Hello, and thank you for standing by. My name is Bella, and I will be your conference operator today. At this time, I would like to welcome everyone to rapid this 7th-4th quarter 2024 earnings call. All lines have been placed on mute to prevent any background noise. After the speaker's remarks, there will be a question and answer session. If you would like to ask a question during this time, simply press star, then the number one on your telephone keypad. To draw your question, press star one again. I would now like to turn the conference over to Elizabeth Trotz, Head of Investor Relations at Rapid7. You may begin.

Thank you, Operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's fourth quarter and full year 2024 financial and operating results, in addition to our financial outlook for the first quarter and full fiscal year 2025. With me on the call today are Corey Thomas, our CEO, and Tim Adams, our CFO. We have distributed our earnings press release over the wire, and it is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast, and following the call, an audio replay will be available at investors.rapid7.com. During this call, we may make statements related to our business that are considered forward-looking under federal securities laws. These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to the company's positioning, strategy, business plans, foundational work in 2024, operational improvements, growth drivers, ability to re-accelerate growth and scale profitability, financial guidance for the first quarter and full year 2025, and the assumptions underlying such goals and guidance and the impact of its product profile and 2025 investments. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the future results expressed or implied in these statements due to a number of risks and uncertainties, including those contained in our most recent quarterly report on Form 10-Q filed on November 7, 2024, and in the subsequent reports that we file with the SEC. The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call except to the extent required by applicable law. Our commentary today will primarily be in non-GAAP terms and reconciliations between our historical GAAP and non-GAAP results can be found in today's earnings press release and on our website at investors.rapid7.com. At times in our prepared remarks or in responses to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be one time in nature and we may or may not update these metrics in the future. With that, I'd like to turn the call over to our CEO, Corey Thomas.

