Conference Transcript - RPD 2025-08-12

Kingsley Crane, Analyst — Canaccord

Welcome, everybody. Thanks for being here. I'm Kingsley Crane. I'm one of the software analysts. Here at Canaccord with me, we have the Rapid7 team. We have Corey Thomas, CEO, and Sunil Shaw, SVP of Finance. Thanks for being here.

Corey Thomas, CEO

Thank you. Good to be here.

Kingsley Crane, Analyst — Canaccord

Let's kick it off. Let's start with the recent quarter. You reported solid results last week. What were the key takeaways for you in terms of customer activity, product traction, macro signals?

Corey Thomas, CEO

Yeah. So we thought coming out of the second quarter, we saw more stability in the macro. We had a healthy quarter. We saw a concentration of some of the larger deals that had been more hesitant in the first quarter, not just closed, but we saw steady mobility both there and in the pipeline overall. We saw really strong health in our detection response business. We saw budding signs of the exposure command upsell, even though they were larger consolidation deals. And so we felt good with what we saw. The primary thing that we actually noticed coming out of it is that we were seeing customers take more time, do more scrutiny and focus more on how are they going to actually do more with less spend and budget overall. And that was for the deals that actually for our consolidation play and how we help customers get leverage in their sales operations between our AI and MDR solution. That's an incredibly positive thing. But it's also now we're in a situation where we used to be a traditionally mid-market player. Now, we're actually looking at being customers' top line expense for mid to larger enterprises. And so, we're adjusting to actually having longer deal cycles with much higher ASPs.

Kingsley Crane, Analyst — Canaccord

That's really helpful. So, I want to take it back to just a basic overview of the product portfolio. From a revenue perspective, it's a bit of a tale that you have. So, you have a detection and response business. It's growing in the mid-teens. And then, you have more broadly and exposure management business that has been seeding some share a bit more stagnant. So can you speak to that dichotomy and how you're thinking about the overall portfolio?

Corey Thomas, CEO

Yeah. So when you take a look out, you zoom back a couple years ago, we had a simple thesis is that customers were going to have more complex environments. We used to be in the vulnerability management space, which was really anchored in the on-prem world. Our view was that the lead in the market overall was going to be detection response about how people manage their security operations and how they scale their security operations, and that detection response or MDR would be the primary lead motion around how people thought about that. We invested heavily to actually be great at that. Today, it's over half of our business. It's over a $400 million business. It is a managed and AI-assisted detection response business, and so we achieved our goal of actually building that business and scaling it, and now we're actually going back and actually then attaching and bringing along the rest of the security operation stack you'll see us do more compliance over time we'll continue to go back and expand on the risk management with cloud security but when we think about the portfolio security operations is really about how do you monitor what's happening your environment how do you manage your threat and risk profile how do you manage your compliance posture and then how do you actually remediate attacks against the environment the core or in the anchors detection response. We want it to be great in that because it was the most strategic, most important. That's the area of growth. We knew that if we actually did that well, then we could actually go back and build the technology, the AI, and the managed experience to actually bring the rest of the stack over it all. We've gotten half of it done. We have to actually go finish the other part of getting as much traction as we have in DNR with the rest of the cloud security, the compliance, and the risk stack.

Kingsley Crane, Analyst — Canaccord

I think that leads nicely into the next question. So when I think about the vision that you have for an integrated SOC, you include all the expertise you've built over the years, and then you start layering in agentic workflows. It really is compelling. So what do you think your right to win is in an agentic SOC arena, and then how do you think that could drive revenue acceleration and bring the whole portfolio together?

Corey Thomas, CEO

Yeah, it's a good question, especially in a world where, like, there's so much noise when you think about the agentic SOC. So you have to zoom out and say, like, what are the things that make any AI great? And at the end of the day, it's do you have better data and better expertise? Like, that's true of any AI domain. We have better data and better expertise. So why do we actually have better data? Most of the stocks that you actually see in the world, most of the agentic players in the world, train their data on the activity data that comes from reading logs, looking at alerts across the environment. And that's great. that's sort of like a part of the data that's actually needed. And most of them are just using a narrow set of product data, meaning that they don't have scale. So, they have a small set of data that they actually use to train off of. That's always going to be suboptimal. What makes us unique is two factors. One, we actually have the complete customer context. So, we not just have the activity data that every SIM, every MDR customer has. The reason we invested so heavily in the integration platform is we have all the data about what are the assets, what are the controls, what are the configurations, what are the cloud resources in the environment, and then what's the data on top of that. And then when you look at the expertise around that, we've actually been doing that for several thousand customers for multiple years and patterns. So if you look at what's different about the environment, is the first thing is that, like, you can say, well, all data's the same, but that's kind of silly. If you think about it, like, Like, if I have a drastically different environment, then the data and the attacks against my environment are going to be different. It's the same reason that you don't have the same insurance market in New England that you actually have in Florida, that you actually have in California. It's different. You're protected from different things. So you have to know what the environment is. Then you have to say, all right, how does that environmental context relate to the data? Am I actually seeing a hurricane or am I seeing an earthquake? You can't treat those as the same type of thing. And then you have to have the expertise to know how to respond. You know, if you're fighting forest fires, you need firefighters. You need a different set of things if you're actually dealing with hurricanes. So the expertise, the experience, and the data are different. We've been building that over years. By the way, that's why we went deep in that area, and we did not try to be the best in cloud security because you can't be all things to all people. We're taking the advantage that we've actually gained in managed detection response and AI and the data around that, and now we're actually expanding that out over time. But that's the core difference.

