Hello and welcome to the Rapid7 first quarter 2025 earnings call. All lines have been placed on mute to prevent any background noise. After the speaker's remarks, there will be a question and answer session. And if you would like to ask a question during this time, please press star 1 on your telephone keypad. I would now like to turn the conference over to Elizabeth Schwach, Head of Investor Relations at Rapid7. You may begin.

Thank you, Operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's first quarter 2025 financial and operating results in addition to our financial outlook for the second quarter and full fiscal year 2025. With me on the call today are Corey Thomas, our CEO, and Tim Adams, our CFO. We have distributed our earnings press release over the wire and it is now posted on our website investors.rapid7.com along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast, and following the call, an audio replay will be available at investors.rapid7.com. During this call, we may make statements related to our business that are considered forward-looking under federal securities laws. These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to the company's financial guidance for the second quarter and full year 2025 and the assumptions underlying such goals and guidance. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the future results expressed or implied in these statements due to a number of rifts and uncertainties, including those contained in our most recent quarterly report on Form 10-Q filed today, May 12, 2025, and in the subsequent reports that we file with the FCC. The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by applicable law. Our commentary today will primarily be in non-gap terms, and reconciliations between our historical gap and non-gap results can be found in today's earnings press release and on our website at investors.rapid7.com. At times, in our prepared comments or in responses to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be one time in nature, and we may or may not update these metrics in the future. With that, I'd like to turn the call over to our CEO, Corey Thomas.

Hello, and thank you to everyone joining us this afternoon. Rapid7 ended the first quarter with revenue and operating income above our guided ranges, while our ARR fell short of our expectations, ending at $837 million with 4% year-over-year During the quarter, we saw continued strength in detection of spots, progress towards stabilizing our risk and explosion management business, the resilience and profitability of free cash In a moment, I'll walk through the details of our performance, but first, I want to remind everyone of the expectations we shared on our last earnings call. We entered 2025 with a clear strategy and commitment to re-accelerate long-term growth and expand free cash flow over time. This strategy rests on three pillars. First, building on our skill and success and detection response, where we have strong customer demand and are well-positioned to sustain growth. Second, upgrading our large vulnerability management customer base to our exposure management platform, which will both increase retention and provide a valuable on-ramp to our DNR platform. And third, improving our underlying cost structure while continuing to innovate by leveraging our new operations center in India and streamlining our processes. In Q1, detection and response continued as the core growth driver of our business from both an ARR and product expansion perspective. This business now represents over half our total ARR and maintain mid-teens growth in the quarter. Our DNR performance would have been even better if not for a few seven-figure deals slipping into the second quarter, which have now since closed. However, our risk and exposure management business continued to see challenges, missing our expectations with continued growth deceleration. While Exposure Command continued to gain traction, this was offset by ongoing negative growth in our traditional vulnerability management offering. On a positive note, our investments to improve our cost structure remain on track, setting us up for profitability re-acceleration in 2026. Our performance took place in a more challenging macro environment than we anticipated entering the year. We observed customers becoming increasingly cautious and measured about their investments, both in terms of what they purchase and when. Extended deal cycles have become more common across multiple sectors, and many organizations are actively evaluating vendors, reprioritizing budgets, and implementing tighter spending controls. These dynamics are particularly evident in the North American mid-market enterprise segment, which has experienced slower deal cycles. This customer segment is demonstrating greater scrutiny and tighter budget control, trends that are reflected more broadly as customers reassess their priorities and spending commitments. As we've seen in previous periods of economic uncertainty, the pressure is more pronounced in our risk and exposure management products, while our detection and response offerings continue to show resilience. Now, let's examine our product-based performance in detail. Our detection and response business continues to be our growth engine, anchored by strong momentum in our managed offering. We ended Q1 with over half of our ARR coming from detection response, growing in the mid-teens year over year. This growth is driven by persistent demand trends, particularly for MBR, which represents more than 75% of our DNR business, as customers seek enhanced visibility, broader coverage, and operational efficiency in managing an increasingly complex threat landscape. we believe the detection response market offers attractive and durable tailwinds and we're still in the early innings of its development we have spent years investing in land the foundation to position ourselves to capitalize on this opportunity and we continue to innovate and invest for growth this includes our recently announced intelligence hub which seamlessly integrates threat intelligence into our command platform experience and expanding our capabilities through our recently opened SOC and Innovation Center in India, which will scale over the coming quarters. These investments are helping us deliver services more efficiently without having better customer outcomes. As organizations increasingly turn to Rapid7 to monitor and respond to threats across complex environments, our integrated platform and MDR expertise continues to stand out in a crowded marketplace. A great example is a first-quarter competitive win with a mid-sized enterprise healthcare customer who consolidated their security stack with our Managed Threat Complete solution. They were seeking broader visibility, greater automation, and reduced operational complexity, challenges we were uniquely positioned to address. Our differentiation was clear across several dimensions. Our Managed XDR capabilities enabled seamless third-party detection response through native integrations with their existing tools. Our AI-powered SIEM and log management offered unlimited ingestion and long-term retention, providing unmatched visibility. Our customizable analytics and automated alert triage streamlined their operations. And we delivered true defense in depth by correlating alerts across multiple sources, not just endpoints, creating a more robust security posture. This win was driven by our technology and strengthened by our partner collaboration and ability to support the customer's goals with speed and clarity. It exemplifies how our consolidated platform continues to drive success in highly competitive environments. With our proven brand, our track record, and the right capabilities to win, we remain excited about the future of this business and expect to continue to drive growth for Rapid7. Now, let's turn to our risk and exposure management business, which is where we experienced the most pressure during the first quarter. As we've shared in recent quarters, we are amid a deliberate shift. transitioning from a traditional standalone VM business to a consolidated, integrated approach to risk and exposure management. We believe customers increasingly need unified visibility across their attack surface with streamlined remediation and smarter risk for our organization. This is what Exposure Command delivers, bringing together vulnerability management, cloud-native application protection, and threat context into a cohesive experience by consolidating risk insights across hybrid environments, automating response workflows, and focusing teams on what truly matters, real exploitable threats. We're helping security teams efficiently secure their expanding attack surface. Our strategy to improve risk and exposure management is centered on driving adoption of Exposure Command across our VM customer base, and we continue to believe this will stabilize performance and ultimately position the business back to growth. We laid the right Foundation in 2024 with our Exposure Command launch, and today we're actively working to transition our VM install base to this more modern, integrated solution. While we've not yet made the full progress we hoped, we're resolute in our strategy, and the key consideration is around timing. The most significant variable in our near-term performance will be the velocity of the upgrade cycle and risk and exposure management. This is where we're focusing our efforts, accelerating migrations, enabling partners, and removing friction points to shorten time to upgrade in what is clearly a more competitive and measured environment. On the go-to-market side, we've completed initial partner and field enablement and are now refining our packaging and pricing to support clearer customer paths and more streamlined upgrades. We also recognize the need to better communicate the strength of our CNAP capabilities, which remain a core differentiator but are still underappreciated in the market. On the product side, we continue to invest in innovation, including several recent enhancements that expand coverage, improve automation, and reinforce our leadership in unified exposure management across hybrid environments. Now, turning to our outlook for the remainder of the year, we remain confident that our strategy can position Rapid7 for sustainable growth and expanding cash flow in the years ahead. Our detection and response business continues to perform and remains the primary growth engine for 2025 as we work to modernize our risk and exposure management platform and return that business to growth. That said, it's clear the environment is more dynamic and fluid than when we initially provided guidance in February. We're seeing greater variability in customer decision cycles, something we experienced firsthand with certain March deals slipping into April, and we recognize that broader policy and budget implementations may take additional time to play out. Additionally, we've taken the opportunity to leverage the expertise and input from our new board members to help evaluate and enhance our guidance approach. Given the evolving backdrop and our slower start to the year, we're adjusting our ARR guidance by lowering the overall range and also widening the range to account for increased budgetary uncertainty importantly we are maintaining our expectations for operating profitability which is a reflection of the operating discipline flexibility and resiliency that we built into our model as we look ahead our focus remains clear and grounded in three strategic priorities first we will continue to drive industry-leading product innovation across both our growing dnr franchise and our established risk and exposure management business Second, we remain committed to delivering successful outcomes for our customers, helping them navigate increasingly complex threat environments while ensuring clear returns to their security investments. And third, we're focused on driving profitable growth and strong cash generation, including through operational efficiency and continued leverage in our expanding partner ecosystem. Before I turn the call over to our CFO, Tim Adams, to discuss financials, I want to take a moment to welcome our newest additions to our Board of Directors, Wael Mohamed, Michael Burns, and Kevin Galligan. Each brings expertise that will support our efforts as we navigate a rapidly evolving landscape. We look forward to leveraging their experience to drive growth, enhance our industry leadership, and create value for all our shareholders. With that, I'll turn the call over to Tim to walk through the results in more Thank you, Corey, and good afternoon to everyone.

