Good day, everyone. My name is Leila, and I will be your conference operator today. I would like to welcome you to the Q3 2025 Rapid7 Earnings Call. I would like to turn the call over to Ryan Gardella, Investor Relations.

Thank you, operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's third quarter 2025 financial and operating results. In addition to our financial outlook for the fourth quarter and fiscal year 2025. With me on the call today are Corey Thomas, our CEO; and Tim Adams, our CFO. We have distributed our earnings press release over the wire, and it is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast. And following the call, an audio replay will be available at investors.rapid7.com. During this call, we may make statements related to our business that are considered forward-looking under federal securities laws. These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to the company's financial guidance for the fourth quarter and full year 2025 and the assumptions underlying such goals and guidance. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the future results expressed or implied in these statements due to the number of risks and uncertainties, including those contained in our most recent quarterly report on Form 10-Q filed on August 8, 2020, and in subsequent reports that we file with the SEC. The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements. and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by applicable law. Our commentary today will primarily be in non-GAAP terms and reconciliations between our historical GAAP and non-GAAP results can be found in today's earnings press release and on our website at investors.rapid7.com. At times, in our prepared comments or in responses to your questions, we may offer incremental metrics to provide greater insights into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be one-time in nature, and we may or may not update these metrics in the future. With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey?

