if you look at DNR and now with Exposure Command, which is, frankly, a much better consolidation story from WISC than what we had previously. And we've taken lots of the process and learns that we actually have from last year. That said, we still think we have significant amount to actually go in our base. I would say of our base, I would say a little over 10% or so of our base is on one of the consolidated offerings. And we're having steady adoption, steady uptick in pipeline. But those deals are also larger in orientation and therefore have longer deal cycles.

Got it. That makes sense. Maybe for my follow up for you, Tim, appreciate the early look at 2025. 25, I think that's prudent. Maybe the question is, how do you think about the mix of sort of customer growth versus that ARR per customer dynamic, even qualitatively as you think about

that preliminary outlook? Yeah, Saket, thanks for the question. Look, I think we have the opportunity on both fronts to continue to grow. We have over 11,000 customers today. We think that market opportunity is roughly 70,000. So there's always room to expand with new logos. And to Corey's earlier point, when you look at the strength that we're seeing in the consolidation offers, they do come in at a higher ARR per the average of around 71,000 that we see on customers. So by selling into the packages, certainly the strength of MDR being larger deals gives us opportunity to do the expansion. And even to Corey's earlier point on exposure command, if you think of that as a great way to land with new customers, and then you have that upsell, cross-sell opportunity with MDR with those customers. So I think you can see it from both new customer acquisition and expansion of customers as well. Super helpful. Thanks, guys.

And real quick, just to make sure we get to everyone in the queue, we do ask that you limit yourself to one question at this time. Our next question comes from Matt Hedberg from RBC. Please go ahead.

Thanks, guys, for taking my question. Maybe I'll just double click on the guidance portion as well. You know, it seems like you're taking a conservative initial approach to the framework of what seems like maybe kind of mid-singles to maybe slightly better growth next year. I'm curious, Corey, you know, are there things that you can do from a go-to-market perspective, you know, that could combat elongated deal cycles? Like one thing, it certainly seems like you're getting a lot of channel momentum. i'm kind of curious as you think about company specific things that could combat some of these macro pressures i'd be curious on kind of how you think about that yeah i mean look the primary

thing that we're actually focused on is we like the dynamics that we have both in the consolidation offers and the dnr attraction there are larger deals i would just say customers have their own specific budgets um dynamic their budgets they never so we want to keep the good what we want to add to that is i would just say more velocity business as we actually term it which is you can think about that more sort of like upgrades upsell motions uh in the install base i think that's the upside um we do have that i mean that's the thing exposure command has we start to see that in the pipeline but it's definitely premature to actually sort of like take pipeline and actually predict conversion rates and how much of that flows through so i just think it's just too early but But that is our strategy for actually keeping the good stuff where we have the larger deals, increasing share of wallet, healthy dynamics hiring the stack, but adding in a mix of velocity deals that are at lower ASPs and frankly balance out some of the large deal momentum that we Thanks, Corey.

Our next question comes from Joe Galwell from Jefferies. Please go ahead.

Hey, guys. Appreciate the question and appreciate the deal cycle elongation commentary. Terry, is that broad-based or are there some areas of the platform that are most impacted? I know you don't give updated mixes, but just any sense of the growth rates for the different segments? And then maybe on the reverse, like the gross retention side, was there any impact on the core vulnerability management or have a gross retention rate stayed stable? Thank you.

Okay. That was a lot. So I'm trying to make sure I got all of it. So on the deal cycle elongation i think it's it's primarily large just i would say it's less product based but deal size based like when you become a material part of someone's budget in this budget environment we're just seeing customers sort of like there's a gap now between sort of like you're recommended and a customer says they're going to go with you and how long it takes them to actually figure out like when the budget dollars are going to land so that's kind of how i would describe it and we are like i would just say being cautious and thoughtful about like our expectations for the year and just keeping consistent with what we've seen overall um as you can imagine is that it's still primarily that's just because you know the exposure command pipe is actually new you know we would expect the same six-month deal cycle so early in that cycle so things that is more dnr weighted so you ask sort of like what's happening and the growth rates in dnr um continue to be strong uh and we expect them to stay strong as we actually go forward um and then the last one is the gross retention rates. I think that's probably a relationship. Earlier in the year, we had highlighted that we were seeing some gross retention pressures. Those feel like those are actually are in the process of bottoming out. I would just say the early indicators that we're seeing around those are actually quite positive. Now, part of that is that customers are seeing what we're doing around the exposure command that are the VM customers, and they do like the strategy. And so we're starting to see early confirmations around that. But I would just say that the we think on net the gross retention trends are positive to up uh we feel good about those as we go forward i think i got all the questions you did that was really helpful thank