Kingsley Crane, Analyst — Canaccord

Yeah, it makes a ton of sense. And so in terms of AI and the security landscape, I would say that it's probably been better used by bad actors in the early days than the companies integrating into their own tools. I mean, how do you see that enabling more proactive security? And then how does that affect Rapid7?

Corey Thomas, CEO

Well, I mean, so it's absolutely true, but you can think about AI in some ways is tailor-made for bad actors. I mean, like, the number one thing we looked out for in attacks, we have phishing attacks, is misspelling in something that looks really fishy and weird when you have some letter that says it's from some foreign prince or your grandmother or something else. And so, of course, AI is great for actually that. It's also been great for organizing. It's been great for research. It's been great for reconnaissance. So, yes, it's many ways, if you think about some of the most natural forms of attacks, whether it's organized attacks, whether it's a reconnaissance before attacks, it's been a boon to bad actors. The challenge that security teams have and adopted is a little bit different in orientation because it's not just about reconnaissance organized. It's about managing an incredibly complex environment. And that requires tools, that requires vendors, that requires the ecosystem to produce products to actually harness the power of the environment. You're seeing that right now. If you look, we're getting better. Look, I consider us in the early stages of the AI journey. But we manage thousands of customer security operations around the world. And right now, we've actually seen massive productivity gains in the ability to expand the coverage of customers' environments and do that while lowering their overall cost. That's a massive boon. If you look at what we just released with Incident Command, it is the technology that our SOC's been using for a while. And again, it's the first phase of that release. But it allows people to actually automatically organize, automatically annotate, and automatically build investigations that pre-filter and pre-organize attacks. That is a big boon to productivity, and I think we're in the very early stages of that.

Kingsley Crane, Analyst — Canaccord

This is something I don't hear talked about a lot, but an increasingly automated security landscape with an incident response. How do you think about users becoming too reliant on automation? Is that a relevant concern for you?

Corey Thomas, CEO

Well, the question is, if you're too reliant on automation, you're only too reliant on automation if you actually have more errors and less efficacy at the end of the day. And so how do you actually assess whether you're actually going to have more errors and less efficacy? Without a doubt, we know about hallucinations. There's definitely error rates. I don't want to dispute that. The question is, are you actually able to actually scale it and get collectively more efficacy out of the solutions overall? And I think the answer is unambiguously yes. Now, I think it's incredibly naive, and I'll just say this, to actually say that I'm just going to actually hand my entire security operations right now over to an automated AI-driven stock. We're not at that point in time where you can actually do it. You still need the feedback loop where you're actually honing, tuning, optimizing. The way that we think about unraveling the AI puzzle is apply AI in the areas where humans are the most volatile and the most error-prone. And so it is incredibly great at actually pre-processing, pre-organizing, collecting the additional information and doing the same thing every time. Like if you know that when you see a certain thing, you go get this information and you organize it this way, you compare it against it that way. Humans just don't like mundane, routine things that you do time and time again. AI and automation is just better, especially if you think about adding some of the intelligence that you actually get from large language models. They actually give you the ability to actually do, I would just say, a better class of thinking against certain types of tasks. Not all tasks, but against certain types of tasks. So is AI better for certain things? Absolutely, hands down. Is it something that you actually go all or nothing? No, we're not at that stage yet. I think we're a long way from that stage where you don't have humans in the loop.

Kingsley Crane, Analyst — Canaccord

So this ties into sort of a managed service question. But so in a market where managed services are increasingly critical to resource-light organizations, how do you balance the high-touch nature of those offerings with strong gross margins in the mid to high 70s? And then maybe where does AI come into that picture to potentially boost margins?

