Good day, everyone. My name is Kehaylani, and I will be your conference operator today. At this time, I would like to welcome you to the Q4 2025 Rapid7 earnings call. All lines have been placed on mute to prevent any background noise. After the speakers' remarks, there will be a question and answer session. If you would like to ask a question during this time, if you have joined via the webinar, please use the raise hand icon which can be found at the bottom of your webinar application. At this time, I would like to turn the call over to Matt Wells, Vice President of Investor Relations. Thank you, operator.

And good afternoon, everyone. We appreciate you joining us. Today, we will be discussing Rapid7's fourth quarter and full year fiscal 2025 financial results. We've distributed our earnings press release over the wire; it can be accessed on our investor relations website. With me on the call today are Corey Thomas, our CEO, and Rafe Brown, our CFO. As a reminder, all participants are in a listen-only mode, and a question and answer session will follow our opening remarks. Before I hand the call over to Corey, I want to note that certain statements made during this conference call may be considered forward-looking under federal securities laws. Such statements are made pursuant to the Safe Harbor provisions of the Private Securities Litigation Reform Act of 1995 and include our outlook for the first quarter and fiscal year 2026, any assumptions for fiscal periods beyond that period, our positioning, strategy, business plan, operational improvements, and growth drivers. These forward-looking statements are based on our current expectations and beliefs and information currently available to us. While we believe any forward-looking statements we make are reasonable, actual results could differ materially due to a number of risks, including those contained in our filings with the SEC. Reported results should not be considered indicative of future performance. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events, or otherwise, except to the extent required by applicable law. Further information on these forward-looking statements and risk factors are included in the filings we make with the SEC, including the section titled 'Cautionary Language Concerning Forward-Looking Statements' in our earnings press release. Additionally, over the course of this call, we'll reference non-GAAP measures to describe our performance. Please review our earnings press release and filings we make with the SEC for a rationale behind the use of non-GAAP measures and for a full reconciliation of these GAAP to non-GAAP metrics. These documents, in addition to a replay of this call, will be available on Rapid7's investor relations website. And with that, I'd like to turn the call over to Corey. Thank you, Matt.