you thank you our next question comes from the line of hamza fooder wallah from morgan stanley

please go ahead good evening thank you for taking my question um for corey or tim just um you know there's been a lot of improvement in their profitability side um in the last few years You're close to 20% free cash flow margin. Obviously, you want to accelerate your growth for 2025. I know we're not providing the full formal guidance, but as you think about that balance between growth and profitability, should we expect to see additional leverage going forward or is the focus going to be more around investing more for growth?

Yeah, look, the clear focus we actually have right now, you think about it, we started you know last year we shifted to driving consolidation i would just say we did good in one part of the business the um threat detection part of the business uh we felt like we did not we have we thought we had room to improve on the overall risk side of the business this year we invested in the products and the offering around risk while continuing to expand profitability we've actually built pipeline we're seeing good early indicators we feel like the setup next year is focused on the growth rate acceleration so that's the core focus of the business as we actually go forward next year. We think that it's a good time to do it because we actually have the products, you know, the products set up well, the feedback from customers and sales team. We're not out over our skis in terms of the expectations, just because, you know, right now, early indicators are good, but they're still early indicators. So, you know, my expectation is that like, you know, we're happy with the profit dollar range that we're in. We certainly expect to see more free cash flow dollars as we actually go forward but the real focus that we actually have is re-accelerating growth of the product base that we actually have today thank you our next

question comes from the line of rob owens from piper sanley please go ahead great thanks for taking my question corey in prepared remarks you did talk about shifts in the business model and particularly on pricing and in the q a you did talk about increasing velocity business does it

speak to that or is there something else afoot if you can maybe elaborate thanks yeah i i think

they're they're interrelated you know when we look out in our customer base we've done a really good job again tied to the threat detection business of actually sort of like um just actually i would just say executing i would say on larger deals larger business becoming more strategic for our customers that's evidenced by the business that we have there the thing that we actually have not done a good job of is how do we actually get the 20 30 upgrades uh and uplifting the install base you know in the old days we used to get a little bit of that from the people adding more vm assets uh overall um but we didn't get we did not get enough of that share originally as people moved to the cloud now part of what we actually found there was that you know the cloud pricing was high we wouldn't look at our install base lots of our customers just don't have any solution at all and And so what we flipped around there is said, how do we actually monetize, I would just say share of wallet and risk management in the install base with a more integrated value proposition that's centered around the attack surface source of truth from the endpoint to the on-prem to the cloud environment, and how do we monetize and upgrade the install And so that's the strategy there, Rob, is sort of like making sure that we actually don't become just a business that does large DNR deals from a sales focus and from an offering focus because that's not our sales team that's more of our offering strategy i feel like we really nailed i mean so far the feedback very early but we've nailed that with exposure command where it's the first time we kind of upgrade to our vm install based customers it also makes the customer stickier because they like the strategy that we're actually doing it also allows us to actually add more assets for customer from a cloud perspective and it's a stickier solution to vulnerability management you know vm was about scan and report or collect data and report and And this is about sort of like collect data, but integrate data and become the attack surface source of truth in the environment. And when you are a system of record in the environment, it's just a much better, much stickier value proposition. So, Rob, that's more what we're talking about is how do we actually sort of like have more offerings that are not just the bigger ASP will be executed well. Again, this is the first time I think half of our pipeline is over 100K deals. And that's okay, but we really do want to keep a lot of that velocity of business.

of color thanks our next question comes from the line of gray powell from btig please go ahead

great thanks for taking the question um i just want to make sure i understood uh some of the commentary correctly uh so when you say the pipeline for risk visibility and exposure is up 70 from q2 we just can you help us think through like what the base of comparison is there for For example, is it 70% growth off of a small number, or is risk, visibility, and exposure a more meaningful part of the pipeline at the end of the quarter? Yeah, just any additional detail there would be really helpful.