We appreciate you taking the time to join us on today's call. Before I turn to the results, a quick reminder that except for revenue, all financial results we will discuss today are non-GAAP financial measures, unless otherwise stated. Additionally, reconciliations between our GAAP and non-GAAP results can be found in our earnings press release. Rapid7 ended the first quarter of 2025 with $837 million in ARR, representing growth of 4% over the prior year. ARR results came in below our expectations and reflect continued healthy growth in our detection and response business, offset by both macroeconomic headwinds and continued pressure in our risk and exposure management business. Softness in our standalone vulnerability management business and a few delayed new deals were the primary headwinds, combined with an incrementally more cautious customer spending environment which muted potential upside drivers in the first quarter. Admit this, we delivered revenue and profitability that exceeded our guided ranges, and we continued to demonstrate strong operational discipline and free cash flow generation. Now, turning to the rest of our financial results for the quarter. Year-over-year ARR growth in the first quarter was split fairly evenly between new and existing customers. ARR per customer grew 2% year-over-year to approximately $72,000, and our total customer base grew 2% year-over-year to 11,685 customers globally. Revenue of $210 million for the first quarter grew 3% year-over-year and was above our guided range. Product revenue grew 4% year-over-year to $204 million. Professional services declined year-over-year consistent with our decision to de-emphasize certain lower-margin service engagements. International revenue represented 25% of total revenue and grew 10% over the prior year. On operating and profitability measures, our product gross margin was 76% and total gross margin was 75%. Sales and marketing expenses were 34% of revenue, reflecting disciplined investments and growth initiatives. R&D and G&A expenses were 18% and 8% of revenue, respectively, and consistent with our plan to prioritize targeted investments behind our core security operations platform and scaling our India Innovation Center. Operating income for the first quarter was $32 million and above our guided range due to the timing of certain hiring and G&A expenses. We now expect these costs will be reflected in the later quarters. Adjusted EBITDA was $39 million in the quarter and non-GAAP net income per share was $0.49. Turning to our balance sheet and cash flow statement, we ended the first quarter with cash, cash equivalents, and investments of $593 million. In early May, we fully repaid the remaining $46 million balance of our 2025 convertible notes, further simplifying our capital structure. Our existing convertible debt is attractively priced, and we plan to meet these obligations through a combination of cash on hand and free cash flow generated from the business. We believe this financial flexibility positions us well to continue investing in growth while maintaining a strong capital structure. Free cash flow for the quarter was $25 million. This brings us to our outlook for the remainder of the year. For the full year 2025, we are adjusting our ARR guidance to reflect the slower start to our year, along with increased uncertainty we're seeing in the market. While detection and response remains a consistent performer. The softness in our risk and exposure management business and lengthening sales cycles, particularly in March, have created more variability than we anticipated at the start of the year. As a result, we are lowering and widening our full-year ARR range to $850 million to $880 million, growth of 1% to 5% over the prior year, in order to better account for these dynamics. We continue to monitor the macro environment closely and are staying agile in our planning and execution. Given the changes in the ARR outlook, we now expect full year revenue of $853 million to $863 million, representing growth of 1-2% over 2024. Recurring product revenue growth will outpace total revenue growth, offset partially by a year-over-year decline in professional services. On operating profitability, we are reiterating our full-year operating income outlook of $125 million to $135 million. We are adjusting our full-year free cash flow guidance to a range of $125 million to $135 million to reflect billings and collection dynamics associated with our lower ARR outlook. Non-GAAP net income per share is expected to be between $1.78 and $1.91, based on approximately 76.7 million diluted weighted average shares. For the second quarter, we expect revenue in the range of $211 million to $213 million, representing year-over-year growth of 1% to 2%. We expect non-GAAP operating income between $30 and $32 million, and non-GAAP net income per share of $0.43 to $0.46, based on approximately $75.3 million diluted weighted average shares outstanding. In closing, while the broader environment remains cautious, we are confident that the steps we are taking, driving innovation in our product portfolio, deepening customer relationships, and operating with financial discipline, position us well to drive improved execution through the balance of 2025 and beyond. To close, I'd like to thank our teams for their hard work and continued focus as we execute against our long-term strategy. We remain committed to driving sustainable growth, expanding profitability over time, and reinforcing Rapid7's leadership and security operations. Thank you again for joining us today. Operator, we will now open the line for questions.