Thank you, Ryan. And welcome to everyone joining us on the call today. Rapid7 ended the third quarter with $838 million in ARR, growing 2% year-over-year as we innovate on our AI-powered SOC vision but continue to see timing variability within our large deal pipeline. Revenue for the quarter was $218 million and operating income was $37 million, both ahead of our outlook. We once again delivered strong free cash flow of $30 million generated in the quarter. The key message I want to leave you with today is Rapid7 has made and continues to make significant organizational changes to accelerate our go-to-market motion, capture the large opportunity in front of us in AI SOC and position the company for accelerating top line growth. We have a leading franchise with a competitively strong set of capabilities that we continue to invest behind. We have alignment to move as quickly as possible across all dimensions of our organization to improve and capitalize on the opportunities in front of us. This includes several recent senior leadership changes, including our new Chief Commercial Officer, Allan Peters, who joined us in early September, and today's announcement of Rafe Brown as our next Chief Financial Officer beginning in December. It also includes operational changes Allan is beginning to implement in the fourth quarter to better align resources and incentives for growth in 2026 and beyond, particularly in our MDR business, which is more than half of our ARR and continues to grow double digits, but which is part of our business where we believe we can focus more resources to accelerate growth with attractive margins. I will discuss this in more detail in a bit. We are confident that we are making the right changes to reaccelerate Rapid7, but we also acknowledge that we have fallen short of the ARR guidance that we have provided to you in recent history and thus far this year. As we take action across the organization, we view it as imperative that we rebuild confidence in our guidance with the investment community. As such, with a new CCO and CFO and recognizing the operational changes we are enacting may create higher near-term forecasting variance, we are today reducing our 2025 ARR target to reflect a higher confidence outlook. The new target is based on what we have experienced year-to-date and now embeds a discount of the new business win benefits expected from Q4 seasonal budget opportunities for the potential impact of the changes that I discussed. Based on our competitive product position and growth across our markets, all of us at Rapid7 believe we're capable of executing better. Let me tell you why and where we are investing in our organization to drive us forward. It is clear that customers are significantly involved in how they operate their SecOps programs. Seeking to integrate AI as they look to consolidate core elements of exposure and direct response in the SOC. We built Rapid7's Command Platform, an AI-powered security operations platform that unifies exposure management and threat detection response to enable quicker execution and accelerate remediation outcomes through deeper and more integrated situational awareness of risk and threats across customers' attack surface. We're optimistic about our roadmap and strategy, yet we maintain a realistic view that these larger platform consolidation opportunities naturally lend themselves to longer, more competitive deal cycles. We have seen this affect quarterly deal timing and overall growth performance throughout the year. But the scale and quality of recent wins demonstrate strong market validation of our platform approach. And as we are seeing adoption from mainstream customers committing to an integrated solution. A great example of this was a competitive six-figure win during the third quarter with a large Tier 1 public university. We were brought in to replace their disparate multi-vendor tech stack across exposure management, SIEM and Managed Detection and Response. The customer security team faced friction trying to leverage a fragmented tool set and legacy technologies. While their initial exploration was around MDR, our holistic security operations offering, including full visibility and access to our market-leading SIEM, coupled with unlimited IR and integrated vulnerability management and delivered via a global 24/7 SOC was a value proposition that no competitor can match. These types of deals highlight our leadership position, strong platform value and right to win in our detection response business, which continues to serve as a core growth driver of our business. This is a great validation of why Rapid7 is well positioned to help customers integrate leading AI capabilities and experiences into their SOC while unifying their overall security operations tech stack through our integrated Command Platform experience. With years of experience operating in a scaled global 24/7 managed SOC, we have a significant advantage in proprietary data, expertise, and as a result, agentic AI capabilities. And we're taking deliberate steps to sharpen our go-to-market focus and execution as we look ahead to 2026 spearheaded by Allan as I referenced. Although Allan has only been in the seat for a few weeks, he is already sharpening the discipline and operational focus around the execution as we aim to accelerate our position and market capture in our AI-led D&R space looking ahead. As we'll discuss, we believe we have the products and capabilities to be one of the leading providers in this space. Accelerating our focus to enhance our operational alignment with faster revenue opportunities remains our top priority, and we're confident in our path forward. We're doing this through both focused product innovation as well as some deeper partnerships that enable us to more seamlessly extend the value of our customers' existing ecosystems. A great example of this was our recent announcement of our expanding partnership with Microsoft to advance modern detection and response by helping organizations simplify and strengthen their detection and response capabilities across their Microsoft environments. Rapid7's new MDR for Microsoft solution integrates a dedicated service with Microsoft Defender that provides comprehensive coverage across endpoints, cloud, identity and email. This new collaboration brings together Rapid7 SOC expertise with the Microsoft security ecosystem to simplify operations, strengthen protection and unlock new value for joint customers. By combining the power of Microsoft's advanced telemetry and analytics with Rapid7 human-led threat expertise and AI-driven operations, organizations can gain faster, more precise detection and more contextually rich response playbooks to stop threats before they impact. Overall, our strategy is well aligned to what we're seeing in the market. Customers are increasingly prioritizing unified data collection and AI in the SOC to achieve better security outcomes than they can achieve with their existing fragmented tool sets. Security teams need platforms that deliver comprehensive attack surface visibility and threat context to enable efficient decision-making and faster, more automated response to threats that are happening in their environment. Demand for integrated exposure and detection programs is growing, amplified by regulatory pressures for compliance and reporting. These trends align directly with the broad SOC capabilities embedded in our Command Platform, focused on expert-guided AI, both for exposure, remediation and threat response, alongside automation and a strong return on investment. Our head start from operating our own SOC for years positions us uniquely in this market. A great example of this ongoing convergence within customer environments was a six-figure deal in the quarter with an existing exposure management customer. This customer was looking to address detection gaps that they were experiencing within their existing program. The combination of our broader telemetry coverage, demonstrated superior detections and a cost-effective platform value proposition, all of which was fully integrated with their existing exposure management platform, drove this retail customer to displace their existing MDR vendor with Rapid7's Managed Threat Complete offering. Our long-term strategy remains centered on scaling our AI-driven security operations command platform with increasing focus on accelerating our growth transition towards our scaled market-leading MDR position as we look ahead to 2026. The Command Platform integrates native telemetry, Open Data integration, curated intelligence and automation into a unified system for risk remediation and threat response that rests on three core differentiators. First, our open platform with over 500 integrations addressed fragmented attack surface use. These integrations unify diverse data into a deconflicted contextualized perspective, providing holistic environmental understanding. Second, our expert-trained agentic AI workflows draw from years of SOC expertise, live playbooks and real-world feedback. These proprietary engines enhance outcomes in real time and are embedded in our MDR offering. Third, we drive automated measurable progress, not just alerts but actions. From AI-informed response to prioritizing misconfigurations and coordinated incidents, we reduce mean time to detect, respond and remediate. Our innovation across these areas fuels our unique position as a leading provider across both the exposure management and detection response market, demonstrated by the breadth of analyst recognition we received within just the last quarter, including our seventh consecutive recognition in Gartner's Magic Quadrant for SIEM, our position as a leader in Frost Radar for Managed Detection and Response, our recognition in Forrester's Unified Vulnerability Management Wave and our leadership position in IDC's MarketScape for exposure management. Overall, our AI-powered security operations platform that unifies exposure management and detection and response and a single customer experience is resonating with customers and industry analysts alike. And is a strong foundation to support improved execution as we look ahead to 2026. As we drive towards this unified AI-powered SOC vision, the integrated platform experience between our managed D&R and exposure management capability remains a key differentiator, delivering deeper visibility and contextual awareness around threats. We believe we're just scratching the surface here, and we continue to innovate demonstrated most recently by our announcements of AI-generated risk intelligence delivered through Rapid7's Remediation Hub. This new AI-driven risk and vulnerability intelligence will empower security teams to prioritize and remediate security threats faster, an outcome that is core to our vision around unified exposure management in the SOC. A key pillar of our growth this year has been around our exposure expansion engine, which is anchored on transitioning our traditional VM customer base through this integrated outcome-focused exposure management model through Exposure Command. We continue to see a steady increase in the upgrades and expansions of our core base of Exposure Command in Q3. And looking ahead, Allan is keenly focused on improving our execution around this expansion engine. This is an area where we have fallen short of our goals this year. However, we view this as an execution shortcoming, and we remain confident that delivering a single contextualized risk view across cloud and on-prem environments with AI-powered insights and particularly in the context of Managed Detection and Response program will enable better risk prioritization and remediation and ultimately deliver improved security outcomes and customer environments. Shifting now to an important and exciting leadership update, which we announced today. I'm pleased to welcome our new Chief Financial Officer, Rafe Brown. Rafe is an outstanding leader with extensive executive leadership experience across multiple public companies, most recently at Mimecast, where he initially served as Chief Financial Officer; and then later as President and COO. His track record of driving operational excellence, scaling growth in SaaS businesses and building high-performing teams makes him an exceptional addition to our leadership team. I'm thrilled to welcome Rafe to Rapid7 and look forward to his arrival later this year and to continue to work with him to drive our business forward. In closing, as we look ahead, we're confident that we have the right strategy, and we are moving as fast as possible, including our recent leadership additions to position Rapid7 to improve our midterm growth execution. We believe there is significant inherent value in our platform that is not fully reflected by the market at this time, and we're taking direct action to address this disconnect. Managed Detection and Response continues to fuel a strong growth opportunity for us and our differentiated Command Platform rooted in automation, integration and expert-guided AI is more relevant than ever. We're focused on continuing to innovate, execute efficiently, and position ourselves to deliver outcomes for our customers, our shareholders, and our team. Thank you for joining us today. I appreciate your support. And I will now turn the call over to Tim to walk us through our financial results in more detail.