And welcome to everyone joining us on the call today. I'm excited to be joined by Rafe Brown, our new CFO, who joined Rapid7 in early December. Rafe will offer some initial impressions on Rapid7 and the opportunities he sees in his prepared remarks. Rapid7 exited fiscal 2025 delivering outperformance against our Q4 ARR, revenue, and profitability guidance. We ended 2025 with ARR of $840 million and total revenue of $860 million, both ahead of guidance. In Q4, we saw sustained new deal activity for our industry-leading MDR offering and encouraging growth within our exposure command platform. Throughout 2025, more specifically during the second half of the year, we made strategic investments across key product growth initiatives to strengthen our position as a leader in AI-enabled security operations. We did all of this while continuing to generate significant cash flow, exiting 2025 with $136 million of operating income and $130 million of free cash flow. These investments enhance our security offerings with AI and machine learning capabilities, consolidate customer environments on a unified platform with our managed AI SOC, and enable our team to scale operations globally. Additionally, we just concluded our sales kickoff with the broader go-to-market team. It was our most impactful SKL in years and a great opportunity for Chief Commercial Officer Alan Peters and his team to outline their priorities to reenergize the Rapid7 Growth Engine. We expect to see tangible benefits from this organizational change throughout 2026 as we develop muscle memory with these new processes. Before I turn to business updates, I want to take a moment to address the broader landscape because I think context matters for how investors evaluate our business. We are operating in a period of significant disruption across the software sector, driven by a fundamental reevaluation of what AI means for software businesses. I understand why investors are asking hard questions. The rapid advancement of AgenTik AI capabilities has created real uncertainty about the durability of many software business models, particularly those built around per-seat pricing. Then workflow layers are point solutions that can be replicated or disintermediated. I want to be direct. Not all software businesses are positioned equally in this environment. And cybersecurity is fundamentally different. Let me explain why we believe Rapid7 is on the right side of this divide. The security operations market is defined by three characteristics that make it structurally resilient and, in many ways, a direct beneficiary of the AI transformation happening across the enterprise. First, the threat environment is accelerating, not simplifying. AI is enabling attackers to move faster, at greater scale, and with more sophistication than ever before. This is not a theoretical risk. It's happening right now, and it's driving an urgent reevaluation of security postures across the enterprise. The regulatory environment is simultaneously becoming more complex and more fragmented around the world. This combination means that the need for comprehensive, expert-led security operations is growing, not shrinking. Second, security operations cannot be reduced to software alone. Unlike categories where an AI agent can trigger an API call or bypass the user interface, effective security operations require the integration of broad telemetry, proprietary intelligence, real-world expertise, and, yes, human judgment, particularly during incidents where the stakes are the highest. This is a market where outcomes depend on the combination of technology and deep domain expertise, not one or the other. And third, our business model is anchored on outcomes and value delivered, not seats. Our pricing is tied to the scope of environments that we protect and the outcomes that we deliver, which positions us well as the industry evolves towards outcome-based and usage-based models. This is the lens through which I ask you to evaluate Rapid7. We are not a wrapper over a generic model. We're not a point solution. We're a platform built on the broadest proprietary security data foundation in our market, continuously enhanced AI-driven productivity and innovation, and delivered through deep services and technical expertise that customers depend on to navigate an increasingly complex world. Now turning to the evolution of our business. The cybersecurity market is changing, and that presents us with phenomenal opportunity. AI-driven attacks are escalating in both pace and sophistication, stretching security teams thinner than ever. At the same time, regulatory requirements continue to expand and fragment globally, from the EU's evolving framework to new compliance mandates across Asia Pacific and the growing patchwork of US state-level requirements. This is driving a reevaluation wave across enterprise security. And the winners in this market will be the vendors that can deliver on three things simultaneously. First, a broad proprietary data foundation that provides complete situational awareness across the attack surface. Not just what you connect, but the ability to integrate, normalize, and contextualize data from across a customer's entire environment. With over 500 integrations, our command platform provides the broadest data foundation in our market, and this data advantage compounds over time as we train our AI capabilities on real-world security operation data that no competitor can replicate. Second, AI-powered productivity and innovation that continues to improve the speed and accuracy of detection, prioritization, and response. Our expert-trained AgenTiC AI workflows are built on years of SOC expertise, trained online playbooks, and redefined through real-world analyst feedback. These are not generic models. They are purposeful engines that improve outcomes in real-time. And critically, we view AI innovation as a continuous engine, not a one-time product release. We're accelerating our pace of AI development and expect this to be a sustained direction. And last, deep services and human expertise that help customers navigate complexity that software alone cannot address. With a decade of experience managing our own 24 by 7 global SOC and that of our customers, we have built an expertise layer that is essential, not optional, for effective security operations. As attacks grow more sophisticated and regulations grow more complex, this expertise becomes even more valuable, not less. Our managed services don't just monitor, investigate, respond, and remediate with the context and judgment that only experienced security professionals can provide. The convergence of these three elements, data, AI, and expertise, is what defines the durable security operations platform of the future. And this is precisely what we're building. The framework guiding our investment and innovation is underpinned by a shift from reactive to proactive security postures, combined with outcome-driven service offerings. We are working to introduce more AI capabilities into our MDR and exposure offerings and evolving our platform to help customers get ahead of threats rather than simply respond. And throughout 2025, and particularly during the second half of the year, we made strategic investments across key product growth initiatives to accelerate our transformation into a leader in AI-enabled security operations. One that enables customers and organizations to take a preemptive posture towards security operations. These investments augment our existing security offerings with AI and machine learning enhancements, consolidate customer security environments under a common UI, and our leading managed AI SOC, and position our team to drive scale across our global footprint. In detection and response, we have a significant opportunity to continue leading our MDR offering. We made strategic investments to evolve, enhance, and scale our solutions while building on our expertise as one of the only providers in the market with a decade of experience managing our own stock. In 2025, we expanded our MDR coverage to enable the management of third-party alerts in a vendor-agnostic fashion. Streamline analyst workflows with our AI sock for MDR incident command, and we start to expand our adjustable market to larger enterprises leveraging our AI-powered services. We're also continuing to build on our partnership with Microsoft. Just last month, we launched closer integrations such as MDR for Microsoft that provides 24 by 7 expert monitoring and native response across the entire Microsoft Defender Suite. This collaboration also extends to exposure management by unifying Microsoft telemetry with Rapid7's command platform to proactively identify and close security gaps before they can be exploited. In exposure management, our evolution is anchored around leveling our exposure command platform with AI tools, native telemetry, and open data integration curated intelligence, and automation to deliver a unified system for risk remediation. Differentiated features such as AI-generated vulnerability scoring and active risk scoring combined with technical severity real-world threat intelligence enable security teams to begin patching zero-day threats before competitors who typically wait for official industry scores. Attack path analysis visualizes primary attack vectors and allows security teams to focus on patching critical vectors rather than low-risk issues. And our remediation hub provides a single destination for remediation across both exposure management and detection response, reducing meantime to detect, respond, and remediate. When we combine our leading detection response and exposure management solutions with outcome-driven AI-enhanced service offerings, we address the core issues customers are facing in the market today. And when we do this, we're playing offense. In this quarter alone, a leading offshore drilling company selected Rapid7 as their SIM provider of choice. After being unable to achieve business outcomes promised by a competitor, this return customer saw real benefits from the investments that we've made in our product over the last two years. Our ability to effectively deploy, coupled with the service level capabilities such as MTC and vector command, made this six-figure competitive win back stand out. One of the largest sovereign tribal governments in the country became a Rapid7 customer after a competitive deal cycle and displacement in which we showcased the benefits of consolidation and the integration into our MTC offering. This high six-figure deal underscores the unique value proposition we can offer. Delivering service outcomes on top of leading technologies. A strategic MSSP provider selected Rapid7 as they continue to expand within the state, local, and education vertical. Our detection response solution provided the features and confidence they needed to deliver outcomes for their clients. We are consolidating a mix of competitive solutions and in-house monitoring onto the Rapid7 platform. These wins share a common thread. Customers are choosing Rapid7 not just for the technology, but for the combination of technology, data breadth, and expert-led services that deliver measurable security outcomes. This is our differentiation and it's durable. Turning to our go-to-market priorities. We're focused on operationalizing our strengths to accelerate growth. We just concluded our sales kickoff with the broader go-to-market leadership team and it was our most impactful in years. Allan, having completed his leadership team build-out, has crystallized his vision of a unified market approach across global sales, marketing, partners, customer success, and sales operations. With new leaders and plans in place, the team is executing a more focused sales motion with tighter alignment between marketing and sales to improve demand quality and conversion. And a refined customer success strategy designed to improve retention. Refresh incentive structures are better aligned to drive net new growth renewals, and cross-sell. These initiatives are still early stage, and our growth flywheel will take time to build momentum. However, the groundwork is in place to improve execution and drive sustained performance across product, marketing, and go-to-market and become a share taker in the medium term. In detection response, ARR growth of 7% was driven by MDR ARR growth in the high single digits. As we drive product transformation to deliver increased value through our AI-enhanced SOC, we are positioning to take share as the MDR market evolves. We believe this market has significant runway and the combination of AI-driven efficiency, with deep human expertise creates a compelling and defensible offering that is difficult to replicate. In exposure management, we're focused on simplifying the migration of our core vulnerability management base to our exposure command platform. By removing friction from the upgrade engine, we are helping our core VM customers migrate to a unified AI-powered view of the attack surface, a move that replaces fragmented tools with integrated contextualized risk visibility. I want to spend a moment on how we're thinking about growth because this is where the AI transformation of our industry creates real opportunity for Rapid7. And I want to be transparent about the work underway. We're actively pursuing three parallel initiatives that we believe will drive both near-term efficiency and medium-term growth acceleration. First, we're shifting significant portions of our operational services work to our AI layer and redeploying our expert talents towards higher-value customer engagement. Today, many of the repetitive pattern-based tasks within our SOC operations, alert triage, initial investigations, and enrichment are being systematically transitioned to our authentic AI workflows. This is not about reducing our commitment to service. It's about freeing our experienced security professionals to focus on what they do best. Helping customers navigate increasingly complex threat and regulatory environments. Providing strategic guidance during incidents, delivering the kind of expert judgment that no AI model can replace. The result is better outcomes for customers, improved unit economics for Rapid7, and a services model that scales more efficiently as we grow. Second, we're strategically redefining our portfolio of solutions. By proactively integrating advanced AI models into our core offerings, we're ensuring our solutions remain at the cutting edge of efficiency and performance. Rather than maintaining the status quo, we're choosing to prioritize innovation over legacy. Making the deliberate decision to shift resources towards high-growth, future-ready product areas. We believe this is the right trade-off. Accepting near-term headwinds in parts of the portfolio that face structural pressure while concentrating our investment and energy on the areas where we have a clear differentiation and durable growth potential. Third and most importantly, our core growth engine is the extension of our AI-enhanced services layer. This is where we see the most durable opportunity. Customers need a partner who can bridge the gap between the rapid pace of technology change and the operational reality of securing complex distributed environments under growing regulatory pressure. Our ability to deliver AI-driven efficiency alongside expert-led services integrated on a single platform with the broadest proprietary data foundation on the market is what sets us apart and what we believe will drive share gains over the medium term. At the core, our growth will come from extending this AI services layer. Delivering AI to help our customers keep pace with technology change, paired with the expertise to navigate a complex and rapidly evolving security landscape. Our anticipation is that the investments we made last year will begin to yield dividends in our AI orientation this year. But just as importantly, we're fundamentally transforming and upgrading our engagement models this year to ensure that both our business and our customers are resilient in the face of regulatory and the threat environment we face today. In closing, I want to leave you with this perspective. The increase in pace and sophistication of attacks is driving a meaningful shift in how security budgets are allocated. Customers are looking for vendors who can deliver measurable business outcomes, not just technology, but a combination of data, AI innovation, and expert services that actually make their organization more secure. We believe this plays directly into Rapid7's strengths. Our business is built on proprietary data that becomes more valuable as we scale and our capabilities that continuously improve through real-world operations and a services layer that builds lasting trust and partnerships with security teams. This combination, data, AI, and expertise, is the foundation of a durable cybersecurity business. It's what differentiates us in a market that is increasingly skeptical of software-only approaches. Rapid7 is investing across our platform to deliver security operations that give customers the ability to stay ahead of attackers. Our long-term strategy of integrating exposure management with detection response is proven to be where the market is heading. Our command platform data mesh integrates more complete security data, including third-party sources, into our AI engine for true scale and efficacy. And our services layer allows us to build lasting trust and partnerships with security teams, supporting them where they need us most. We're confident in this strategy. We're moving with urgency, evidenced by our recent leadership additions and organizational changes to improve our execution and capitalize on the significant opportunity in front of us. I look forward to sharing incremental progress throughout the year. I'd now like to pass the call to Rafe to discuss our financial results and guidance in more detail.