Thank you. If you would like to ask a question, please press star one on your telephone keypad. If you would like to withdraw your question, simply press star one again. Please ensure that your phone is not on mute when called upon. We ask that you please limit yourself to one question and rejoin the queue if necessary. Thank you. Your first question comes from Sakit Kalia with Barclays. Your line is open.

Okay, great. Hey, guys, thanks for taking my questions here.

Good. Hey, Sakit.

Hey, guys, maybe I'll stick to the rule just around one question and maybe make it for you, Corey. Can you just go one level deeper into why you think maybe the upgrade cycle on a closure command is just going a little bit longer than you expected? I mean, it's clearly a tough macro, but can you just maybe dig into some of the product considerations here as customers think about, you know, really consolidating multiple tools with that product?

Yeah. So if you look at the budgetary, or if you look at sort of, you can step back and say, like, why do customers want to upgrade to a product like Exposure Command? It's by and large, customers have a more complex risk environment. So they have more cloud assets, more SaaS assets. They need to actually look at risk across the environment. They need to understand their environment. They need to model their attack surface. And they need to manage their remediation and compliance across that complex environment. So complexity is the primary driver of demand. The reason that we actually have confidence in this cycle is we're seeing good interest in demand and solving the problem. We are seeing, especially in our core mid-market install base, is not readily available budget. And so part of, you know, how we think about the opportunity is where are we seeing budget that people can actually allocate and where are we not? As we enter the year, we actually looked at it across the board and thought that there will be a pace of upgrades across, which we still think that there will be a healthy pace of upgrades. But we are seeing a difference between those that can actually afford the budget and those that can't afford the budget. I remind you that we tend to have a more heavy-weighted mid-market install base, especially in traditional VM. And that's where we're expecting it to take a little bit longer on the time to actually get through that upgrade cycle, because it is incremental expense.

Got it. Very helpful. I'll hop back in queue.

Thank you very much.

The next question comes from Jonathan Ho with William Blair. Your line is open.

Hi, good afternoon. I guess one thing I wanted to understand a little bit better is when it comes to your expectations around the ARR side of things, I mean, clearly it's a bit more challenging here with the macro and with what's happened around exposure management. But what has to happen to sort of re-accelerate the ARR, and what could maybe be some upside scenarios here as we look at sort of the environment?