Thank you, Corey, and good afternoon to everyone. We appreciate you taking the time to join us on today's call. Before I turn to the results, a quick reminder that except for revenue, all financial results we will discuss today are non-GAAP financial measures, unless otherwise stated. Additionally, reconciliations between our GAAP and non-GAAP results can be found in our earnings press release. Rapid7 ended the third quarter of 2025 with $838 million in ARR, representing a 2% increase year-over-year. Revenue and profitability were above our guided ranges and as in prior quarters, we continue to see promising signs for future growth in detection and response and progress in Exposure Command adoption. While in general, we've seen the customer spending environment challenged by additional scrutiny, particularly in large deals, we have been focused on enhancing our product capabilities to address a challenged threat environment driven by escalating AI-enhanced threats and cloud migration demand. Turning to our financial results for the third quarter. Year-over-year ARR growth in the third quarter was driven predominantly by 2% in ARR per customer. And we ended the third quarter with over 11,600 customers globally and average ARR per customer of over $72,000. Third quarter revenue of $218 million grew 2% year-over-year and exceeded our guided range. Product subscription revenue also grew 2% year-over-year to $210 million. Professional services continued to decline year-over-year consistent with our expectations and decision to deemphasize certain lower-margin services. International revenue represented 25% of total revenue and grew 8% over the prior year. On profitability measures, our product gross margin was 75% and total gross margin was 73%. Sales and marketing expenses were 33% of revenue, slightly above the prior year at 31%. R&D and G&A expenses were 17% and 6% of revenue, respectively, compared to 16% and 6% in the prior year. Operating income for the third quarter was $37 million and above our guidance range, driven by natural leverage in the business as well as timing of spend as we continue to focus on making targeted growth investments and scaling our India capability center during the second half. Adjusted EBITDA was $44 million in the quarter, and non-GAAP net income per share was $0.57. Shifting to our balance sheet and cash flow statement. We ended the third quarter with cash, cash equivalents and investments of $635 million compared to $600 million at the end of the second quarter. We generated free cash flow of $30 million in the third quarter, bringing our year-to-date free cash flow to $98 million, and we remain well on track to achieve our full year free cash flow targets. This brings us to our outlook for the remainder of the year. As Corey referenced, we believe we are well positioned to help customers and prospects integrate our leading AI capabilities and experiences into their SOC as we look ahead. At the same time, we are managing active change during the fourth quarter, both from a leadership perspective as well as we accelerate our focus and operational alignment toward our fastest growth opportunities as we look ahead to 2026. We have factored these dynamics into our fourth quarter ARR outlook, which now calls for ARR to end Q4 approximately flat quarter-over-quarter. Turning to our other guidance metrics. We are tightening our full year revenue guidance range to $856 million to $858 million, representing year-over-year revenue growth of 1% to 2%. Full year recurring product revenue growth will continue to outpace total revenue growth, partially offset by year-over-year declines in professional services. Moving to profitability. We are raising our full year operating income guidance to the upper half of our prior range and now expect to deliver $130 million to $135 million in operating income for the year, representing an operating margin of 15% to 16%. We continue to generate strong free cash flow and are reiterating our full year free cash flow target range of $125 million to $135 million. Finally, we now expect non-GAAP net income per share for the full year of $2.02 to $2.09 based on approximately 75.9 million diluted weighted average shares outstanding. Turning to fourth quarter guidance. We expect revenue in the range of $214 million to $216 million. We expect non-GAAP operating income of between $25 million and $30 million and non-GAAP net income per share of $0.37 to $0.44 based on approximately 76.6 million diluted weighted average shares outstanding. In closing, I'd like to thank everyone for their support during my time as Rapid7 CFO, including our Board, our investors and analysts, and most importantly, our team here at Rapid7. I would also like to welcome Rafe Brown to the team and wish him the best. Thanks for everything, and I look forward to continuing our relationships in the future. With that, I want to thank you for joining us on the call today, and I will now turn the call back to the operator to open the line for questions.