Thank you, Elizabeth, and welcome to everyone joining us on the call today. Rapid7 ended 2024 with $840 million in ARR in line with our outlook and growing 4% over the prior year. Revenue and operating income exceeded our guided ranges, while we generated over $150 million in free cash flow for the year. Customer engagement in the fourth quarter aligned with patterns we observed at the end We're seeing encouraging trends in platform adoption, evidenced by expanding deal sizes and longer contract durations. While these factors naturally extend our deal cycles, they underscore the growing strategic value customers see in consolidating their security operations with Rapid7. Our detection and response business remained a key pillar of strength, delivering double-digit growth in 2024 and in the year at over $400 million in ARR. The strategic value of our security operations platform is reflected in the average ARR per DNR customer, which is now approximately $100,000. Meanwhile, our risk and exposure management business is showing promising momentum driven by early traction from Exposure Command. The integrated approach of our command platform resonated strongly with customers, helping drive over 20% year-over-year growth in total risk and exposure management pipeline generation during the fourth quarter. Looking back at 2024, it was a year of critical foundational work across three strategic priorities. First, we focused on innovation within our world-class detection and response offering by expanding our coverage of third-party alerts and leveraging AI-driven capabilities for alert triaging and detection accuracy. We significantly improved our customers' ability to respond with the speed and precision that they expect. These advancements strengthened our competitive position and delivered measurable benefits to our customers, solidifying our leadership in a rapidly evolving market. Second, we made substantial progress scaling our partner ecosystem to drive more efficient Today, we're booking between 80 to 90% of our new ARR through the channel, with deeper engagement and stronger pipeline generation from our top strategic partners. The operational improvements we've made in enablement and transaction efficiency provide strong foundations for continued partner momentum in 2025. Third, we achieved a significant milestone in cloud security adoption, with the third quarter release of Exposure Command. The early traction we're seeing validates our integrated approach to comprehensive attack surface and exposure management. A recent competitive win illustrates the value proposition of Exposure Command. An existing MDR customer, a regional insurance company, needed to expand their security coverage and manage assets across a multi-cloud environment. Rapid7 distinguished itself through our comprehensive approach, seamless integrations with their existing endpoint security provider, and strong capabilities in identifying security control gaps. This six-figure deal exemplifies both our cross-sell opportunity and the value we deliver as customers consolidate their security operations across our command platform. While we recognize that our recent growth has not kept pace with broader security demand, we strongly believe the foundational work we completed in 2024 positions us well for more consistent execution and sustainable growth. Our strategy is anchored in today's market reality. Organizations with constrained resources need to proactively manage threats across an increasingly complex attack surface. The cornerstone of any security operations program is detecting and stopping threats before they become major incidents. Yet most organizations struggle to cost-effectively process their growing volume of security data. This data challenge results in limited visibility across the attack surface, creating unnecessary exposures that further strain response capabilities. Over the past three years, we have worked to evolve Rapid7 into a leading integrated security operations platform anchored by our managed detection and response program and emerging traction in risk and exposure management. Our expert-led, AI-driven MDR enables us not just to monitor the attack surface, but to track what should be monitored as it evolves in real time, allowing our customers to proactively contain likely compromises before they occur. The foundation of effective detection and response must be built on an integrated view of the attack surface, and this is a key differentiator in our approach to MDR. We built a comprehensive exposure management solution that spans from endpoints to cloud across an organization's internal and external attack surface. Our flagship exposure management solution, Exposure Command, integrates traditional VM, cloud security, application security, SOAR, and Chasm capabilities into our command platform. We believe the progress we've made in our strategic transformation now sets the stage for reaccelerated growth in 2025 and 2026. To understand our trajectory, it's important to examine the key drivers of our recent performance. Let me outline why we're now positioned for acceleration in the decisive steps that were taken to improve the growth while improving and scaling profitability over time. Our AI-driven MDR represents the future of security operations, redefining how organizations protect themselves in an evolving threat landscape. We have spent the last three years investing in both technology and service experience to build an MDR product that delivers the scale and extensibility to monitor customer security at a lower total cost of operations. These innovations have improved security outcomes while deepening our partnership with customers. This steadfast commitment to our customers has positioned us as a leader in this space with one of the strongest offerings in the market today. Our DNR business now generates over $400 million in ARR. Managed DNR contributes over three quarters of this total and is growing in the mid-teens. Looking ahead, we see significant opportunities for accelerated growth while maintaining our gross margin structure. This year, we're making targeted investments in MDR growth as well as incremental R&D for exposure management in order to scale our threat detection capabilities, expedite response times and provide customers with deeper visibility into their tax service. We are underway in establishing a new stock and innovation center in India to accelerate these investments, as well as investing in sales and marketing initiatives to support our expansion opportunities. Rapid 7's differentiated NVR offering and high product market fit support these investments in expanding our market position, especially given the large growth opportunity that we see ahead. As we've seen success with detection and response, we've recognized shifts in the vulnerability management landscape that required a strategic response. This space has seen intense competition and accelerating cloud migration, leading to secular pressure and standalone VM. Rather than simply defending this traditional business, we've intentionally shifted toward the more sustainable growth markets of consolidated exposure management and managed detection response. As we built out our integrated offering, Exposure Command, we were less competitive in traditional vulnerability management, a dynamic that included both growth deceleration and moderately increased churn in those markets. We believe that we're entering 2025 equipped with a better product profile that positions us to reverse these trends and capitalize on the market opportunity in front of us. This emerging domain of integrated risk and exposure management positions us to compete more effectively for VM and cloud security budgets going forward and to re-establish our leadership in the exposure management space. We view exposure management as the consolidation of multiple risk markets, including VM, cloud security, and several ancillary markets. This approach gives customers budget consolidation leverage, as well as a more integrated view of the environment, providing the foundation for an active detection and response practice. As we look forward, our shift towards sustainable security growth and exposure management isn't just underway. It has meaningful scale and momentum. The launch of Exposure Command has exceeded our early expectations. In Q4, we continue to build pipeline momentum while seeing encouraging conversion rates that validate our strategy. We're building on this early success through several key initiatives. deeper integrations with third-party tools to provide more comprehensive and actual insights reducing customer workload and adding better data context expanded use cases supporting emerging needs in secure ai development and hybrid cloud compliance focus customer education campaigns highlighting the roi of consolidated risk visibility and exposure management and lastly competitive pricing models including surface command as an entry-level option for existing ABM customers. Looking ahead, we see two core expansion opportunities for 2025. First, we're evolving our customer engagement model to drive expansion of MDR and exposure command capabilities across our install base with clear expansion paths for cross-selling threat complete to risk and exposure customers and vice versa. Second, we're in process for FedRAMP authorization for key pillars of our risk and exposure management portfolio. This opens meaningful opportunities as federal agencies increasingly embrace cloud-native SaaS solutions. Turning to our 2025 outlook, we expect ARR growth of 4% to 6% consistent with the preliminary expectations we shared in November. We expect a majority of our 2025 ARR growth to be driven by our detection and response business with a strong contribution from MDR. We're assuming a modest contribution from risk and exposure management and expect to have a better sense of momentum for exposure command and our new sales expansion initiatives through the first half of the year. As we work towards re-accelerating sustainable growth, we remain committed to expanding free cash flow over time. This year, we identified several attractive opportunities to reinvest in our business to accelerate growth while enhancing our midterm cost structure. As a result, we're electing to reinvest up to $30 million into these opportunities with a primary focus on supporting the strategic growth initiatives we've spoken about, including extending our MDR service capabilities and offerings to reach a broader set of customers and accelerate our enterprise progress. Secondly, building upon our exposure command traction by accelerating our exposure management roadmap. And lastly, establishing a new innovation center in India to accelerate future innovation while improving leverage over time. This upfront investment in 2025 positions us to strengthen our competitive position through enhanced innovation while improving our go-forward cost structure. We anticipate seeing the benefits of these investments in 2026 and beyond. Later this year, we'll host an Analyst Day to provide a deeper look at our business, our strategy, product performance, and mid-term