Yeah, thanks for the question, Jonathan. Look, we see two drivers, which is why we have a pretty wide range right now. The first driver is the continuation of what we're seeing right now. We've seen strong demand for detection response. We just expanded the offering to be able to actually go after more customizable, more enterprise use cases that just launched off. So we're expecting execution there. Now, those deal cycles are longer, and so we're not forecasting or making that completely into the plan, but we're definitely bullish on what we're seeing. And even with the performance in Q1, I would just say some things that were headwinds where deals got delayed in DNR and they showed up in the early part of Q2. We had some customers that had M&A. We still saw very, very healthy performance on DNR, and we just significantly expanded the market opportunity and the TAM there. And so that's an area where we actually have a lot of confidence overall. The second part is that, you know, the ability to upgrade our install base, we don't have to get to material parts of the install base to see upside. We are incrementally more cautious about the U.S. mid-market. We still see lots of strength internationally around the world. But when we look at sort of what it takes to see reacceleration, it's really sort of like, can we actually start to get the upgrade engine going? Keep in mind, the upgrade engine is a new engine for us. This is the first time in a long time that we've had the ability to upgrade a material part of the install base. And so, again, that's why we have a wider range. So, again, to simplify it, continued DNR momentum, pursuing the expanded DNR opportunity, which we just opened up from a product for Solio and we're well positioned to actually get. And then we need to actually see the upgrade cycle perform on the risk side. All of those give us plenty of room to actually achieve the upside. But timing is one of those things that we did not want to actually overcommit on the timing because the upgrade cycle especially could take a little bit of time. Thank you. Thank you very much.

The next question comes from Matt Hedberg with RBC. Your line is open.

Great. Thanks for taking my question, guys. You know, I wanted to follow up on Zakat's first question at the start. And, you know, it seems like, you know, Corey, you outlined a couple of steps for improving risk and exposure management that you talked about, enabling partners and accelerating migrations. I'm just kind of curious, what sort of timeline should we think about for stabilization, if not improvement, in that business?

That's a great question. And this is one of the things that we focus a lot on. I would say if you look at the guidance range that we actually have now, is we're expecting moderate stabilization over the course of this year. And then I would just say, you know, reacceleration as we actually move forward. When we look at the core drivers, you really do have to break it down and say what's happening by a segment basis. And so what we're finding right now is that customers that actually have flexibility in budget, we're seeing movement and we're continuing to see upgrade cycles, not at the pace that we would want to see, just to be clear, to offset the larger macro pressure. But we are seeing momentum and we are seeing upgrades and we are seeing improve points around those. The deal cycles tend to be a little bit larger, which is one of our indicators that we're seeing more pressure in our core mid-market install base. There are some things that we're doing around packaging and pricing to actually try to ease that upgrade cycle for that core mid-market customer. But to answer your core question is that we expect, I would just say, moderate stabilization as we actually go through the year. We are expecting it to be more pressure than we actually expected as we started the year overall in the risk and detection business. but we're constantly focused on what it takes to unlock that. The steps that you outline are sales and channel enablement, honing and tuning the pricing and packaging, driving campaigns against the install base and segmenting the install base, really focus on those who actually have the budget and the ability to actually upgrade overall, and most importantly, continuing to improve the product value proposition. Those are the keys that we actually see that drive the mid-term cycle there. In the interim, we're not jamming the timing on that. We're focused on, and we're focusing our sales teams and marketing teams on what's working. We have a strong value proposition in detection response. And so we're really focusing on that as we actually continue to drive the systematic upgrade of the install base. Thanks, Corey. Super helpful. Thank you.

The next question comes from Aaron Samuels with Susquehanna. Your line is open.

Hey, good afternoon. Thank you very much for taking the question. I wanted to ask a little bit more about the macro. You mentioned some pressure from U.S. mid-market customers. Do you have any call-outs in terms of customers that have been relatively more resilient, whether by customer size, geography, or industry vertical? Thank you.

No, it's a good question. You know, it's interesting is that I would just say customers where security is required and mandated are clearly easier to actually sort of like withstand and get the budgets more so that's why we find it more in both highly regulated industries as well as slightly i would just say not large large but i would just say the larger end of our install base you know when you think about that over a billion dollars of revenue customer set And so there tends to be more we have to solve. But we actually do see real benefits and tailwinds from the fact that those customers also have to scale their operations. And so we think that there's a real opportunity, especially with our expanded enterprise MDR offering, to actually be able to drive growth and acceleration there. So that's where we actually see opportunities. We also see lots of actually opportunities in Europe, especially outside of the U.S., where we continue to actually have healthy growth and healthy demand drivers overall. The places that we're seeing pressure are unfortunately places that are, you know, I would say critical to Rapid7's focus on resource constrained buyers historically is we see pressure in the health care sector. We see pressure in the education sector where, again, they're still moving forward, but those deals are definitely taking longer. And there's lots of budget concerns as you go around. Same with state and local sectors. And then we talked about sort of like the general market. So we see areas of strength. We also see areas of pressure. The one thing I'll say as you look across those things, we are seeing, even though it may take a little bit longer, the DNR projects are closing. Now, people want to make sure they get great value for what they're getting, but those DNR deals and our closing and moving forward. We saw those in the month of April that slipped from March. So it was very positive. Thank you for the question. Thank you.

The next question comes from Fatima Balani with Citigroup. Your line is open.