Our first question will come from Rob Owens with Piper Sandler.

Great. Hopefully, you can hear me. A couple for you, Corey, is the business seems to shift towards MDR. Can you talk about the economic model? And despite the success you're seeing here, it doesn't seem to be dragging on margins either from a gross margin or operating margin standpoint. So I would just love to understand that. And then I'll just ask the second one upfront. Can you maybe parse for us the success that you're seeing internationally versus what you're seeing domestically? And just looking at the dispersion between those 2 growth rates?

Thank you, Rob. We can hear you well. Regarding MDR, we achieve a higher gross margin and overall profitability compared to typical MDR companies. This is largely because we've taken a measured approach to growth historically, focusing on building our automation and now AI capabilities to effectively integrate them. We believe we can deliver modern managed services with better quality, effectiveness, and higher gross margins than in the past decade, with AI playing a crucial role, particularly through AI SOC. This year, we made significant investments in this area and are progressing well, which is generating strong economic returns and allowing us to expand our growth potential. Now, we can profitably scale nearly half of our business with increasing market opportunities. We are confident in our robust economic model that provides a solid foundation for future growth. However, we deliberately paced our approach to ensure we developed the necessary automation and core technology to sustain a high-quality, high-margin business over time, which required time and careful planning. Your second question was...

Yes, Corey, I think his second question was the success we're seeing internationally. It's 25% of revenue growing faster than the business overall. So it's got a nice growth rate.