Thank you, Corey, and good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers except revenue and balance sheet items mentioned during my remarks today are non-GAAP. I want to begin by sharing how happy I am to have joined Rapid7. This is a great company doing incredible work to protect its customers around the world. And moreover, I believe there is tremendous opportunity to build shareholder value in the coming years. In this fourth quarter earnings call, I'm pleased to report that we exceeded our guidance across revenue, annual recurring revenue, or ARR, and operating income. For the quarter, we generated total revenue of $217.4 million, growing 0.5% year over year. This brings us to a total of $859.8 million of revenue for the full year 2025, growing 1.9% year over year. For the quarter, we recorded product revenue of $209.1 million, growing at 1.4% on a year-over-year basis. Professional services revenue for the quarter totaled $8.2 million, compared to $9.9 million in 2024. Our year-over-year results reflect an intended shift in our operating model toward a greater utilization of our partners for professional service delivery, allowing Rapid7 to remain focused on its core offerings. Our ending ARR of $839.9 million was approximately flat year over year as the business digests a mix shift towards our faster-growing detection response business, which currently constitutes just over 50% of our ending ARR. On a year-on-year ARR basis, our DNR business grew at approximately 7% in total, with the MDNR portion of the business growing in the high single digits. We continue to believe that the managed detection and response market is a significant opportunity for us, and we are focused on unlocking the value in this market with our AI-enabled approach to preemptive security. Within our exposure management business, there are encouraging signs that our investments in modernizing and upgrading our offerings are taking hold. For example, our Exposure Command offering saw rapid adoption in Q4 by both new and existing customers. Turning now to profitability. Our Q4 non-GAAP operating income of $30.1 million or a margin of 13.9% was incrementally ahead of expectations. The sequential downtick in margin reflects a continued ramp of 2025 investments discussed in prior earnings calls. Across our global capacity center in India, our go-to-market teams, product teams, and new organizational leadership. It is worth noting that we will carry this higher Q4 expense base into 2026. However, as the investments take hold and the efficiencies they bring materialize, we expect operating margins to expand as 2026 progresses. I will provide more context in a moment when we discuss our 2026 guidance. For the fourth quarter, we posted non-GAAP earnings of $0.44 per diluted share at the high end of our guidance range. For the full year, we delivered non-GAAP operating income of $135.7 million or an operating margin of 15.8%. And drove non-GAAP earnings of $2.08 per diluted share. Our fourth-quarter free cash flow was $32.3 million, bringing us to a total of $130 million of free cash flow for the full year 2025. We finished the year with over 11,500 customers with an average ARR per customer of approximately $72,000. From a balance sheet perspective, we ended 2025 with over $659 million in cash, cash equivalents, and government securities. In addition to these resources, we have a $200 million undrawn revolver in place. Thus, our balance sheet position, strong free cash flow from operations, and available undrawn credit capacity give us confidence in our ability to settle our March 2027 convertible debt upon maturity. Before we turn to our 2026 guidance, I would like to share some initial observations. It has been an energizing first two months with Rapid7. The security market is in the midst of a dramatic change. Likewise, Corey and the leadership team are focused on taking Rapid7 to new levels, ensuring we meet our customers' increasing demands for excellence, as we protect their businesses from an ever more dangerous threat environment. As such, Rapid7 is well-positioned to take advantage of a growing market opportunity. Within the company, there are a number of areas where we must continue to improve. Both in terms of focus and execution. In addition to the go-to-market efforts Alan is spearheading and which Corey discussed, we have the opportunity to improve our focus across our portfolio of offerings and in particular, to prioritize investments in the products and revenue streams that are core to our future. In my role as CFO, I'm focused on the following key objectives: improving financial forecasting, driving measurement and accountability across the organization, focusing and shifting our resources to align with our core products and growth strategy, expanding non-GAAP operating margins as we move across 2026 and into '27, and focusing on free cash flow as a core operating metric across the organization. As we turn to guidance, I would like to begin by sharing that we have been refining our financial projection models over my first few weeks with the company. Our philosophy for providing guidance works to ensure transparency with investors while setting realistic, meetable expectations for company performance. I would like to note that while we continue to provide full-year revenue guidance for 2026, we've decided at this time not to give full-year ARR guidance. While we have a clear view of current trends across our business, we have several new leaders in place, and we are implementing key improvement initiatives across sales, marketing, and our customer success and support organizations. As such, we believe visibility into ARR is best reflected on a quarterly basis at this time. This brings us to our first quarter 2026 guidance. In the first quarter, we expect ARR of approximately $830 million or down 1% on a year-over-year basis. While we are optimistic about the leadership changes in strategy that have been implemented in our go-to-market organization, we do not anticipate the benefits of these changes will impact Q1. The total first-quarter revenue is expected in the range of $207 to $209 million or down 1% year over year at the midpoint. We expect non-GAAP first-quarter operating income in the range of $19 million to $21 million or a non-GAAP operating margin of 9.6% at the midpoint. As previously mentioned, margins in Q1 will be pressured by a higher expense envelope entering the year in addition to seasonal expenses such as our global sales kickoff. Non-GAAP earnings per share is expected in the range of $0.29 to $0.32 per share on approximately 77 million fully diluted shares. Turning to full-year 2026 guidance. In fiscal 2026, we expect total revenue in the range of $835 to $843 million or a decline of 2% year on year at the midpoint. Non-GAAP operating income is expected to be in the range of $108 to $116 million or a non-GAAP operating income margin of 13.3% at the midpoint. As stated earlier, we made a number of investments during 2025. As we move into 2026, we expect these will yield improvements in the efficiency and operation of our business, moving our non-GAAP operating margins into the mid-teens. Non-GAAP earnings per share is expected in the range of $1.50 to $1.60 per share on approximately 78 million fully diluted shares. Free cash flow for the year is expected in the range of $125 to $135 million, flat with prior year performance at the midpoint and a margin of approximately 15.5%. As a reminder, the company is focused on free cash flow as a core KPI in 2026. Please refer to our earnings release and SEC filings for any additional details regarding the presentation of our results and guidance metrics. And with that, I'd like to turn it over to the operator for Q&A.