Yeah, thanks for the question, because it does help clarify. So to the dual call this year, as we were retooling and upgrading our strategy around risk management to move from the CRC or stroke, so really I would say an integrated product platform approach. um we stopped selling and building pipe on that so like you know you could think about sort of like that really going down um precipitously sort of exiting last year and coming into this year which puts i would just say more pressure on growth than we probably anticipated overall uh and so what that signifies is one is now we're actually wearing back up that risk business overall so while it's up quarter over quarter most significantly um it's actually back sort of at the levels that it was sort of like in the middle of last year for the risk business and most importantly, the total pipeline has actually sort of like bottomed out its deceleration in Q2. It actually has steadily risen up and then accelerated in Q3 as we actually move forward. So what we've also seen is just overall pipeline generation improving, and that's what we're really focused on. It's a contributor. By the way, it is the best contributor because DNR stayed within its ranges of expectations, but we really have to recover that risk management pipeline generation. And we've actually seen that. And again, the early sort of like data and conversions are pretty good. So, I think I can capture that. Okay. That's a really helpful color. Thank you.

Our next question comes from the line of Greg Moskowitz from Mizzou. Please go ahead.

Okay. Thank you for taking the question. Hi, guys. This is maybe a bit of a high-level question, and you may have touched on this a little bit in response to Rob's, but all of us on this call are you know as we're all aware there are many security platforms out there corey and to be fair several of them are a lot bigger than rapid seven you know what gives you the confidence that rapid seven can be one of the real longer term winners uh as a security consolidator thank you

no look i think that there's two approaches to if you're going to be a one i think you're right like if you're a niche player it's going to be hard uh and there's two approaches that you can actually have for consolidation you can be a general consolidator of which i think lots of the companies you talk to are general consolidators they have lots of stuff across a wide breadth of overall security and they're using the you know customer relationship to try to deliver um or you can be a focused consolidator and and if you're a focused consolidator what you really say is we will be best in the world at this and we will do it at better economics than anyone else We're focused on being a focus consolidator. What we're best in the world at is security operations consolidator. We collect more data from more systems than anyone else in the world. No one's actually processing data across the on-prem with the traditional modeling technologies, the cloud technologies, the endpoint data collection. And oh, by the way, we process data from every other select security delivery provider. No one processes more data, integrates more data to actually paint a picture of the attack surface and then takes that data and then uses to monitor the overall environment for tax. Security operations is about, do you have the data to paint a picture of your tax surface? And then can you monitor that tax surface for tax? We actually have been investing in this for longer than anyone. We're still like the most comprehensive, even if you compare every single player on the market today. And we do it with better scale, better customer economics and better value proposition. That is still resonating with customers. And again, if you dig into it, what you see is in many ways, we've actually executed and continue to do better and go faster than the market in the hardest part of it, which is the going up market with the DNR stuff. We're just adding back on the risk piece, but we're adding it back on from a rebuilt risk engineering that's more about integration and the integrated attack surface than it is about the traditional vulnerability management approach. But that's the approach that we actually have that we think wins. It's a focused consolidation effort.

Thanks, Corey.

Our next question comes from the line of Jonathan Hough from William & Blair. Please go ahead.

Hi, good afternoon. Just wanted to see if you could give us a little bit of additional color on what you're seeing in the MDR space and, you know, with your own managed offerings as an add-on. And just how meaningful could this be as you start to think about, you know, trying to expand wallet share within your own customer base? And just similar to that, if you could talk a little bit about, you know, what's happening on the Insight IDR side, you know, whether any of the consolidation that's been happening in this space is, you know, starting to show benefit there as well.