Yes. I want to emphasize that we have been increasing our international investments because we were historically low in that area. We are focusing on aligning our sales processes across the organization to ensure consistency across segments and regions, which will help us evaluate our investment strategy. We believe there are ample opportunities in North America, and we see potential for accelerating sales there as well. Additionally, we anticipate significant growth opportunities internationally as we move forward. Thank you for the question, Rob.

Your next question will come from Fatima Boolani with Citi.

Corey, the question is for you. Just with respect to MDR now, almost the majority of the business. But when I map that back to the flat ARR per customer growth you've experienced sequentially, it is up 2% year-on-year. How can we not conclude that there are elements of pricing pressure and/or pricing competition inside the MDR business as well? And maybe what are you seeing that we aren't necessarily seeing or is not necessarily visible to the naked eye for us to give you that confidence because that space generally is fairly competitive. And the AI SOC vision, there are a lot of vendors competing for the hearts and minds of the SOC. So I would just love your perspective on some of the pricing dynamics and what insulates you and why it may not be visible to us? And I have a follow-up, please.

Yes, that's a great question. To clarify, our MDR business is still experiencing double-digit growth, and we believe we have ample capacity to continue expanding. Historically, we've been cautious about how much to grow due to concerns about gross margins. However, as we automate more aspects of the business, we are increasingly confident about unlocking further growth. Our competitive position is clear: we are well-suited for organizations seeking to leverage an AI-driven SOC that integrates both advanced technology and skilled personnel. Currently, we have a highly effective MDR practice that delivers quality results at scale, reflected in high retention rates. Furthermore, we are extending our offerings to managed red teaming and managed risk, with a value proposition for customers looking to efficiently scale and outsource their SOC, ensuring access to both AI and talent. We can provide this service more economically than our competitors, backed by our scale and experience. This is our core value proposition, and we are focused on optimizing it as we continue to see strong growth opportunities. Did you have another question?

Fatima, go ahead if you had another question.

I appreciate that. As we think about calendar '26 with the backdrop of what has been a year of work in progress in calendar '25, you're layering on further operational changes and some new sales processes. So when we think about calendar '26 at a very high level, how should we internalize the growth versus profitability algorithm and specifically around efficient reinvestments. And I know one of the mandates this past year also was leveraging the channel more. So how should we, at a very high level, think about that algorithm seeing that you outperformed on operating margin and cost control this year?

Yes, I believe we have established a highly efficient business. We can build upon this foundation and continue this positive trend. One reason for our current investments is that this is the right moment to seize opportunities. For instance, in the MDR space and our recently announced partnership with Microsoft, we have a significant chance to assist Microsoft customers in managing their security ecosystems in a more scalable manner and addressing their outsourcing needs. We could have postponed these actions until next year, but we chose to act now because we saw ample clear opportunities ahead of us. This decision allows us to prepare for momentum next year and implement crucial changes aimed at enhancing our scaling and streamlining our efforts moving forward.

Yes, Corey, I would just add. We said earlier in the year that this is an investment year for us as we're building out the innovation center over in India, and that continues to ramp up and you see it in the second half of the year with some of the expense load that we anticipate in Q4 as we continue to ramp that business, but giving us leverage in the business over time.

Yes. And the overall goal was always to actually make sure that we can actually scale profitability as we go forward in the next couple of years. Thank you very much for the questions.

Your next question will come from Matt Hedberg with RBC.

Can you hear me, okay?

Yes, Matt, you're just fine.

Okay. So I guess maybe one for both of you guys. You guys have noted some timing variability with large deals, and it seems like Allan is going to be working on some processes to improve that. I guess as you think about Q4, can you talk about the large deal pipeline? And Tim, how have you sort of contemplated that in your Q4 outlook?

Do you want to talk about Allan?

Yes. So Matt, it's a fair question. And I think Corey had it in his prepared comments that we really wanted to give you a high confidence outlook for Q4 as we come into the quarter. So we take a very hard look at the pipeline, and we're looking at that all the time, as you might imagine, because that is your leading indicator. And you're looking at conversion rates, you're looking at cycle times of deals when they're in the pipeline. And Corey mentioned this earlier that when you're looking at these platform conversions with customers, the great news is these are larger deals that we have the opportunity to win. They do take more time for these deals to work themselves into a closed state.