We will now move to our question and answer session. If you have joined by the webinar, please use the raise hand icon, which can be found at the bottom of your webinar application. When you are called on, please unmute your line and ask your question. We kindly ask that you limit yourself to one question and one follow-up. We will now pause a moment to assemble the queue. Your first question comes from the line of Mina Marshall with Morgan Stanley. Please unmute and ask your question.

Great. Thanks, and I appreciate the question. I guess just in terms of some of the changes that you were mentioning, in terms of tighter marketing and sales, refined customer success, refreshed incentives. Just how would you measure or kind of expect where some of those changes should be seen first and kind of what milestones are you holding yourselves to see evidence of those changes?

Yeah, great question. Look, I think there's a number of different areas, but I think one of them we're looking at is sort of increased sales and marketing productivity efficacy. We think we can actually grow faster while doing it more efficiently. We have to clear that's a clear-cut one that actually stands out and we could. That's a pretty opportunity. And that aligns across, frankly, product marketing and the go-to-market teams. And the overall engagement. Specifically, when you think about the customer side of the house, look, one of the bigger opportunities we have is customers are frankly looking for more services, more customization, more depth, not less. And so scaling that leveraging both technology, but also people and the expertise is a big focus area for us so that we're actually able to do more work at greater levels for our customers, while still frankly maintaining or improving our gross margin profile. That's one of our bigger pieces of focus we've had over the last year. Customers have not been looking for less services, less engagement. They've been looking for partners who can do more with less. And that requires both technology and some of the people, talent, and expertise. Thank you so much for the question.

Your next question comes from the line of Jonathan Ho with William Blair. Please unmute and ask your question.

Hi. Good afternoon. Can you hear me okay?

Yes, Peter. Just my job.

Okay. Perfect. So I just wanted to understand in terms of the segments of the market that you're prioritizing, can you talk a little bit about what you see as sort of the core growth businesses going forward? And know, what are, you know, some of the changes or areas of focus that you can implement, you know, to sort of drive that acceleration? Thank you.