Yeah, we are showing, look, part of the DNR backdrop is driven by the detection response product and the MDR service. Look, from our benchmarks, we have one of the highest quality MDR service in the market. It's backstopped by incredibly strong retention rates compared to the overall market. We are one of the few product companies that actually built and continues to build an MDR as a product stat. So we're using our detection and response product solution to actually build it out. We think that there's lots of opportunity that are going forward. Our engineering team has been focused on how do we actually allow customers to not just monitor part of the environment. Like lots of the consolidators are still very narrowly focused on just their data. Our goal is for customers to monitor 100% of their environment and do that cost effectively. You have to be a product-driven company versus a services company that adds technology or a product company that actually has MDR as an ancillary feature of how you manage your own offerings. So our goal is to monitor and manage 100% of the attack surface. Our team's focus there. The benefit on your question for our SEM or security analytics offering is that that gives our SEM customers the most productive solution for actually managing detection response in their environment because our MDR analysts have to be productive and we have to do it at scale and at quality. And that's part of why that solution is so attractive to so many of those customers. Again, that strategy of designing it to actually be a scaled monitoring solution that monitors 100% of the environment, built as a product company, allows us to actually have a great MDR offering, but most importantly, that technology to be delivered to customers and partners, importantly, deliver a great managed service business.

Our next question comes from the line of Josh Tilton from Wolf Research. Please go ahead.

Hey, this is Patrick on for Josh. Thanks for taking my question. can you talk about the competitive environment and sort of what you're seeing there right now and maybe any changes observed over the last year and then within that is there been any changes to your win rates over the first 11 months this year and if so what gives you confidence that you can at least stabilize those win rates or maybe improve them with the better pipeline in front of you

thanks yeah it's good um so josh the wind rates haven't changed material it's just the pipeline competition has changed and it's become again for this year we had a more of a dnr focused business um we're building back up the risk business with exposure command so it's just too early i mean this is why we're not out over our skis and what the embedded model and conversion rate assumptions are i think the win rates will be somewhat high because like you know a significant you know half of that is just upgrades of the pm so like customer base and so that's a you know those tend to have different competitive deals. And by the way, those are also faster cycle deals to the question that was asked earlier. So while it's early, we would expect that to overall be positive. And then we'll see how it fares in the head-to-head space. We did not pursue a lot of risk management and cloud opportunities leading into this year, like we did at the start of last year, when we were launching CRC. We really wanted to retool it for a better approach. So in the DNR, so we'll know more on the exposure command side, but it's actually early, but I'll just say, you know, it looks really good, but I don't want to overweight a small set of deals that actually happen to actually move along fast. On detection response, we think we have a very, very competitive solution. We have high win rates. If we lose by far, it's because we are like walking away based on price or based on sort of like the extent of the customizations that we'll do because we're taking a product-based approach there um the good news there is that we're actually have been aggressively extending what we monitor naturally and we can actually do that in very very good gross margins um and so i would just say on that mdr space we actually uh have a premium solution there that's actually well regarded and we feel great about the competitive position overall there i think i've actually hit it so i don't think i just look i think the biggest issue this year is we had to re-accelerate pipeline on the wrist side um it's not about it's not that we were actually like generating pipe and losing our sales team was just waiting for us to actually redo our offering

going forward thank you our next question comes from the line of brian essex from jp morgan

please go ahead hi good afternoon thank you for taking the question um corey i think you mentioned during your prepared remarks that about 90 of net of new arr is sold to the partner ecosystem and i know previously you've talked about investing in channel relationships msp partnerships marketplaces uh can you maybe talk a little bit about the the mix of what you're seeing to the partner ecosystem is it leading to more consultative sales is is there anything about that partner mix that might also be contributing to these elongated sales cycles it's a good