Hey, good afternoon, team. This is Mark on for Fatima. Thanks for taking our questions. Maybe just on the challenging macroeconomic environment and also the new upgrade cycle motion that you guys are seeing, can you maybe speak to the level of growth churn and attrition during the quarter? Any sense of observed disruptions from the upgrade cycle? And related to that, any color you could provide on NRR would be great.

Yeah, no, it's a good question. So when you look at the churn that we actually saw, it's pretty consistent with what we actually saw exiting last year. So if you think about the pressure from a net AR perspective, is the churn was consistent, especially in the risk business with what we saw exiting last year. It was a pressure environment. So we didn't expect any major changes overall. I will say that we were pressured more on the new side of the equation in that core mid-market space. As you think about sort of like the traditional vulnerability management growth, while it's not a big factor, it's still sort of a factor when you think about total net AR growth. But churn was relatively consistent to what we expected as we actually exited last year. And the upgrade cycle hasn't been a major factor in the churn overall. If that's the core question, is this putting more deals up for risk? No, we're not seeing that at all.

The next question comes from Patrick Colville with Scotiabank. Your line is open.

Thank you so much for taking my question. I guess, Corey, I mean, this one's for you. I mean, in the quarter, we had, I mean, RSC conference recently and, you know, a large, I guess, platform cybersecurity company best known for its endpoint tool put into GA, its network-based VM. I guess clearly too early to tell what that might mean, but can you just have some thoughts on what this entrant could need for Rapid7 and how you guys are going to compete against them to lock them out? Thank you.

Yeah. And so when we look at VM, we consider VM to be a hyper-competitive pressure, but also in that high growth space. And so we do have to actually defend and upgrade. Our strategy is pretty straightforward. We uniquely have a very differentiated approach to actually provide an integrated risk visibility across the attack surface, which is what people are looking for now. I've said it before. If you're looking at monetizing just traditional standalone VM, it's going to be an unattractive business. Part of what we're doing is part of the upgrade cycle is we're drawing down the value of historical traditional standalone VM and providing more value from the ability to actually track all the assets, resources, technology across the attack surface. look at the integrated risk profile across the attack surface, manage remediation across the attack surface, and manage compliance across the attack surface. I looked at all the announcements at RSA. None of them are actually taking that truly integrated approach overall there. So we think that our upgrade strategy, this is why we said that it is an imperative to upgrade our install base because we are upgrading in a way that actually makes us stickier. And so that's a no. We have to execute on it, but that's a no-no. But the other part of it is, you know, there's a lot of focus, and I would just say it is defense, and we are definitely declining on the overall traditional vulnerability management market, and that's the imperative to upgrade. But the other part of that is to actually continue to play offense about what's working. And the DNR growth engine also provides a stickier avenue and approach for those VM customers as they consolidate on the platform. And so if you think about our strategy of defense is two-pronged. If we have a bunch of, I would just say, stranded vulnerability management customers that don't have any sort of like other compelling value, then that's at a higher risk for disruption. And we acknowledge it. That's the imperative there. But either upgrade to exposure command or upgrade them to our deintegrated detection and response offering, those customers are much, much more stickier. And we've already seen that with our overall DNR customer base. So that's the strategy and that's the approach. I would just say, regardless of what anyone does, standing still was never an option. We've known that. We could have managed to change better, but we've known that standing still was never an option, we are in a good place that we have massive momentum and we are participating in a core growth market. And we're getting more than our share of that core growth market, which is DNR, as we actually then address the changes that are happening in the vulnerability management market overall, which we forecast and saw that coming.

Very good. Thank you so much, Corey.

The next question comes from Eric Heath of Key Bank Capital Markets. Your line is open.

Hey, Corey. Thanks for taking the question. And Corey, just curious to understand, maybe at a high level, how much of the success on DNR is dependent on the install basis of VM? Can DNR continue to grow double digits if VM continues to decline? And Tim, if I could sneak one in, I think in the past you've given some guardrails on ARR for the upcoming quarter. So just curious if there's any guardrails on 2Q ARR.

Thanks. so um to answer your core question is we've been pretty lucky with the dnr business is that the growth has actually come from both within our install base i'll just point out that we still have massive upgrade opportunity within our overall install base both on the exposure command upsell basis but also on the existing dnr and technology customers in the install base so we still have plenty of upgrade room that's one of our under leveraged opportunities that we're really focusing our sales engine on building the motion about how do we actually expand and grow in the install base. So, you know, to answer your question is one, are we running out of room because of the VM dynamics is no, we have massive room in the VM install base. I think the second part of your question is, is when I think about it, it's, do you actually have a land motion independent of the install base? And yes, the unique thing about our DNR business, and this is what makes us very proud is that we've always been able to actually add new land customers. And I'm not saying that's like 10%, 20%, it's been pretty close to half of the install bases actually come from new land customers, which is much higher than we expected. So we still have more than enough land engine to actually drive sustained growth as we actually go forward in that business overall. Even as we have opportunities to upgrade existing DNR businesses, our focus and what some of the stuff that we're actually launching later this year around AI for our DNR customers, we think will actually be a boon for both our technology customers, but also for our MDR customers who continue to want us to cover and manage more and more of the environment. You're seeing some of the early indicators of that with our recently launched enterprise MDR customizable service and business where we're using more and more AI for that. And that's a great opportunity. To get your last point is, Tim, you can do a quick one on the thing because we're supposed to keep everyone on the question.