Yeah. Look. I think our biggest growth area is still gonna be detection response, which is still growing. We think it has the capacity to grow faster. That said, as you think about like our core adjustable market is that mid-sales or mainstream enterprise, think about, like, employees from organizations that have employees from a thousand to 20,000 employees. For there, we're focused heavily on making sure we can provide the depth and quality of the service experience. We think we're only addressing part of the total addressable market there. Our big focus right now is unlocking the full addressable market. Now, let's say it lots of competitors we have are especially a private are actually doing it at lower total gross margins, and we're very focused on delivering quality service and quality experience at the right gross margin profile. So that's the first one, is that detection response market. Of which does include AI services. But exposure management is an important part of the puzzle there. And so I would just say that's another core focus area. We do think about that being an integrated part of the stack. Not a standalone focus. And so if you think about where our focus it’s about how do we actually bring together security operations that bring together exposure management and detection response. So we think about that flowing into a single integrated offering. Some of the things that we're less focused on are some of the legacy on-prem, much of which has been upgraded to our command platform. But we're still working through the upgrade of those technologies and capabilities to the command platform. When you look at the core market that we're focused on title, it's that mainstream enterprise that is, frankly, our historical base. We have I would just say, moved slightly out of that over time. And I think one of the things that Alan and the team are bringing back in is a tight focus on our core customer and our core customer profile. Which we think is a good thing for both acceleration and win rates.

Got it. And then just as a quick follow-up. So when we know, take a look at your decision to not offer the full-year ARR guidance, can you maybe walk through the rationale for that? And what maybe has to happen for that visibility, for you to be comfortable to bring that back? Thank you.

Yeah. Thanks, Jonathan. You know, as my prepared remarks mentioned, you know, the first and foremost, we thought it's really important to put out guidance that is meetable and clear to align everyone. And so that's why we have confidence in the near-term ARR. For the longer term, we felt that revenue was the best metric for the current time. You know, and this is largely because of all of these changes that are underway in our business, you know, across whether it's the sales organization, marketing, customer success, and support. And so, you know, with the total of all of those factors coming together that led us to this decision. You know, there's a number of us that are new, including in the organization, as we see the trends establishing themselves, as we see these investments begin to bear fruit, we will reconsider giving full-year ARR at that time.

Yeah. I would just say we decided. Look, this is not a moment where we can be slow. So we decided that we had to actually move fast. But what we didn't want to do was attempt to be overly precise when we're actually have a new team that's actually coming in driving execution fast. We're holding ourselves accountable for driving improvement. Both in growth and in the cost structure as we go across the year. You know, the cost structure is a little bit easier to focus on, especially when you look at free cash flow. I would just say the growth piece of it that because of the last couple of years, we were just really focused on actually starting out with where we have clarity. And then as we actually show the improvements, we'll update you, of course. And then as the new folks that are on board get situated in place, my expectation is we'll be able to continue to provide commentary and visibility. Thank you so much for the question.

Next question comes from Rob Owens with Piper Sandler. Please unmute yourself to ask your question.

Great. Good afternoon, everyone, and thanks for taking my question. I guess I'll pick on the guide a little bit too, and I can appreciate that there's a tremendous amount of uncertainty both with the changes that are going on within Rapid7 that you talked about, Corey, but also just where the market is. But the Q1 ARR guide does lend to significantly more churn, I think, than you've probably been seeing. And so we just love a frame. And I realize it's hard to commit to an ARR number given all the moving parts right now. But when would you hope that some of these investments that you've put in place will start to bear and you can see some stabilization in that number. And I know that historically, you do see some seasonal weakness here in the first quarter, but obviously, you're giving us accelerated churn in the numbers here. So appreciate the thoughts. Thanks.

Yeah. It's a very fair question. Look. I think part of what you're seeing, I think you're referring to, both the net ARR, which sort of indicates that churn is going faster than the new. What you see there is that, look, we clearly you look at DNR it is a positive contributor in the environment. We need that to grow faster, frankly. There are some aspects of the business we've broken down before in the other category. That are negative. We've had pressure on parts of the traditional VM business. We need the DNR business to grow faster, the biggest thing that we're actually doing on that is we're actually focused on the growth being in line with our gross margin expectations. And we're taking a fairly disciplined approach to that. Which means that we have to be gated somewhat still, even though we're starting to take in and increase our adjustable part of our TAM. We are unlocking that now. So we started unlocking that late last year. And we expect that to improve over the course of the year. And for that to actually flatten out the exposure management piece we are in the middle of an upgrade cycle. What I would just say is we saw good unit trends exiting Q4. We were very slow last year overall, but we did not want to throughout the whole year. Straight line some improvement that we saw in Q4. But I would just say we have positive indicators there. To answer your question, Rob is DNR. We actually have pretty strong confidence that you'll see that continue to improve over the course of the year. So we'll have a good mid-year check-in on the DNR side, where we'll provide commentary and discussion about what's happening overall there. The exposure piece was definitely slower last year. Did improve in Q4. Just to be clear, I think that was in some of the early comments. But it's not where we wanted to be. And so again there we don't want to actually straight line of the early improvements that we saw in Q4. I hope that helps with a little bit of how we're thinking about how we're.

It's very fair. No, that doesn't I appreciate the color. And, you know, obviously, given the software maelstrom or whatever we want to call it that we've seen recently, I appreciate your comments earlier around the defensibility of cyber and the domain expertise and couldn't agree more. That being said, I'm curious, what are conversations with relative to AI, the potential threat of AI? And what are they asking of Rapid7, if anything? And thank you.