question the answer is i don't think that's the primary contributor look i think having looked at it and spent some time in some of these myself. It's mostly, it is, we are now one of the more, again, for the deals that, look, our pipeline mix has actually just changed. We just have a lot of larger deals in pipe than probably we have at any point in our history. And customers actually have more scrutiny, you know, for 150, 200, $300,000 plus line item than they actually do for a 20, 30K line item. I mean, that's just the bottom line. So I think it's the deal size plus environment. I would not attribute that to our partners. I think our partners are doing a great job. We've seen good momentum. They've been one of the contributors to our pipeline overall. And so, no, I think it's more environmental and frankly, us not having enough offerings that are in that velocity space and actually really focusing our partners on our DNR business. I think that should change a little bit, again, as we actually continue to grow the exposure command which again should be a little bit more of a velocity business

at a lower asp got it thank you thank you our next question comes from the line of joel fishpin

from truest securities please go ahead thanks for taking the question um uh corey for you just uh love to hear anything that's going on in the fed business um and how uh that tracked this quarter

and what the pipeline looks like there thanks yeah it's a good question as you recall we have a we We have a strategic business. It's actually good, but we do much more in state and local. We have some really exciting, I would just say, Fed pipeline and launches coming, not launches, but like Fed true engagement coming up next year. And so I'll just say next year really starts our aggressive cycle in the U.S. federal government space where we have these certifications, we have the momentum, we've been working on lots of precursor work but it's not a material factor right now for for this quarter on a new growth basis we have some very strategic brands and companies in the federal government space um but it's not a strategic it's not a material factor for new business um this

quarter for this year great thank you thank you our next question comes from the line of srinik kothari from robert robert baird please go ahead hey yeah thanks for taking my question uh so

Corey, on the elongated deal cycle, some questions on customer budgets, being more broad-based. You and Tim, you guys touched upon, of course, pricing and bundling and so on. Can you specify in terms of adjustments?

Hey, Shrenik, you're bringing. Yeah, you're breaking up there. Could you repeat the question, please?

yeah yeah so i just trying to ask uh just taking a leaf out of some some other vendors making any specific adjustments uh to go to market those are perhaps exploring flexible financing some some trial periods other value-based selling techniques just to kind of employ them to alleviate customer hesitations in adopting the platform just trying to understand uh others might uh might be doing as well yeah it's a great point so i would

just say we are active in discussions around that right now um we're learning from others uh it's not in the base plan that we actually gave you uh we're trying to see the durability of how it impacts um but i would just say we are looking at sort of like how we actually think about just securing the business as we go forward we're doing it i would just say uh strategically and targeted but we don't actually have a broad based program in place around some of those things but i'll just say our our finance team and our sales teams are actively looking at that right

now great question our next question comes from the line of eric keith from key bank please go ahead

hey corey tim um thanks for taking the question i just wanted to come back to the sim market uh obviously been a lot of m&a activity across both enterprise focus and mid-market mid-market focused vendors and there's a lot of vendors out there circling the sim displacement opportunity so just curious if you think you're getting shots on goal there and um i don't know if that's one of the other sources of why you're seeing longer deal cycles so just any commentary there would be

helpful i mean i think that yeah i think we're doing great at the shots on goal i mean like and we're scoring lots of points too i mean the dnr business is actually proven um stable and healthy and so we feel very good about that overall. It's a competitive market, but I would say our competitive position is actually quite strong and we're investing a lot in R&D there to actually continue to extend that strength and that leadership.

Yeah, Corey, the DNR business is very healthy. It's half of the ARR that we have and the growth rate has been very exciting for us. So that remains very strong.

Thank you. Our next question comes from the line of Arch Koval from Scotiabank. Please go ahead. Thank you so much for taking my questions. Patrick