growth framework. With that, I'll turn the call over to Tim. Thank you, Corey. Good afternoon, everyone, and thank you for joining us on the call today. Before I turn to the results, a quick reminder that except for revenue, all financial results we will discuss today are non-GAAP financial measures unless otherwise stated. Additionally, reconciliations between our GAAP and non-GAAP results can be found in our earnings press release. Rapid7 ended the year with $840 million dollars in arr growing four percent over the prior year we ended 2024 with solid double digit growth momentum in our detection and response business and with promising early traction and efforts to stabilize and accelerate growth in risk and exposure management as corey shared fourth quarter deal activity tracked as expected reflecting stable customer spending patterns Our larger deal sizes and longer contract durations reflect strengthening customer partnerships and will support expansion opportunities over time. Our total customer base grew 2% year-over-year to end 2024 with over 11,700 customers globally. Just under 15% of these customers have adopted a consolidated offering, which reflects the sizable opportunity to drive expansion in our customer base. ARR per customer grew 2% year-over-year to approximately $72,000, reflecting continued customer expansion within our platform. Full-year revenue of $844 million grew 9% over the prior year and exceeded the high end of our guidance range. Recurring product revenue also grew 9% over the prior year to a full-year total of $809 million, while professional services declined 6% as we actively de-emphasized certain lower-value services. Operating income of $164 million was above our guided range for the year as well. This represents 19% full-year operating margin and expansion of over 600 basis points from the prior year, demonstrating our ability to drive operational efficiency alongside our 2024 investments in innovation and growth. We generated $154 million of free cash flow in 2024 towards the high end of our outlook range. This represents a full-year free cash flow margin of 18%, expansion of over 800 basis points from the prior year. Now, turning to our fourth quarter results. Total revenue of $216 million was up 5% over the prior year and above the high end of our guidance. Recurring product revenue grew 6% year-over-year to $206 million, while professional services declined 5% over the prior year. International revenue grew 14% year-over-year, increasing to 25% of total revenue, while North America grew 3% and accounted for 75% of the mix. Product gross margin was 75% in the quarter, slightly below the prior year on higher hosting costs. Total gross margin for the quarter was 73%. Sales and marketing expense represented 30% of revenue, down from 32% in the prior year. R&D expense was in line with the prior year at 16% of revenue while gna expense ticked up to eight percent of revenue all in all fourth quarter operating income of 40 million dollars was above the high end of our guided range driven by revenue outperformance and disciplined expense management and represented an operating margin of 18 percent our adjusted ebitda was 46 million dollars in the quarter and net income per share was 48 cents moving to our balance sheet and cash flow statement we ended the year with cash cash equivalents and investments of 559 million dollars compared to 439 million dollars at the end of 23 higher operating profitability contributed to strong fourth quarter free cash flow of 59 million dollars this brings us to our 2025 guidance for the full year we expect ending total arr of 870 to 890 million dollars which represents growth of four to six percent this range assumes a stable customer spending environment to what we're seeing today which includes some uncertainty and disruption with certain state, local, educational, and healthcare customers. In addition, we expect more pronounced seasonality that reflects larger deal sizes and longer deal cycles associated with traction in our broader security operations platform. Similar to 2024, we expect new ARR seasonality to be skewed to the second half of the year, with a first-quarter ending ARR that is flat to modestly up from the end of 2024. Turning to revenue, we expect total revenue for the year to be in the range of $860 to $870 million, representing growth of 2% to 3%. Our recurring product revenue is expected to grow faster than this range, offset by a year-over-year reduction in professional services revenue of approximately $10 million for the full year. We continue to de-emphasize certain professional services, and this is reflected in our guidance range. Moving to profitability measures for 2025. As Corey mentioned, we are reinvesting in our business to prioritize growth re-acceleration. We remain strongly committed to expanding profitability over time, and this year we are making targeted investments to improve our cost structure and ability to scale efficiently in 2026, particularly in investments in R&D and the opening of our innovation center in For operating income, we expect to be in the range of $125 to $135 million for the full year and we expect to generate roughly 135 million dollars in free cash flow net income per share is expected to be in the range of a dollar 72 to a dollar 85 based on an estimated 77.3 million diluted weighted average shares outstanding moving to our quarterly guidance for the first quarter of 2025 we expect total revenue in the range of 207 to 209 million dollars representing year-over-year growth of one to two percent we expect non-gap operating income for the first quarter in the range of 23 to 25 million dollars and non-gap net income per share of 33 to 36 cents based on an estimated 75.6 million diluted weighted average shares outstanding. One accounting item I want to mention. During our financial close process for the fourth quarter, we identified and corrected a stock-based compensation error, which resulted in an understatement of stock-based compensation expense in 2023 and the first three quarters of 2024. While this required an immaterial correction of our historical financials, it does not affect our ARR, reported revenue, free cash flow, or non-GAAP profitability metrics. For those interested, we provided additional details in the footnotes of our earning press release. I'd like to once again thank our team for the dedication and execution as we continue strengthening our platform and positioning Rapid7 for long-term success. We are encouraged by the momentum in our detection and response business, the deepening impact of our partner ecosystem, and the continued adoption of exposure command. As we close out the year, we remain committed to driving sustainable growth, expanding profitability over time, and reinforcing our leadership in security operations, helping customers navigate an increasingly complex threat landscape while delivering strong value for our shareholders. With that, thank you for taking the time to join our call today. We will now open the call for questions. Operator? At this time, I would like to remind

everyone in order to ask a question, press star, then the number one on your telephone keypad. We do request for today's session that you please limit to one question and one follow-up. We will pause for just a moment to compile the Q&A roster. Your first question comes from the line of Executive Kalia with Barclays. Please go ahead.