Yeah, Eric, on Q2, I would say we're anticipating a modest increase from where we ended Q1. And our full year guide for the year is more second half weighted this year. Thank you.

The next question comes from Greg Muskowitz with Mizuho. Your line is open.

Thank you for taking the question. Corey, anecdotally speaking, why is it that the U.S. mid-market does seem particularly cautious about spending right now? For example, are customers deliberating for a longer period of time as they decide how So specifically, they may consolidate in cybersecurity and with which vendors, where tariffs mentioned at all as an issue in late March or in April. Any additional color here would be helpful.

Yeah, look, I actually think it's general uncertainty. What we found in almost every cycle, you know, we've had the, we're probably one of the few cyber companies and enterprise companies that had a mid-market business for longer. So we've seen a lot of these cycles. The mid-market tends to respond faster to economic pressures. It tends to shut off faster, come on faster. And so that's not anything new, which is why, as we saw things play out in the early part of the year, we actually did shift our position to take a more and we talked to them and validated we'll take a more cautionary approach. Now, to get down to the reasons is that they vary, very differently across the industry. So manufacturers, of course, worried about tariffs or cost structures, pricing, how much they can accrue from their businesses. The midsize health care companies are clearly worried about margins, whether you are a health provider or health insurer. That is a concern that you're actually going to have regardless. Retailers are very worried about their cost structure. So, again, I won't say it's a formal survey, but we do do our pressure checks across a bunch of different segments. And so it does vary about what the pressure is. But what I'll tell you is that we saw it in the COVID cycle, we've seen it in the previous cycles, is retail customers tend to pause and wait to see what's happening much faster than some of the larger customers, some of the larger enterprises. And then one thing that's unique is we all see more pressure in the education sector that's go around for obvious reasons. Exactly. Thank you.

Thank you. the next question comes from gray powell with p tig your line is open okay great um thank you very much um so yeah another another question on the macro environment i mean everything you said uh makes a lot of sense and i just really appreciate um you're being up front with everybody uh i i am curious like can you give us a sense as to the tone of customer conversations in April and May. And just broadly speaking, my understanding was that people were pretty panicked the week after Liberation Day. And I actually heard some people say it felt like March of 2020. But once the tariff pause went into place on April 9th, I was hearing that things started to fall out. So I'm just curious if you heard anything like that. Did any conversations start to improve the last few weeks?

Yeah, absolutely. I mean, so Tim said earlier, we have closed some of the deals that we were worried about. You can make an argument that things are stabilizing. I think anyone who would actually estimate that things stay stable in this environment is probably a little delusional because I think we're probably in an up and down cycle on the news cycle. But I would just say there's just as much reason to actually see stabilization and upside as there is to see downside pressure. I just want to be clear. We're not, I would just say, overly pessimistic about the macro. We just realize that now there's a wider range of outcomes there. We have seen some customer deals progress and move. We see continued opportunity creation. So it's not a negative read. I would just say on balance, we see increased pressure. But as you said earlier, is people do respond to actually what's in front of them. And it feels like it's not the worst of the worst right now would be my read of it. But I don't think yet what I would consider a stable macro environment. I think there's a lot of unknowns and we're trying to reflect that. That's why you see we actually have a wider range here because, you know, we have, you know, we have the upside and we have the base case and we have the downside scenario. But that required a wider range. Understood. Thank you very much. Thank you.

The next question comes from Roger Boyd with UBS Securities. Your line is open.

Awesome. Thanks for taking the questions.

Corey, you mentioned confidence in the CNET product, and I understand it's a big opportunity there, but I think we've all kind of seen that it's incredibly expensive to compete there. There's been others in that space that have been there for a long time that are now looking to partner. How are you thinking about the health of the cloud security market, and how do you think about kind of the investment strategy to capitalize on the opportunity there?

Yeah, no, it's a great question. So I would just say we've been very deliberate about how we think about it. Our primary focus is just upgrading the install base to our integrated offering. And we have lots of, I would just say, leverage to actually pull there. This is not one where we're going to go out and spend a ton of money trying to acquire new land in cloud security is we think we can provide compelling economically leveraged upgrades for our customers and our install base. We think that our install base is underpenetrated of having any cloud security solutions there. That tends to just describe a little bit of the resource constrained buyer that we have heavily in our install base. And so we see that as the primary opportunity, which is a much more efficient cost of sales and marketing. That's it. We are maturing in our ability to actually pursue that opportunity, because this is probably the first time in a long time that we've had a big upgrade cycle in front of us. So we're getting the engine ramped and targeted. You know, I was talking to one of our sales leaders earlier today and they said, listen, we're starting to actually progress and ramp up the sales engineer. But we are targeting a much more efficient growth opportunity there is which is really how do we grow the install base? You know, I'll remind you is that to achieve success, you know, we actually just need a moderate uplift across, you know, a moderate portion of our install base. And that actually drives stability, which takes away negative growth engine and our overall risk and exposure management install base, puts it to net neutral to slightly positive. And then we can actually really leverage the tailwinds that we see on the traditional DNR side of the equation. That's the dual focus is, you know, in some ways we have a tail of two cities. So stabilizing and getting to neutral or positive on the risk and exposure, which is really about upgrading the install base, even acknowledging some of the traditional churn pressure, while we actually continue to actually really focus on the massive growth engine that is that DNR business.