Koval from Scotiabank. Corey and Tim, I guess I just want to ask about the preliminary 2025 outlook. Did you say that we should use the 4Q exit ARR rate? Which, if so, I calculate that to be 4% in 4Q. So she used that to forecast 2025 ARR. And if I'm right in my math, I guess that guidance would suggest a kind of nice amelioration of demand trends. And so I guess, can you just talk us through the puts and takes as to, you know, how things are going to stabilize as we

look into 2025? Thank you. Yeah. Yeah. I'll give you the assumptions sort of like base there. So one um what we say is look at the exit rate and expect sort of like flat to mild acceleration um the core assumption around it just to be clear is look you know we don't love it but we actually had to actually reset expectations a couple times this year um and while we have extreme excitement we expect to be in our business stay stable because it is stable it's actually very healthy uh exposure command we actually are saying it actually sort of continues to show the momentum and the retention rates that we actually see. But we are going to, we're taking a wait and see approach to see what the conversion rates are on that. And we're not faking that into any base assumptions would update you on that as we actually see But in launch later in Q3, we've been thrilled that's exceeded expectations so far, but we want to get through its full deal cycles versus just taking a random estimate and actually plugging it to the model. So that's just the logic behind sort of like where we are, but of course we'll actually update sort of as soon as we actually have um clarity of like um does that momentum that we actually see carry through in the same deal cycles um with the asps that we're expecting

yeah corey and we just you know we talked about q3 q4 elongated deal cycles larger deals we assume

that going into next year very quickly thank you very much our next question comes from the line of mark cash from raymond james please go ahead hi yeah thank you this is mark one for adam so

So we're just kind of circling back to the really strong new AR bookings from partners this quarter. It's coming after the pipeline from strategic partners being at 15% last quarter. So just kind of get into what's driving that buy-in and pipeline from partners. I mean, could you also comment and tie in how much of that has come from AWS or the impact of that relationship so far? Thank you.

Yeah, I would say we have a set of strategic partners that I believe I've talked to you all about before. that are like our top um you know our top strategic partners i think 15 partners around the world um that's the lion's share of that sort of like increase uh and we do see that you know part of how you get momentum is partners create pipeline and they close pipeline and we're seeing those healthy trends keep in mind that we did shift lots of our investment away from purely internal sources to be more partner based last year so this is expected some of this is expected i would say again similar to our overall business more of that's dnr weighted um it's um and frankly it's early on the risk side um but we actually think there's lots of growth opportunity on the exposure command side but think about that as a part of the natural evolution of starting to see yields from the investments that we made exiting last year when we shipped it from our own internal sources to more partner based um primarily dnr focused and we're expecting both the pipeline and conversion to actually line up as we go forward on the exposure command and the risk management

business our next question comes from the line of matt dessert from needham and company please go

ahead great thanks for taking taking the question guys i wanted to ask about the shift to a regional sales model that you implemented recently can you update us on how that's progressing and given the early glimpse to 2025. Any learnings or thoughts around changing go to market incentives for sales reps, given the pipeline composition is shifting as you alluded to?

Yeah, it's a great question. So I would say it's going very well so far. I mean, the pipeline acceleration you're seeing is focused execution around the world from our sales leaders, and the partnership with our partner teams, frankly, based off having the full product set in market for the first time in a while uh that we close competitive in the right product set so um so you know what do you want to see you want to see um the pipeline build you want to continue to see healthy conversion rates and win rates of dnr which you actually have you want to see the pipeline exposure command um convert and actually go forward and that should drive sales productivity um next year as we move forward that's certainly sort of like the leading indicators that we actually see, but those are the steps we go through. So like, if you look today, our sales teams have been really focused on both building the pipeline, converting the existing pipeline. And so they've hit all the execution goals that we've actually laid out. They've also sort of like done a good job of going back and now upgrading our install base and building pipeline around that. So I would say they've hit all the milestones that we've actually laid out and that we want to hit. You know, what's next up is what allows us to actually go in and tell you more than mild acceleration is that we actually have to see what the deal cycles are for exposure command um we have to actually um see what the conversion velocity is around that and we have to actually execute on that that's the next up thing that we're really focused on all right well thank you all do we have one more oh no sorry i was about to turn it back over to you but please go ahead okay so what uh i really appreciate everyone want to take in the time on the call today. I know we've had some changes throughout the year, but we continue the momentum with DNR. We've now landed on a good integrated risk strategy that we actually feel good about. And really our focus now is about how do we actually reaccelerate and drop growth as we actually go forward. Thank you all for your time. Thank you.

Thank you. That does conclude today's presentation. Have a pleasant day.