Okay, great. Hey, guys. Thanks for taking my questions here. Hey, how's it going, Socket? Hey, guys. Corey, maybe just to start with you, you know, I understand the strategic shift towards towards detection and response. But I just wanted to double check some numbers that you called out in your prepared remarks. I think you said about 400 million in ARR for detection and response, most of which is managed DNR. And I think we said that's growing mid-teens. Is it fair to say that the remainder of ARR is mostly VM? And if so, how are we kind of

thinking about growth in that segment in 2025? Yeah, so you're right on the DNR business growth and MDR weighted towards the mid-team. The remainder is a mix of cloud VM, and we have some legacy sort of like products and technologies around threat intelligence and all over there. So it is a number of other things. The way that I would think about it is we have very good confidence, and we're leaning into and investing more into the DNR growth. We think we have a big market open opportunity there. We do believe that the integrated exposure management market is going to be a growth driver. And we've seen early momentum on that as we actually go forward. I would just say to actually your core question is entering this year, we actually are taking the approach of actually adding it into our guidance and expectations as we actually see the progress in arrears. So we've seen good initial both pipeline build. We've seen good conversion rates. It is upside to our plan. It's a continued momentum that we actually have, but it is primarily upside to the plan because we want to make sure that we're not over-precise on the timing or the deal cycles or anything else.

That makes sense in the exposure management side.

Tim, maybe for my follow-up for you, the investment that's going towards managed DNR

to support that growth, I think we got that message loud and clear. Maybe if you think forward, though, can you just talk about how the margins in that business might look at scale versus maybe, you know, the rest of the business?

Yeah, Socket, you know, I think overall product gross margins, you know, will remain stable in that mid-70s range that you've seen historically. The managed service does come in at a lower gross margin due to the nature of the business. There's a labor component. We do a lot of work around introducing AI to drive more efficiencies. We talked about the Innovation Center and the SOC over in India. That also gives us the opportunity to drive some efficiencies. But if you look at overall gross margin from a mixed standpoint, the managed service gives you a little bit of a headwind because of the lower gross margin. But we think we have a tailwind based on some of the AI and the efficiencies that we can drive over time. But overall, when you look at product gross margin, mid-70s, should remain stable. Very helpful. Thanks, guys. Thank you very much,

thank you. Your next question comes from the line of Matt Hedberg with RBC. Please go ahead.

Great. Thanks for taking my questions, guys. Corey, you know, I wanted to circle back to something you said on the Carter Marks. I think you said you've reached some significant pilot security milestones, which is good to hear. And I think some of the numbers you gave supported that and I'm just curious though at a high level can you you know help us think about like your value proposition why you're winning there obviously it's a competitive landscape when we're talking about cloud security and you know I guess how sustainable is that success do

you think yeah look it's a hyper competitive landscape one of the things that we actually spend a lot of time looking at is how to make sure that we're actually taking a approach that was going to be both value add in the market but also going to be actually sustainable over time One of our big realizations is that cloud security is still adopted by a relatively small number of customers. And if you look at the broader market and if you look at sort of like the cloud security market at scale, what people really want is complexity reduction. And so our big focus is how do you actually deliver integrated exposure management? But when you really think about that is how do I actually understand my attack surface, regardless of whether it's cloud, on-prem, endpoint, SaaS solutions? And how do I have an integrated, complete view of my attack surface? How do I track my risk over time? How do I adhere to an incredibly fragmented regulatory compliance state that's emerging up? And then how do I manage my remediation? And so, you know, our our approach is not to go after. I would just say the traditional what we think about is the first mover cloud centers of excellence, hyper competitive market. Our focus is how do we actually make total security risk management and exposure management accessible, cost effective, easy to use, easy to manage compliance, easy to manage remediation for your average sort of organization and customer around the world. And that targets our core customer base of that. You know, when we looked at even in our install base, we saw under adoption of anyone, of anyone's cloud security technology. So we approached it less from a, how do we actually go build what other people are building in the traditional cloud security market? We approached it from a, how do we actually help customers solve their overall security problems, track and manage risk and compliance and do that within the security budgets that they actually have for those that are under adopted. And we see that as a pretty big market, pretty sustainable. And so that's the core focus that we have.

That's great. Sounds like a lot of greenfield opportunity And maybe this is kind of a dovetail for Kim. Yeah, no, it was evident. You know, Corey, you talked about some of the incremental investments. And I guess, you know, Kim, from your perspective, you know, I guess how confident are you you know when you think about the financial model of those you know leading system acceleration in 26 and you know i do should we think about that as more i don't say one time but do you think we start to see some margin improvement then in uh encounter 26.