Matt, to address how we factored this in, we kept it simple. We see numerous opportunities moving into next year. The question remains about any sales or organizational changes in Q4 for January, but we believe the process is straightforward enough that we want to ensure we are addressing it while enabling other initiatives. I want to emphasize that we understand there are various possible outcomes. You are likely touching on this point. There is indeed a range of outcomes, and we haven't been exceptionally precise about where we may land within that range. With Allan and Rafe on board, we've opted to rebaseline and maintain simplicity, expressing confidence that we can achieve our goals while recognizing the range of outcomes around them. We did not want to be overly precise while Allan was working through the model.

Your next question will come from Mike Cikos with Needham.

Corey, just picking up on that last remark as it pertains to the Chief Commercial Officer, Allan Peters, could you just provide additional detail on what exactly he is doing with respect to that resource alignment behind the MDR opportunity and execution and transitioning the VM to Exposure Command? I would just love to get some more color there.

One of the key focuses is standardizing our operating procedures. We have a lot of talented individuals, but there is variability among the representatives and teams, so we are aligning our efforts to set everyone up for success. A significant part of this is creating a solid foundation for our team. Additionally, this year marks our first major upgrade wave in a long time, and successfully operationalizing and maturing this process is crucial. We're focusing on both the VM to exposure management side and the detection and response side, with notable opportunities for upgrades. Allan is collaborating with our sales and marketing teams to ensure we have an organized process to capitalize on these opportunities. Lastly, we believe we can fully deliver the AI-managed SOC platform, focusing on AI-centric managed detection and response, risk, and compliance workloads over time. It's essential to leverage these capabilities and concentrate our sales team on the most promising opportunities. In summary, our main areas of emphasis are standardization, accelerating our expansion engine, and aligning our sales force around the MDR opportunity. We haven't fully tapped this potential this year, but we're working on it. Thank you for the question.

Your next question will come from Brian Essex with JPMorgan.

This is John on behalf of Brian. Yes. So I guess I'm just curious to hear maybe what were the key criteria in selecting Rafe? And what are the top priorities or changes the team is most excited for him to drive when he joins in December?

Yes. And we'll talk more about like he has some big shoes to fill with Tim. We'll talk a little bit about more in the future. I mean, later on the call. One of the things that we were actually looking for is someone who could actually meet where we are is as we actually go forward, we are an AI services engine. And so we were looking for someone who could actually come in and bring not just the financial acumen, but we wanted someone that can bring the operational acumen as we actually to partner with our go-to customers teams to actually really scale our processes around how do we actually do land, expand, how do we scale our pricing and packaging, how do we actually really drive the economic engine predictably for growth? We've been investing and we're still investing efficiently on. But we're in a good place. We're in the right markets for growth, which is important. More and more customers are looking to outsource more and more of their security workloads. We've set it up well, whereas people are thinking about how they scale their security operations, we can do that across detection and response. We can actually do that across risk. We can do that across compliance, and so we're set up well today. We're tuning the product engine, of course, around that. But now it's really about how do we actually take that the market, how do we have the right pricing and packaging, the operations engine behind that. And we're looking for someone who was an operationally minded CFO who could really tie the sales and the business model together with the product strategy to actually drive that sustained growth. And that's what we're looking for, and that's what we got in a great candidate with Rafe.

Your next question will come from Eric Heath with KeyBanc.

Can you hear me?

Yes, Eric.

Corey, I wanted to ask on the SIEM, MDR side of the business, which does seem to be going strong and even validating the latest Gartner Magic Quadrant last month. But my question is to maybe understand the business a little bit more holistically and how valuable the traditional VM piece is to the SIEM, MDR side of the business? And maybe the second part to that question is, we did see another vendor announce the end of life of its on-prem business. That was a reasonable portion of its overall business. And maybe how you're thinking about similarly bold options or less strategic parts of the business in order to focus on the growth side of the business that is doing well, whether that's MDR Exposure Command.