I mean, look, that's the one that's actually the clearest, and this is where this is also the time where on one hand, you never love, as you're seeing some of the growth things that we have, last year for us to make an investment. That's it. In retrospect, I feel great about the investment because we are moving on the AI. The number one thing that customers are for us is they want us to do more to help them do more with less. Like, we think about AI crowding out budgets, but it's also crowding out staff. And as customers are dealing with increasingly complex environments, they're absolutely demanding that their providers be able to tackle more and to do more with less. So that's why I say that they're looking for us to actually leverage AI. Now, there are a lot of customers that want to actually they want transparency in the AI. So part of what we're working with our team on is not just solving the problem, it's showing your work on how you solve the problem, because security folks are skeptical. And so we're not mission complete until we actually both deliver the AI velocity to customers well, but that we actually do it in a way that's trustworthy. So that's one thing the customers want. But then they actually want you to actually do more. So we have lots of customers that are looking for us to actually take on more of their operational workloads. And frankly, we can't quite address all of that right now. That's why we are upgrading and investing in getting richer, deeper expertise even as we deliver more AI solutions. To take on part of the work that actually some of our people used to do. Customers want to scale their security operations, and it's not just their technology, but that they're trying to figure out how to get the most out of. They also, for their teams, are being asked to do more with less. Next for the questions, Rob.

The next question comes from the line of Brian Essex with JPMorgan. Please unmute and ask your question.

Brian, please unmute to ask your question.

Alright. The next question comes from Joseph Gallo with Jefferies. Please unmute to ask your question.

Hi. This is Grant Darling on for Joe Gallo. Thanks for taking the questions. I wanted to ask first just about, you know, outside of AI customer consolidation trends. How are those impacting your win rates and deal sizes? And then in the conversations with customers, what is most important for you to be a beneficiary of this trend?

Yeah. It's a great question. It's interesting. So we are benefiting from it. I would just say we do have to actually improve the delivery of how we actually simplify that for customers. And so we see this as an area it's our biggest area of winning. It's also one that we actually have some improvement to go. I think one of Alan's big focus areas is to simplify the proposition, the storytelling, and the packaging about how we actually deliver the consolidation story. Look, Rapid7 has traditionally been because we're a security company, we tend to believe in not overpromising. And so we tend to under-promise and over-deliver, which isn't always the greatest thing in a hyper-competitive sales cycle. And so part of that is how we actually tell the story. The thing that we're focused on the more substantive level, though, when it comes to consolidation is how do we actually be the best at actually integrating into the rest of people's technology and security stacks. Look, if you look today, we're able to essentially integrate the four biggest parts of security operations in. Which is a big deal. People are asking us also to actually take on even more of that work. And we're doing that increasingly through partnerships. So we announced not just a partnership with Microsoft, we announced a partnership with another company that extended some of our capabilities. You'll see several more of these key partnerships coming up a little bit later this year. As a key part of our strategy that allows us to stay tight on our R&D focused budget, which is somewhat known, in some in the past, we would just actually spend on teams to do that. So it allows us to stay focused but it also allows us to apply best-of-breed technology deeply integrated within our security stack. To get more of that share of wallet for the budget, and that's a big focus that we have as we move through the year. That said, we are not assuming in our initial guidance that Rick gave, any material improvement there. Will say we are managing to that. With the strategy of both expanding our addressable market in exposure and DNR and demand services that go along with it. And we're quite aggressively investing in embedded partnerships that deliver the consolidation experience and budget that folks are looking for.

Got it. That's very helpful. And then maybe going back to MDR, like, when does that get big enough to drive growth acceleration, and maybe how do we think about that dynamic there?

So I think it's pretty close. It's actually it is actually big enough. We need to be ungated in our ability to actually go sell it and drive it. I do think we crossed that threshold this year. To be clear, we were one of the most profitable, highest quality MDR businesses. But that does mean that we are pretty clear about what we do and don't do. And we are actually increasingly unlocking that business that does require technology. That does AI, and it requires us to shift where the services go. But I think that we're on the track this year to be able to unlock that. Then that really compensates for the growth. I think this is part of our Raphael's comment earlier is that look, we don't want to be over-precise in predicting timing. We're unlocking it this year, then alright. How fast can we actually take that to market, tell the story in a noisy market? That's where we are actually just, you know, being very direct and open with you. But we do see us unlocking that this year, which we think the profile improves over the course of the year.

Very helpful. Thanks again. Thanks.

Your next question comes from the line of Adam Tindle with Raymond James. Please unmute to ask your question.

Okay. Thank you. I just wanted to kinda circle back to Rob's line of questioning and just double click on what's driving the ARR decline in Q1 based on guidance. It's just a little bit more meaningful in the past, down $10 million or so on net new ARR. And I wouldn't think Q1 is necessarily a big renewal quarter, so I was confused at the churn comments. Just maybe double click on why that is happening in Q1. And then if you could tie in the color on investments and strategy to potentially reverse this decline in net new ARR. For example, if it's a churn issue that you're seeing, are you creating, you know, or investing in a retention team? Just a little bit more, Corey, some qualitative comments on the strategy as well.

Yeah. No. So one Rob went to one that framed it as a churn thing. But, you know, to be clear, I do think that the if you look at the biggest driver, DNR is growing, but it's not enough to compensate for the negative for the rest for the other parts of the business that aren't growing. But I will answer your churn questions too about what we see around churn is we see you know, if you think about DNR, and you think about exposure exposure was stable last year, so it was in line with expectations. We think it can be better. We have a number of major releases coming out to make it easier to do the VM to bond with the vulnerability management. Exposure upgrade until we think we have upside there. But again, was slower last year. And so we're not baking that into the core assumptions and outlook. And it's not that's not a true one thing either. And so that is something that we're actually looking at in the middle of the year. But we actually have good visibility there. The DNR one, we're actually doing great in DNR. I would just say that for customers to say we love what you're doing, we need you to do more, or we want more services, we want more customizations, not set up right now to fully unlock that right now. And so that does cause more complex customers to come out in the near term. That one we have a lot more confidence in clearing and visibility in. Because we've been specifically retooling around that. And that, we actually think, improves both on the addressable market TAM side but our ability to say yes to customers as we go forward. So again, the biggest driver is DNR growth isn't enough to compensate for the other, but I also want to make sure explicitly address your questions on churn dynamics. Did that get to your core questions?