yeah matt um look we were very confident in the steps we're taking uh 30 million dollar investment corey talked a little bit about it uh you know roughly half of that is going toward mdr and expanding that service capability. So we think that will be a growth driver. The other half, I would say, is really just accelerating the roadmap on exposure command. Again, a product we're very excited about and opening up this new innovation center in Saak in India, which we know will drive, I think, some exciting innovation talent over time, but also does come at a cost benefit as well so we do expect to see more of that yield in 2026 and beyond thanks a lot thank

you your next question comes from the line of fatima buleni with city please go ahead

all right good afternoon thank you for taking my question um corey i wanted to go back to uh earlier question and some of your commentary in the script around the vulnerability management as narrowly defined being in secular decline. You know, I think that's pretty evident in the numbers if your DNR business is growing kind of double digits. I think we can all do the math. That's over half your ARR at this point. So what I want to ask you is where are we in kind of the trough or the nadir of some of this decline and I guess the disillusionment in this market? And how are you directionally thinking about um the trajectory of decline in this area in 2025 and i have a follow-up for tim please

yeah it's a good question so you know the first thing is um i think there's two different parts and one is the secular decline because vulnerability management has traditionally been on-prem uh and so there's been less participation in the i would just say the cloud dollars and some of the other risk dollars that's it we do see pretty robust opportunities when you think about how people have to manage risk in a pretty crowded, not crowded, but in a pretty fragmented regulatory environment. So the way that I see it right now is that if you look at traditional on-prem vulnerability management, I would just say there's not lots of growth there. I don't know if there's massive decline there. There's just not a lot of incremental growth there. The growth areas that we see specifically are the greenfield organizations that actually are trying to get a handle on how do they actually deal with incredible regulatory compliance pressures, deal with a very fragmented environment and have very few resources to actually manage that. That's where we see some of the earlier momentum with Exposure Command. Now, to get to your core point on timing, the expectation that we laid out for this year is that we see it in pipeline building mode, we built pipeline, we see early conversion rates. We see it, I would say, incrementally positive this year from a total net perspective, but it's not sort of like adding to material growth in our baseline plan right now. That said, we'll increase that as we actually go across the year and see the numbers, but we've put pretty modest expectations in based on the exit rates coming out of last year. Of course, we're managing that to actually be more forward, but we see lots of the benefit, again, coming in throughout this year and building it to next year. And you got

a follow-up? Thank you. And Tim, just in terms of the margin guidance that you shared, there's an tremendous amount of change in the business from a personnel standpoint. You know, you all went through a pretty material rebalancing of the workforce. So I wanted to better understand in 2025, just at a base layer, sales productivity, sales capacity, anything you can give us on, you know, how much of the capacity is still kind of net new and still ramping and some of the productivity trends that you saw this year, how are you toggling that into your assumptions for the mid-single-digit AR growth for next year.

Yeah, thank you. So on a sales perspective, we're actually adding a modest amount of sales headcount, and we expect to see productivity gains. That's primarily because our sellers have now more products to sell. And we're actually, remember last year, we had like a partial year of selling with the transition from CRC to Exposure Command. And so the lion's share of the productivity gains is just a full year of selling with better pipeline coming into the year. on Exposure Command. So we feel really good about that. On your point about the staffing changes from the time that we actually did the restructuring through now, I remind you that now you see some of the results. Our intention was always to actually rotate our business towards DNR and what we eventually called Exposure Command. I will say that we expect more of that expenses to hit last year. So we were a little bit slow off the mark on actually re-accelerating the hiring around that that definitely has some implications on the growth and the velocity that we wanted to see um and so in some ways this year is sort of like rebalancing for some of the hires that we originally expected to actually start last year but we're still on the plan that we originally intended um with rotating the business from traditional vulnerability management towards a detection and response oriented business with the core exposure command underlying base that

really targeted that greenfield market very clear thank you so much thank you your next question

comes from the line of joseph gallo weather jeffries please go ahead hey guys thanks for

the question can you just further elaborate on the competitive and pricing environment i just want to better understand what gives you confidence that this is a a pipeline to eventual conversion timing story versus competitive pressures

that's a great point well you know what i would just say is just to hit it hit it directly is that i would say traditional bm was a competitive pressure source and i think we were pretty clear about that in my prepared remarks um on the exposure command and the momentum that we're actually seeing there i would just say the evidence is evidenced by the fact that not we not just built pipe we actually saw conversion rates ahead of where we expected look it's still nine month deal cycles but we actually are seeing the trending on the adoption and the conversion rates where we expect them to be. Now, I expect that to still be a somewhat competitive market, which is why we're investing, because we see the growth opportunity, we see the interest, we actually see the momentum. So we're not assuming that it's a non-competitive market, but we have a massive, I would just say, upsell opportunity within our own install base. If you look at it, we saw a significant amount of the pipeline that we built and the early conversions in our install base. We've not had a big expansion business off of our traditional VM install base for a while. We see a lot of latent demand within that resource-constrained buyer, that Russell 3000, those private firms. And so those are the dynamics that we look at. We don't expect any market insecurity to be non-competitive. But what I would just say is that the opportunity is very robust, both from a DNR perspective, especially with our MDR offering, as well from the exposure to demand perspective. Awesome. And then just as a follow-up, I mean,

if you look at your guidance and maybe compare it to previous years, I mean, what's your sense the visibility into your forecast? And as we look at potential upside drivers to the 4% to 6% ARR growth, what are the things that can go right this year? And are those more first half or second