We have already been on a journey to streamline our business as part of our growth strategy. Although it wasn't a sudden transition, we have been gradually shifting our focus. Moving forward, we are focused on understanding how customers looking to scale want to align their security outsourcing needs. We aim to build upon our Managed Detection and Response offering to not only deliver this service but also expand into risk management, compliance, and red teaming. Over time, we have transitioned from traditional on-premise workloads to more strategic, value-added services that cater to both the mid-market and the resource-constrained upper enterprise market. Our emphasis is on the service layer rather than just technology or on-premise solutions. We are focused on extending our MDR capabilities and have been discussing this shift for a while. We believe we are nearing the final stages of this transition, which is why we are realigning our sales focus around the AI managed experience that functions at the service layer. Many of our customers seek to offload work from their teams, as they cannot continually increase their workforce.

Your next question will come from Joseph Gallo with Jefferies.

I know you have the large deal dynamics. But fundamentally, where does exposure management and MDR rank in terms of CISO budget priorities right now?

MDR consistently ranks among the top two or three options in every survey we conduct. However, a decreasing number of customers are interested in managing a 24/7 global SOC themselves. Instead, more customers are looking to outsource for efficiency, which presents significant opportunities for us. As I mentioned earlier, traditional on-premise VMs are becoming less of a priority, while modern exposure management has become essential. We are focused on enhancing our capabilities in exposure management to integrate it with MDR, and we see numerous opportunities arising from that. The entire industry is transitioning away from legacy systems. We are concentrating on MDR while also expanding exposure management to address workloads. In fact, MDR is currently one of the top three budget priorities for most CISOs.

Your next question will come from Gregg Moskowitz with Mizuho.

Interesting announcement with Microsoft. And I'm wondering, Corey, if you could elaborate a bit on your expectations from this going forward? And is this purely a technology integration? Or could there be a go-to-market aspect at some point as well?

Yes. We're in the early stages, focusing on deep technology integration. We have also been collaborating extensively with their go-to-market teams. The situation is clear. Microsoft has an excellent technology stack, and we are aligning our technology stack with theirs. They have a large existing customer base and currently lack a top-tier partner providing high-quality, efficient managed services on their platform. They are looking to expand their partner portfolio, and we are making significant investments in that direction. Additionally, there are many customers using the defender ecosystem that we have optimized, and we are announcing more technology integrations to enhance our offerings. We can manage their technology infrastructure integration, utilize our technology stack, do this at scale, and achieve great cost efficiency for our mutual customers. We view this as a substantial growth opportunity moving forward. Though we are just beginning, we are actively working with both their technology and go-to-customer teams.

Your next question will come from Junaid Siddiqui with Truist.

Corey, you have mentioned extended deal cycles for some time now as your platform becomes more strategic. How comfortable are you getting with the visibility around the pipeline and close rates so to give you a better ability to forecast?

Yes, I believe this is the reason I mentioned that we have a range of outcomes this quarter as we proceed. One of Allan's primary focuses is to streamline the process of managing the larger deal cycle. He is accustomed to assessing these deals, and we need to standardize our approach. We moved more quickly to compete for strategic deals with larger average selling prices than we traditionally focused on, which were more in the mid-market range of $40,000 to $50,000 ASP. This shift has occurred relatively quickly over the past 18 months, and we are starting to get a better grasp on it. This change has affected both the precision of our communicated guidance and our need to enhance our processes and systems for managing such deals. This is a clear objective and point of emphasis that Allan is addressing.

Yes. And he has the experience doing that years of it. He's just a seasoned leader.

So I actually think that, that will be not a problem as we go into next year. But that's also why we didn't want to actually sort of like have Q4 be a distraction around it because he's only been in a little over a month, and we did not want to have more precision that was warranted.

Your next question will come from Joshua Tilton with Wolfe Research.

Can you hear me?

Yes, hearing just fine, Josh.

Great. Totally understand the decision to put some incremental conservatism in the guidance for ARR for this year. I guess I'm trying to understand outside of that conservatism, what is the underlying momentum of the business. So my question is, assuming you don't see any disruptions, right, from these one-off dynamics, are you still on track to hit the ARR guidance that we had coming into this quarter? Are you running below that prior ARR guidance that you gave? How do I understand what you're guiding to from an underlying momentum of the business, if that makes sense?