Great. Thanks very much. Thank you.

The next question comes from Joshua Tilton with Wolf Research. Your line is open.

Hey, guys. Can you hear me? Yes, you can. Great. Thanks for sneaking me in. I want to start by echoing Gray's comments. I appreciate you guys being up front on what you're seeing out there. The one I had is just kind of parsing out some of the comments that have come out during the Q&A. And I guess, you know, in the prepared remarks, you talked to DNR still being, you know, mid-teams growth, but some deals slipped. It would have been better. But those deals have closed. I guess, was that a macro dynamic? And then did you see a similar dynamic on the risk and exposure side of the business in the sense that, you know, you had a light quarter, but what has happened to those deals since and what's expected in the guide for everything that slips going forward?

Yeah, no, it's a very fair question. So on the DNR deals that actually slipped, what I would describe, it was just very large deals, so it's easy to count them. like it's a handful of, not even a handful, it's a couple of deals that just happened to be very material in orientation. And the reason that they slipped were probably, I would just say, macro pressure situation. You know, one was a large educational institution, which, you know, really needed to see how things were going to actually play out. And another was in the retail sector. And so, you know, those are sectors. We had a smattering of, I would just say, manufacturing companies too, that I think most of those have actually since closed, not all. And then when you look at the risk exposure management side, keep in mind our strategy on the upgrade, it's just much smaller ASP. So it's not that you didn't have deal slippages on that side. It's just, it's not as concentrated. The DNR business tends to actually have larger average ASPs and then wider ranges overall. And so that's the read through is that, And then on your question about what's, you know, in the guide and the expectation, look, our core guide is really anchored on, I would just say, consistent DNR performance, which is, I would just say, in line with what we saw in Q1. There's no real deltas that we're experiencing there overall. I would say the range of outcomes on the high and the low is that do we actually get some acceleration in DNR based on the expanding offerings that we think are pretty competitive? That's upside there, but without the history, it doesn't make sense to make it into the And then we are more modest on balance on the pace of the upgrades, which can offset some of the VM pressure. We're working very, very hard to actually drive the upgrade cycle and operationalize that. But I would just say incrementally versus the start of the year, we are expecting that cycle to actually take a little bit longer. And we're expecting to see continued pressure in the overall traditional vulnerability management business for all the reasons that we actually talked about earlier. Do we have upside there based on the upgrade cycle? Absolutely there, but we're at where we are based on what we've seen so far. Super helpful. Thank you.

The next question comes from Shrenik Kotari with Robert Baird. Your line is open.

Great. Thanks for taking my question. So, Corey, you mentioned, of course, structural pressures in traditional VM and slower mid-market. Despite all of that, you've been able to drive MDR growth, which is anchored in, of course, lower TCO via AI automation, but also differentiating beyond cost. So on the risk and exposure management, I hear you mention about, of course, packaging pricing, partner enablement, but in terms of messaging, right, you did touch upon that. How are you aiming this broader risk and exposure management to differentiate your approach, Robinson's approach from other VM players. I had a quick follow-up after things.

So I think the question is, how are we differentiating versus traditional VM players? Well, one, I would just say, listen, we have to recognize that the VM market has a lot of approaches, players, avenues. I would just say it overlaps with the cloud market in some ways. We've taken a very, very specific approach of focusing on integrated risk management. And so the way to think about that is that what's unique about us is we're one of the few players and the only player I'm aware of that fully out of the box integrates all the assets, all the information, all the context in your environment. We actually consolidate risk across the environment, not just from our tools and technologies, but across the environment. We have open APIs. People can collect our data, too. We believe in open APIs to support that. And we think that's good for the technology industry in general. We consolidate the remediation across the environment. We have some enhancements later that are going to accelerate our ability to process and help customers drive compliance, leveraging AI across the environment. And then we actually build automated workflows. In general, the way to think about what we're doing is when you think about the CTM structure that Gartner recommends across is our big focus is about being the integration engine behind that and enabling the automation of the response and management of those processes. We see ourselves as highly differentiated. There's areas that we're catching up, like some of the long tail of the cloud capabilities that some of the cloud pure plays have actually done, is we're playing catch up in some of those areas. But when we look at our core install base, while they may be more budget constrained, they may be more resource constrained, lots of them are trying to figure out how to actually get efficacy at scale. And we think we have a great story and a great solution for that install base.

The next question comes from Aiden Perry with Piper Sandler.

Your line is open. good afternoon this is a non for rob owens and thank you for taking my question um you mentioned earlier that complexity is a driver demand and with the launch of mdr for enterprise do you think these new capabilities will allow you to go after specific verticals with complex environments more effectively or is this offering intended to address large customers more broadly thank you uh it's intended to address large customers more broadly um but look there's also some large verticals that we see, like, you know, we've gotten lots of demand from the manufacturing vertical, for example, which really has a massive amount to manage.