half stories? Thank you. Yeah, it's a very good question. So the first thing is you'll notice that we widened the guidance versus prior years. Look, after the year last year, we had no intention of actually not being incredibly thoughtful as we actually came into it. And so we widened the guidance range that we actually sort of like took as we actually entered this year. The drivers of upside to your core question are fairly straightforward overall. We're expanding our MDR offering. It's an area of strength. The deal cycles are longer. So we are seeing sort of, I would just say, more larger deal cycles, just to be clear. But we talked about what the ARR per customer for the overall MDR customer is. But we see upside to that as we expand that offering. The pipeline that we built on exposure command is actually very good. We saw good early progress. it is still primarily upside to the plan, just to be clear. Look, this is a year from a guidance perspective that we're not going to actually change or raise numbers till we actually see the performance in arrears. We think that's the right thing to do with our investors and with the contacts. So when we see performance, we'll actually do it in arrears, but we do see lots of opportunities for upside. But again, we're measured. Now, I would just say one of the things that we're watching closely and that I'm hearing a lot about from our customers is we have a lot of customer spectrum, especially when you think about these resource constrained buyers that are under some pressure from ambiguity. If you look at our healthcare customers that are reliant on federal funds, if you look at our state and local customers that are also reliant, and as well as our emerging federal market, those are customers that are trying to understand how the federal funds are going to flow. And so we're incrementally thoughtful about like how that plays out over the

course of the year. Your next question comes from the line of Patrick Colville with a Scotia Bank. please go ahead your line is now open all right guys thank you so much for taking my question um

so i guess um looking at the look at the numbers what stands out to me is uh i guess the improvements in the kind of net new arr contraction and guided to continue improvements in kind of the trajectory for net new ARR into next year, I think you called out in prepared remarks that expecting net new ARR by the back half of 2025 to actually be kind of flat to maybe up. So can you just, just so we're completely clear, what are the factors that give you confidence to call out the kind of net new ARR in the back half of the year could even grow, you know, from these levels?

Yeah, that's a great question. So the first is that it's based on areas of strength. We see good opportunity in the DNR business, and we're extending that business. There's parts of it that we haven't been able to address historically. There's more customized business, especially in the enterprise segment. So we're making a pretty significant investment to actually extend the business into something that our sales team has actually been hungry for. The second thing that we're looking at as we actually go along is we actually have a better pipeline entering this year. Now, we are being sort of thoughtful about sort of like how that actually sort of converts over the pace of the year. But we are in a much better position from overall pipeline. And we do have the upside from the exposure command, surface command and vector command products that we introduced late last year.

And Patrick, it's Tim. So, you know, you saw we had a strong Q4 of this year, and that is traditionally the strong quarter for us. And so as we model out the profile of net new throughout the year, we do see Q3 and Q4 being a little bit stronger, again, with Q4 playing out similar to what you saw this year.

Okay. Thank you, Corey and Tim, for that. And I guess my follow-on is just about the competitive environment. I mean, Rapid7 today is a very different business to what it was even just 12 months ago. I guess if we think about the key competitors as of right now in these new areas like, you know, DNR and exposure command, are we talking about your traditional competitors, your VM competitors, those guys and their tools there? Or is it network security competitors or kind of cloud native competitors?

Yeah, on the NDR market, it's a good question about competition. On the NDR market, it's a different set of competitors. I mean, part of what we like, it's a massively fragmented market that actually includes service providers, tech-oriented service providers, endpoint providers. But it's a fragmented market, and we think that fragmented competitive markets are great places to actually play. And we think our strategy of actually providing the widest visibility and monitoring across the attack surface and assisting customers and how they manage and operate that environment is a good play and a strategic play there. When you look at sort of like the precursor to that, that ties directly into our exposure management market, because part of what differentiates us from MDR is we understand the attack surface better than our traditional MDR players. And so we have good symmetry between those markets. When we identify exposures, we also have the opportunity to say, here's how we can actually actively monitor those exposures for attacks. When you think about the exposure management market, I would just say you're seeing that market evolving and emerging because most people recognize if you are going to actually be a narrow player, it's going to limit your opportunity. And so like cloud, there's only so many people that are going to have massive cloud centers of excellence where they're going to be paying, you know, hundreds of thousands of dollars to millions of dollars a year. Vulnerability management, if you're just doing that, you're on prem. And so it really is how do you provide integrated risk? we think that there's going to be some major cloud security players that are going to shift and expand their offer over time. You saw Tenable did the acquisition, which was a smart acquisition that actually put them in the exposure management market. So we do expect that to be a competitive market. We also see it's a massively underserved market. We see where it's the opportunity that's emerging. And we're investing behind pursuing that opportunity. And we think we're incredibly

well positioned there over time. Excellent. Thank you so much, Corey. And looking forward

to 2025. Thank you very much. I am too. Your next question comes from the line of Hamza Fodorwalla with Morgan Stanley. Please go ahead. Great. Good evening and thank you for taking my

question. Corey, good to see the stabilization on the net new AR front this quarter. I'm just curious. It seems like there's more growth or greater makeshift rather in the faster growing part of the business, the MDR portion of the business. But can you comment on the churn or the downsell pressure that you're seeing in the VM part of the exposure management business? Has

that started to bottom out as well? Thank you. Yeah, no, it's a great question. So I'll remind you two things. One, last year, we actually were not selling our VM and CRC solution for a big part of the year when we were actually going to do the transition. So that added growth pressure overall last year. I would also just say, in retrospect, we did not manage the transition from the traditional vulnerability management to our integrated security operations stack with MDR and Exposure Command as well as we actually could have. And so what we saw was increasing pressure when customers were trying to figure out what our strategy was, and that caused both retention pressure, but most importantly, new ad pressure while we were waiting to actually add the new product. We see the new ad stabilizing this year, and we see the retention we factored in as stable from last year. We're looking at improvements as we upgrade our install base from vulnerability management from our InSight VM product to our Exposure Command product, which is a much stickier, much more integrated product. So I would just say our baseline assumptions assume stability, and we feel really good about the stability right now. The upside is if we're able to actually upgrade our install base faster, that prevents both expansion dollars, but those customers are also stickier because they're more integrated into the overall environment. Very clear. Thank you.