Yes, it makes sense. We are not going to provide multiple guidances, but to address your main point, we still have the pipeline we expected, with only slight variations. I won't be too specific, but the pipeline remains unchanged. The main difference now is that we are not trying to be overly precise about when parts of that pipeline will convert. We wanted to convey an ARR target based on what Tim mentioned regarding Rafe. We are confident we can achieve that, and we will keep you informed about it, particularly as we move into Q1. I acknowledge this might not seem ideal, but it's the right approach, especially with our new CFO and CCO on board, as we aim to establish a clean baseline and set a consistent cadence for next year.

Your next question will come from Zach Schneider with Baird.

This is Zack on for Shrenik. So Exposure Command really feels like a big flagship bet for you guys. And I'd love to just hear more about what does the data really show today. Maybe our net new customers landing faster or larger with it. And then maybe what's the ASP uplift versus just legacy VM only? And what's the true ramp time line?

Yes, there are two key aspects. First, we are concentrating on integrating Exposure Command into our overall services strategy with MDR, which is still in its early phases. The second aspect is that we are keenly focusing on the upgrade, as it supports the overall MDR strategy by moving from VM to Exposure Command. So far, we have observed significantly larger deals in terms of average selling prices. In fact, these deals are more than double the average selling prices we anticipated, which has resulted in much larger deals with longer deal cycles compared to the smaller upgrades. We have primarily concentrated on upgrades this year, as we mentioned at the beginning of the year, rather than bringing in new customers for Exposure Command. Consequently, the volume of conversions has not met our expectations, as the pipeline is filled with larger deals. While we appreciate the value in the pipeline, the size of these deals means they are coming in at a slower pace.

Your next question will come from Kingsley Crane with Canaccord Genuity.

Just wanted to double-click again on the Microsoft integration. As that scales, just could you speak more to any near-term investment required to support that at the engineering or sales level? And then do you have a sense of what portion of your customer base are already customers of both Rapid7 and Microsoft?

Yes. It's a little bit under half, but it's still a substantial portion of our customer base that is Microsoft. And frankly, we see a big opportunity to grow it. Like we look at this as primarily a growth opportunity as we go forward. We've been working on the engineering for a while now. And so it's one of the investments that we talked about, and we wanted to invest in earlier this year. We're not done. By the way, just to be clear, we're not done, but we actually can do it within the resource outlook that we actually have available. So it's not incremental resources. It is the resources that we have on board. This is part of why we're taking the opportunity to refocus and retune and realign the sales engine, though. Because it's not more salespeople, it is sort of like focusing and training and enabling our sales teams on the partnerships and the opportunities that we have in front of us, of which this is a substantial new one that provides net new opportunities. Our sales leadership team has been asking for this. It's been one of the priority areas. And so taking the time next year to make sure that we actually start next year with velocity and momentum is a big deal. So it's not more sales resources, but it is time and focus to align that engine. And we decided that we wanted to do that as soon as possible, not wait to Q1 where if you wait to Q1, you don't see the benefits in the back half of next year.

Your next question will come from Rudy Kessinger with D.A. Davidson.

Could you just talk to us about gross churn and how that's trended throughout the year and your expectations for gross retention and gross churn going forward into '26?

Yes, that's a great question. Gross churn has been exactly where we anticipated based on our previous calls. The main concern in the business is more about acquiring new customer annual recurring revenue and the deal cycles associated with that rather than churn. We expect to see the same trends moving forward, which we are quite comfortable with. As our managed detection and response services become larger and more strategic, the deal cycles and terms generally become longer. As the business shifts in that direction, there is a slight improvement in gross churn dynamics, indicated by higher retention rates. However, this is primarily due to the mix of business types in managed detection and response services. So, the significant issue this year has not been churn but rather the lower than expected new customer annual recurring revenue and expansion annual recurring revenue. I appreciate the opportunity to clarify that.

There are no more questions at this time. I'd now like to turn the call over to Corey Thomas for closing remarks.

So thank you all for joining on the call today. I want to take this time to thank Tim Adams, our CFO, for his outstanding service for his time, for his partnership to both myself, the Board and the leadership team. Tim, I want to thank you. I want to acknowledge it since this will be your last call but thank you so much for your time today. And I want to thank all of you for taking the time to join us on our earnings call today. Thank you.