And they're looking for scale help. Healthcare, we actually see, you know, on the larger end, real dynamics there. So, you know, think about our sweet spot here is very, very large customers that have to scale. Security is mandatory. They're looking for a partner. They have some security resources, but they're looking to scale. The unique thing that we do is we help them understand what their attack surface is. We actually help them monitor 100% of the attack surface at efficacy. They know that they have to monitor not just the endpoints. They know they have to monitor the identities, all the cloud resources, which are incredibly noisy across that environment. They know that they actually have to actually process all the security telemetry together. They have to reconcile the data. We're leveraging both AI and our talent to actually do that. And so we're adding real scale to those organizations, and we're assisting them in a way that works for them. This took a lot of effort and investment to actually be able to do that in a way that had healthy gross margins, but could operate in a way that customers want. So we're incredibly excited about the launch. That is one of the upside drivers for the year. We had a nice warm reception from our initial pilot customers and some of the customers at RSA, but that is a growth driver, but I would just say it's, you know, think about very, very large resource-contrained buyers. We offer the best economic solution to actually get efficacy at scale.

The next question comes from Joe Gallo with Jeffries. Your line is open.

Hey, guys. Thanks for the question. Last quarter, you announced, you know, heavy investments for DNR, which seems justified, but maybe can you just talk a little bit about your overall profit versus growth framework? Are some of these investments collude if growth doesn't accelerate and then maybe how do we think about sales capacity as well?

No, there's a lot of questions built in there. So let me just sort of hit a couple of ones. One, look, like any company, we need to invest behind growth opportunities. In detection and response, we have a massive market, we have a healthy position, and we can actually create an even stronger position and frankly expand our addressable market there. So that's a clear, I would just say, profitable growth opportunity. You know, in almost any definition, you actually invest for profitable growth in the growth opportunity. When you think about the allocation of resources across, is that, again, we're not trying to be all things to all people. We're focused, when we think about outside of that, things that reinforce our overall stack. So we're going to be the best at actually integrating telemetry across the environment. That's both the entity data, the risk data, and the monitoring data. So our integration engine is a core investment prioritization that we're focused on across the environment. And then we're going to make sure that we actually have the right capabilities to serve our core mainstream customer when it comes to the risk and the exposure at the best economics. So we have a rational allocation view. It takes focus. It takes discipline around it. But we are invested in the areas that actually have the best growth profile. And you continue to see us sort of like both innovate, partner to actually drive success in the overall market.

Yeah. Hey, Joe, it's Tim. I would just underscore something Corey brought up earlier. Selling into the installed base, as you know, we're just under 12,000 customers. And that really creates a large market opportunity for us with customers that we have a good relationship with, you know, on the expansion motion. And that does come at a lower cost of sale for us. So that's one area where we can see leverage in the future.

Yeah, and I go to market motions are pretty straightforward. And I go to market motions are pretty straightforward. It's the, if you look at what we're doing, we are driving the integrated land motion about, like, looking at how customers look at integrated security operations. We're upgrading our install base VM to exposure command, and we're driving adoption as our big thrust in detection and response.

Thank you.

The next question comes from Adam Borg with Stiefel. Your line is open.

Awesome, and thanks for fitting me in. Maybe just building off of Joe's question. So when we think about the new stock in India, maybe, Corey or Tim, you could talk a little bit more about how that's supposed to help, not just from an innovation perspective, but also from an efficiency perspective as well.

Yeah, there's a couple of elements. So one, if you think about our operations in India, India is another global development center, just like we have a couple of them in the U.S. We have one in the U.K. Today, we just opened up a development center specifically in Prague, and now we'll have a global operations center in India that'll have some development, some security operations. I would just say, just to be clear, the number one driver of the center that we're doing for this SOC, we need to go out to SOC in India, is that we've had significant growth in EMEA and APAC in our core detection response business. And so having people that are in regions that have over-large lapse that can actually do multiple time zone coverage is a response to customer demand. That's the number one drop. It happens that that also has some economic benefits, but I just want to recognize that the customer benefits are massive and significant because that's where the growth is. Again, our thesis is very clear, just invest behind the growth. So we see great growth internationally in those regions and we're invested behind it. That said, when you think about how do we actually scale DNR and we have big MDR demand, we're customizing more of it, you have to engineer that in, you have to have a product-based approach. And also it's a combination of technology and sort of like the cost of the talent there. I want to be clear, is there's definitely cost talent arbitrage stuff in there. But if you say, what's the majority of the cost efficacy that's going to allow us to continue to scale this business as it actually serves more and more customer use cases, it's definitely the investments that we're making in our adoption of AI technology, which was a big part of the investment thesis that Tim laid out earlier. And again, I met with our team over the last couple of weeks, and that is on track and frankly accelerating the investment that we're actually having. Our belief is that our technology and the AI investments that we've actually already made, and they're in the stock, and frankly, we're going to make available to our broader customer base a little bit later this year, are already yielding massive dividends that are allowing us to actually run at better operating margins from a traditional MBR player. And if you say where most of the gains is going to come from, it's going to come from the technology innovation side of the equation. Yes, there'll be lower cost talent that's going to actually play a factor there. But we're seeing real gains from sort of our ability to leverage both AI and automation to drive the efficacy of the stock. And that'll be the dominant driver of how we continue to actually have better margins than most traditional MBR players.

Corian, we're already seeing that in the numbers on international.

It's 25% of revenue and it's growing faster than what we saw in the u.s at 10 as part of how we're actually able to actually even with some of the wider ranges continue to manage profitability this year because we're already seeing some of those benefits that is all the time we have for questions this concludes today's call Thank you for joining.

You may now disconnect.