Thank you. Thank you.

Your next question comes from the line of Adam Tindall with Raymond James. Please go ahead.

Okay. Good afternoon, Corey. Very clear that it makes sense to invest behind the strength in the DNR piece that's growing. I did want to tackle the other half of ARR that's in decline and just wondered the different options that you considered for that, what you could potentially do to reaccelerate that or is that kind of more good money after bad? and the strategic optionality you might have considered? Understand that maybe a little bit more minimal growth, but presumably profitable. What would be the pros and cons to considering maybe even splitting or selling that piece?

Adam, great question. So we look at all options when it comes to actually thinking about what's the best way to actually get shareholder return. You know, it was influenced by, I would just say two ways. It's one, the strategy that we went down on the tax surface management path is a core differentiator for our DNR business. And so that's the first thing to actually consider. The second thing is we saw a pretty significant opportunity that we're excited about. And the early momentum that we actually saw from Exposure Command and Surface Command validated the early momentum that we actually saw from customers who are looking at how to tackle an incredibly complex risk environment. So to get to the core of your question is that we really focused on where do customers have the most pain? Is it already addressed for other products at reasonable price points? And where can we actually have a differentiated position? There is a significant amount of customers out there who are struggling with the complexity of managing a complex environment. And we actually see that those customers are under, not just underinvested. They're looking for solutions to solve that complexity problem. And that's why we built and designed Exposure Command for it. It's for that growth-oriented market. And we actually see great growth opportunities there.

Got it. Okay. Maybe a quick follow-up for Tim. I just wonder, you know, if I look at the past couple years, you initially start out with an ARR guidance that, you know, seems to be thoughtful on the surface. And then throughout the year, we've had to, you know, kind of lower expectations consistently. You know, for investors who have been through that, what's different about this year? And particularly given, you know, if we take the Q1 commentary, where it's going to be of flat sequentially it's going to imply about 40 growth in net new in q2 three and four so those investors who have been through that cadence in the past what would be you know uh something to give them a little bit more comfort this year what's different thanks yeah adam cory touched

on a couple things i think one is the strength of the pipeline as we see that playing out uh over time. The success that we've had with DNR, MDR, mid-teams growth rate, $400 million of ARR. We're clearly one of the market leaders in that space. And that gives us a lot of confidence based on the quality of the product that we have. And then we're investing behind it as well. So take roughly half of that incremental investment for next year is really going to accelerate more that we can do with MDR. I think when you take all of these factors considered, and I think Corey touched on a little bit earlier, we're not going to bake into the plan a large success of exposure can ban. We're seeing early signs that are very promising, the pipeline growth, the conversion rates, and we just have a modest contribution in the plan this year. And it really is a wait and see. Let's get the ARR that's booked and sold before we really bake it into the guidance or make any changes there. So I think it's the strength of MDR is going to drive a lot

of this. I mean, the last thing I would say is we're hyper-focused on both looking ahead and looking at different seasonality ranges and sort of communicating that proactively. Two, we actually ended this year with a much wider guidance range, and we communicated that proactively. And we've ourselves more levers for upside in the business as things move around. So we feel pretty good about the setup and it is materially different than sort of like the setup of what we described

last year. Thank you very much Adam. Your next question comes from the line of Jonathan Ho with William Blair. Please go ahead. Hi, good afternoon. Just one question for me.

Can you talk a little bit about your thoughts on net retention just given these larger deal opportunities and upsell opportunities and maybe can you contrast that with you know the opportunity for an uptick in contribution from net new customers thank you yeah it's a great question

so look one of the biggest cycles we're actually seeing in front of us right now is the opportunity to upgrade our install base we've never had a better opportunity for cross-sell and upsell i mean part of what we've done over the last year is add extensions to our product so that's sure across our DNR and MDR install base, that's sure across our traditional VM install base. We have more cross-sell and upsell opportunities than we've actually had before. We've seen good initial pipeline build. Of course, we actually have significant campaigns that actually highlighted in my prepared remarks for our sales teams to actually upgrade our install base. But we do expect, you know, both over the course of this year and into next year, I would just say more robust performance on the expansion business and increases in net

ARR as we actually go forward thank you very much Jonathan your next question comes from the line of Roger Boyd with UBS please go ahead great thanks for taking the question Corey I wanted

to come back to the competitive environment in detection response and get your perspective on some of the M&A we've seen in that space particularly with some of the MDR providers acquiring tools like endpoint security in what ways do you see that kind of influencing the

opportunity to have on that side of the business. Thanks. Look, I think it's, like I said, it's a

fragmented competitive space. You also will see from our prepared remarks that we're investing in the space. We're investing directly. We're also investing in partnerships in the space. And so I think it's one that it will be an evolving space. We're one of the, I would just say, larger players that actually has very healthy dynamics overall. And you'll see, I would just say, if you look at our offering today, we actually sort of like partner include an OEM, endpoint technology in there. We have lots of our own core detection technology. We've been extending our cloud detection response technologies. There's a lot of complexity there for customers. Most customers cannot manage the complexity of their security operations environment and the volume of data that they actually have. And so I think an integrated solution is the most powerful solution. I would just say if there's one requirement that trumps all others is customers cannot ignore critical aspects of monitoring. We believe that customers have to monitor 100% of their environment. And we're investing to actually do that and do that well. As you alluded to, others are making that investment. But again, it's a very fragmented space. And we think our core value proposition holds up well. Thank you very much.