Yeah. That's helpful. Thanks. Sure. Maybe just a follow-up for Rafe. I was curious in looking at the guidance here. You do have that improving EBIT margin I know you talk about, but in dollars, it's also improving $20 million or so. In Q1, and EBIT dollars has to go to 30-ish to hit the annual guide on EBIT. And I'm noticing that, revenue growth is not accelerating, so it's not necessarily an operating leverage dynamic going on here. What's driving the improvement, in EBIT? I know you talked about investments I wonder if maybe there's also some cost-cutting restructuring or something that drives that trend of EBIT dollar improvement on revenue declines. Thanks.

Yeah. Thank you. As we move across here, part of where we're at is we have been investing throughout 2025. We, of course, our run rate comes into the early parts of the year, but those investments start to bear fruit. Right? Some of the things that I called out in my prepared remarks are investments that help us build efficiency, whether it's investments into the product, investments into the India team. It gives us greater capacity as we move through the year, and that bears some fruit for us. That will help us build those margins as the year goes on.

Yeah. I mean keep in mind, I think yeah, I do wanna reflect one thing. I think it's a core part of it is that one, Rafe is completely right about the managed the MDR that customers are looking for. Just to clear, it's a big demand driver. Also, you can see why because the gross margins profile why we have to do it in a technology-oriented way. And so that's the first thing. The second thing I remind you is that this was planned for year. You know, what we committed to you all last year that we were gonna make an investment but we were planning out the investment such that the benefits of it would sort of like peak at the end of the year. But then come down. I would say we're completely aligned with the plan. So yes, I think that you're right on the profile of how it flows but this profile and this investment structure was planned out last year, and we are on the plan. And so it's not a major derivation of the plan. Now, again, Q1 is probably not the right baseline to think about the Q1 expenses. But the efficiency gains that we have we're playing out as we actually went through the increased investment last year.

Your next question comes from the line of Shrenik Katari with R. W. Baird. Please unmute and ask your question.

Hey, guys. This is Zach Schneider on for Thanks for taking the question. So I just wanted to follow-up to some previous questions. If you could just help us understand where are we really in the monetization curve for exposure command. And incident command and maybe which upsell levers offer the highest probability of lifting net retention meaningfully maybe without relying on broad pricing increases over the next twelve months. Thanks.

Yeah. I'll hit both on the chart. So one, incident command is relatively easy. We haven't we haven't we launched initially last year. I will say the primary focus initially was on the AI managed services around it. And to support some of the customer demand again because we have not addressed the full addressable market there. So, I would just say, listen, we're in the first inning of incident command, and frankly, it's not even a big priority right now for our sales team. It will be a later priority as we actually go through the year. But we actually think there's plenty of upside there. Especially with what's happening in the sale market. So it's something we're prepping for and looking at. There's a couple of things that we wanna do to make it plain dead, easy, and simple. For folks to do. And so we expect to actually do that. But think we're in a good position, but that's not a core focus. I would just say first inning but it's something that we're looking at. And I think that upgrade does not require a lot of complexity in terms of pricing there. On exposure command, would just say, listen, that was a big disappointment last year. Because we did not really sort of like get that going to Q4. That said, in Q4, we actually saw a unit up starting to get the upgrade motions. And if that continues, and even in Q1, we're starting to see a little bit of continuation of that. Then we feel quite good about what that means for both growth of expansion and what that means for retention over the course of the year. As that goes along. But this is a classic one where we missed the timing last year, and so that's where we're not baking that into the it's not in the core Q1 assumption. It's not there. But I do think that that is one that I feel like we're in the I would just say, fourth or fifth inning. I hate to keep using baseball analogies. But we're further along. We see it. We know what we've gotten good feedback there. We just wanna see the uptick do think more of this is operational and so I feel more confident that will continue to see it and we've already seen some of the initial progress there.

Very helpful. Thank you.

You're welcome.

Your next question comes from the line of Kingsley Crane with Canaccord Genuity. Please unmute and ask your question.

Hi. Thanks for taking the question. Entering last year, I think we felt like we had a stronger pipeline at the beginning of the year than fiscal 2024. You know, of course, this has been somewhat of a challenging year. In retrospect, I mean, was the quality of the pipeline lower than original valuations? Just how do you feel about evaluation methodology and just the quality of the pipeline heading into '26? Thanks.

Yeah. I mean, look. I mean, clearly, you look last year, our assumptions on deal cycles, especially in the pipeline, or off significantly, which is why we've actually revised we look at things, how we think about things. As we actually come into this year. These were conservative, would just say we have a much more thoughtful approach around the learnings from last year and how they apply coming into this year. Way that I would frame last year's pipeline is that on the DNR side, we actually built a backlog of larger deals faster than we could actually consume them and deliver them and execute them in the market. And I think that's fine, but it represents customer demand. And so we have a lot of urgency on responding to that sort of like customer demand that we actually see there. I do think that this year will match up the demand and supply capabilities to actually do the more customized accounts. I think it's the right thing to be gated on that, but to be clear, I do think that'll be more matched and in line this year. Look, we also just need lots more transactions in singles and doubles. Was the other quality. So one of the big things that Alan's focused on is not just doing the big deals, but also getting, you know, I hate to keep using baseball in Nashville, singles and doubles. But that matters hugely. Now, again, this is one of the things that kind of worked well coming out of last year. We did start to see that mentalities of these singles and doubles starting to hit. Need to see that systematized across a few quarters. But if you look at the recipe for growth acceleration, which is what we all want, is it is the singles and doubles. Think about that as the mid-market AI MDR. It's the incident command, it's the exposure command, which includes the upgrades of those, which we have plenty of capacity and room for. It is continuing to deliver the pipeline then actually being able to convert and service the, I would just say, the larger deals. When I say larger deals, those are the customers that are with somewhere between five and twenty thousand employees, which is sort of in our core sweet spot. And unlocking that. And I think that that is a big focus area. Those are the things that actually unlock growth as we come in. When we look at how we're actually looking at the pipeline in the planning assumptions this year, is one, look, we're factoring in that we need a multiple of the coverage ratios that we actually did last year. So we actually are taking the learnings from last year and applying them in to this year as we actually think about the pipeline overall. And certainly, as we actually think about how does that relate to guidance. But again, there's a couple tailwinds that I would just say our team's ability to go get the singles and doubles, which should, in things over the course of the year. But we wanna see that evidence done, and they will actually communicate that and we'll give you updated guidance.