Your next question comes from the line of Greg Mazzucowicz with Mizuho. Please go ahead.

Thank you. It's Greg Mazzucowicz from Mizuho. I'll keep it to one as well. uh corey your prepared remarks i believe you spoke about an expectation to drive re-accelerated growth in 25 and 2026 and the midpoint of the 2025 arsi does point to uh one point of acceleration for 2026 obviously you're not providing the guidance at this time but directionally speaking are you expecting uh additional acceleration in that 26th year

Yes. Look, the whole setup that we actually have is two things. One, we do think that DNR and our extensions on it have actually good long-term sustainable growth dynamics. We wouldn't invest if we didn't think that there was accelerated growth opportunities. The second one that I would just highlight is we have a pretty big expansion opportunity within our install base. We built out the products last year, but we have to do it. We are anticipating continued long sell cycles, so this is why we're more conservative and thoughtful on the timing. That's why we have the wider ranges. Yes, absolutely. We do expect to see accelerated growth in 2026 off the base of this year. And that's why we're making the investments that we're making. It's because we see the opportunities. And we're investing now to prepare.

Exactly. Thank you. Just to clarify, Corey, I apologize, but it sounds as though the reacceleration, and again, I realize that this is a longer dated question, right, in terms of 2026 but it sounds like the reacceleration is kind of versus the 2024 baseline and maybe sort of a wait and see in terms of how 2025 ends up no i think that we're expecting both the

acceleration of 25 over 26 i mean 25 over 24 and 26 over 25. okay and again we're going to provide an analyst day later this year to actually lay out those mid-range plans but thank you for the question. It definitely needs to clarify. Thank you. We have time for one more question. Our final

question comes from the line of Brian Essex with J.P. Morgan. Please go ahead. Hi, good afternoon.

Thank you for taking the question. Corey, I was wondering if you could share a few thoughts on North America versus rest of the world. And if I just kind of look at the whole year on a trailing 12-month basis, international revenue accelerated while North America revenue decelerated anything you can share with regard to either macro customer profile a catch rate your go-to-market motion that would maybe help reconcile those growth rates and where do you have the i guess which which which geographic region either north america rest world gets you most excited and has you expecting the most contribution from as we kind of look into the

next couple years yeah if you look over last year it's interesting you know so you always have to be careful because it moves around from year to year. You know, a couple years ago, we saw Europe as a challenge. Last year, we actually saw really strength in Europe and APAC that really accelerated. Also, last year, you saw North America by midway through the year, especially some large organizations, just sort of had like their budget cycles where I would say not as strong as we actually expected or hoped that they were. And that was something that, you know, we noticed, we talked to others about and seemed to be a bit of a factor last year. We're not expecting macro improvement this year, to be clear. Our strength that we actually see this year, so North America will improve this year. That has more to do with the fact that we just have a full year of selling and more robust product set than it does any change in the overall macro. Keep in mind, we only had a partial year of selling Exposure Command last year. We had a more limited MDR offering last year. The extended customizable enterprise MDR offering that we recently launched will be available for this year. And so those are the factors that drive it. It's our product suite availability is driving our productivity improvements in North America this year, more than assumptions in the overall macro dynamics.

Got it. Anything really that you can take away from the customer profile in Europe that might have led to better growth this year? or is it, you know, more idiosyncratic than that?

Well, I think it's more idiosyncratic. Look, there is a lot of different moving parts because Europe's not a monolith. Look, we saw different trends in, you know, Germany versus the UK versus France. So, like, there was different trends in different geographies, different territories, different industries. So I can't give you a continent-level sort of, like, synthesized view because that's just not where the trends operate. This is definitely an environment where you have to pay attention to what's happening in specific areas. Like right now, I think Tim called out his script is that in North America, the healthcare sector is under more pressure incrementally this year than it was last year. There's some other sectors that are actually stronger. And so this is one where we just have to be paying much, much more attention to what's happening in specific customer environments. And our goal is to actually show up and say, how can we actually help you have great security operations? And I think our team's set up and willing to do that work.

Great, super helpful. Thank you so much, I appreciate it.

I really appreciate it, Brian.

thanks for the question that concludes our q and a session i will now turn the conference back over to kari thomas chief executive officer for closing remarks thank you so much thank you

all for joining us today on the conference call uh and we look forward to updating you on the progress over the course of the year and connecting with you later on as we actually do our analyst

and yesterday thank you thank you ladies and gentlemen that concludes today's call thank you for joining you may now disconnect