That is really helpful, Corey, and I do appreciate the baseball analogies. Maybe one for Rafe. Are you thinking about the net debt balance moving forward? And then just the general philosophy around cash balance uses of cash as you wrap your hands around the business? Thank you.

Yeah. Thank you. Well, first, we've been very, very focused as I touched on in my prepared remarks, about making sure we're in a strong position for that maturity, that comes in March 2027. You know, on our balance sheet, a lot of our investments, are still classified as long term, but all of those treasuries, government securities mature before the bond does. So, you know, what we anticipate as next quarter, the bond maturity moves from noncurrent to current. So too will the investments. It really just lay out for everybody. First and foremost, we're in a very strong position to be able to take care of that debt maturity with, with the cash and the investments we have on hand. Think beyond that, you know, we're looking to make certain we have the liquidity to obviously, fund the business, make sure we've got good headroom there. But also, you know, we need to be liquid enough to take advantage of any opportunities that come up. Know, through the course of the year. So very much evaluating that now and continuing to have discussions around that. But first and foremost, we wanna just share with everybody our strong position to take care of the debt maturity. Take that off the table for everyone, and then we'll go forward from there.

Thank you very much.

Your next question comes from the line of Mike Kikos with Needham. Please unmute to ask your question. To unmute while you're on the phone, it's just star six. And it looks like we're not getting a response from Max, so we'll go next to Rudy Kessinger. Please unmute to ask your question.

Hey. Great. Thanks for squeezing me in, Rafe. Kinda back to Adam's question and some other questions on just the ramp in op income. I guess on gross margin, you know, was down sequentially in Q4. Should that tick lower for the full year here? And, again, just so I if I'm modeling it right and assume a gradual ramp in that op income. I've gotta take OpEx down by, like, $10 million a quarter by Q4. So do we have that right? And, you know, you're saying it's driven by efficiencies, but you know, what are you guys planning to cut hedge or anything, or how do you get to that level of improvement on operating income side?

So I think, first and foremost, remember that we did touch on Q1 inherently has some extra expenses that just hit Q1, right? Not only do you have the usual stuff like all the tax rates resetting and that always hits Q1, but also sales kickoff falls in Q1, and you know, we as Corey called out, you know, we got the whole team together. We really had a great chance to get together with the new leadership and really set that strategy for the year. So that is one unique aspect that obviously shows up in our Q1 guidance. You know, across the board, you know, these investments that we're making that the gradual shift to MDNR does come with a little bit lower margins. We still think they're very good margins. You know, we've talked about in the past maintaining those margins in the low seventies. We feel good about that. But as that mix shift continues, it does pressure cost of goods sold a little bit. But again, you know, these investments are around AI, investments across the business and all the different changes we've called out, I think that will bring efficiency as we move through the year.

Yeah. I mean keep in mind, I think yeah, I do wanna reflect one thing. I think it's a core part of it is that one, Rafe is completely right about the managed the MDR that customers are looking for. Just to clear, it's a big demand driver. Also, you can see why because the gross margins profile why we have to do it in a technology-oriented way. And so that's the first thing. The second thing I remind you is that this was planned for year. You know, what we committed to you all last year that we were gonna make an investment but we were planning out the investment such that the benefits of it would sort of like peak at the end of the year. But then come down. I would say we're completely aligned with the plan. So yes, I think that you're right on the profile of how it flows but this profile and this investment structure was planned out last year, and we are on the plan. And so it's not a major derivation of the plan. Now, again, Q1 is probably not the right baseline to think about the Q1 expenses. But the efficiency gains that we have we're playing out as we actually went through the increased investment last year.

Your next question comes from the line of Trevor Rambo with BTIG. Please unmute to ask your question.

Great. Yeah. This is Trevor on for Gray Powell in squeezing me in here. Just one quick one for me. You touched on it a bit earlier, but can you just talk more to the mix of enterprise versus mid-market deals you saw in the quarter and how that compared to Q3? And then where are you seeing the most traction between these deals heading into 2026 and then the next there? Any color there would be helpful as well. Thanks.

In pipeline I don't have the specific numbers off hand right. But in pipeline over the course of the year, we saw, I would just say, a pretty significant shift towards larger ASP deals in pipeline. Which is frankly, again, a little bit ahead of our capacity to deliver on all of those. And so that ended up being a pressure, which why say, listen, we have to have the singles and doubles mixed in there. I do think it'll be more balanced this year. Now, I can't comment about where the current pipeline sits. I just look at it. Don't have the enterprise and it's not really enterprise versus mid-market. It's more the deal size and complexity. And customization that really that drives it more than anything else. I am expecting, based on conversations with Alan and the go-to customer team and the go-to-market team, that we'll see a more balanced mix this year coming in. We'll still get a reasonable share of the larger deals, but we are planning for it to be a more balanced mix. We think that was one of the things that we just did not quite nail the execution on last year. So we do want to be more balanced, even as we actually continue to now convert some of those larger deals. Just to be clear, that is the goal, that is the focus, in both our customer orgs for our existing customers that are asking for more, and for new business. Lots of customers are looking to upgrade their capabilities and get partners on how they actually scale their street operations. But we can say yes to more of those, but we do want more of the singles and doubles, so to speak. I do think the mix is gonna shift to be more balanced this year.

Alright. Thank you very much. More questions at this time. I would now like to turn the call over to Corey Thomas for closing remarks.

Alright. Well, thank you so much for joining us on the call today. And I really do appreciate the folks that are actually on the journey with this Rafe and I look forward to updating you on the next call.