Corey Thomas, CEO

This has been sort of like the area that probably I have the most excitement in. In some ways, we've had to curtail some of our growth because we only did things that you could actually do at a reasonable gross margin. And so for the last several years in the managed services space, there's been many private companies that have actually been unsustainable, unprofitable, and on the hopes that they can actually grow at the scale, which just isn't true. You actually have to actually build scale and efficacy. We have not just one of the larger MDR businesses. We also have one of the best gross margin profiles overall in the market there, and we've just actually unlocked the capability, leveraging AI, to actually take in more customized workloads and do it at higher gross margins. Our belief is you can actually approach products' gross margins over time leveraging AI. Now, it won't completely be there, but our belief is you can actually approach that over time. When you think about where customers are, you've got increasing security compliance requirements all over the world. You have a highly fragmented regulatory ecosystem. You have complex technology environments, and you have competition for resources within companies. It lends itself to an environment where customers are going to be more inclined to leverage managed services if they can get the right quality and the right cost. I believe that AI and managed services and the right expertise give customers that right mix of cost and quality, and we've clearly been leading into that with our MDR business overall, and we're seeing the fruits of that. Now, part of what happens is our approach has been to steadily unlock addressable market as we actually can actually do it at the right gross margin profile. And I think that strategy has been proven right when you look at there's a bunch of stuck businesses. There's a couple of high-quality businesses in the MDR space, and then there's a bunch of stuck businesses in the R space. So you've got to see the high-quality businesses that have reasonable gross margins, a healthy growth profile thrive, and you're going to see a lot of other businesses that didn't do that work struggle.

Sunil Shah, Head of Investor Relations

Yeah, and I'll just add, because I think you've seen us demonstrate that over the last number of years, right? We've talked about the sustainable sort of growth and the pace that we've seen of growth within our detection response business, now over $400 million. You've seen that scale, and we've been on that journey to see the gross margins of that business scale along the way, to where as that scaled and taken up more share of our business, you've seen us maintain that 70% plus overall gross margin as a business, very healthy kind of software gross margins at a high level.

Kingsley Crane, Analyst — Canaccord

Yeah, it's been impressive. So in the spirit of Boston, this is where we have our conference every year. You have a significant presence in Boston. You're building a tech business. Just, you know, curious your thoughts on the tech and cyber scene here and finding talent both in Boston and globally. Yeah.

Corey Thomas, CEO

Look, a couple of years ago, it was incredibly difficult. Like exiting 21 when you had hyper competitiveness in the market. Today, you can actually find great talent around the world. Boston, of course, produces amazing talent, whether it's the research institutions or even some of the schools. And I won't name all of them because I'll get in trouble and I'm local here. But like there's some great schools that create great marketing people, salespeople, finance people. so you actually have a great ecosystem we're also a global company and we actually operate all around the world talent attractiveness has probably not been as good as it is right now since pre pandemic levels like we're able to find talent we're able to attract talent it's a very very different model and so now it's really just trying to find the right talent in the right location that wants to work the right way I always joke you know someone asked me you know for one of our socks like why did you open up a sock in europe or india i said listen i can find lots of talent but you know what an attacker's favorite time to attack is it's friday night and there's not many people in the u.s um who have the skills that we're looking for who actually want to be up at 1 a.m friday night monitoring environments for attacks so we have to be globally oriented yeah i mean it's a huge asset um so and you spoke to some of your deals getting more strategic, getting larger.

Kingsley Crane, Analyst — Canaccord

You entered this year with some of the strongest pipeline that you felt that you've had in a long time. Just how would you characterize that and how we've progressed through this year and how you're looking at the backup?

Corey Thomas, CEO

Yeah, so when we entered this year, we had two sort of like two aspects of the pipeline. Our DNR deals have always been larger deal cycles. So that's not sort of like different and that's been as we expected. We had a large amount of exposure command upgrades. The way to think about that is people moving from VM to the full management of their tax surface in their environment and the understanding of the risk the threats the compliance across the environment our hope and I'll emphasize that was actually see a bunch of smaller upgrades 10 to 20% upgrades that was actually built into the plan the reality of what we're actually seeing is we're actually seeing people upgrades but they're upgrading and consolidating at the same time so instead of a 20% upgrade, we're seeing sort of like 200% uplifts on those, but also the corresponding deal cycles that actually goes along with that. And so that's what we've refactored in, is we've refactored in a year to have larger ASPs and longer deal cycles. And look, that's new for us. This is the first time that we've actually managed a deal cycle that's had this size ASPs uh and 12 month plus deal cycles in the overall pipeline right so you had you closed a number of large seven figure deals in q2 um just to play devil's advocate why why lower the guide again um you know why not kitchen sink the guide if the only new elements are some of the seasonality that you may have known a quarter yep uh and so two different parameters on the on the question so one why load the guide is that part of it our job is to make sure we communicate what you see It is different in terms of the smaller volume at-bat deals that are more predictable and the larger sort of – in the larger deals that we actually have in pipe. And we're not precise in actually predicting that. I'll just say that, like, this is the largest mix of concentrated deals. And so we want it to actually be in a range that we felt very comfortable we could actually hit. and without expecting to have the same conversion rate on half a million dollars a million and a million and a half deals that we actually had at $50,000, $60,000, $70,000 a year. Once we have some traction, we'll be much better at actually leaning in with confidence. But we wanted to actually lean in with the way that we actually say we're confident in the range and the targets that we actually have and not expecting the same types of cycles and conversions overall. I mean, same type of conversions that we were seeing on much larger ASP cycles. So that's one about why we tighten the guidance range. And, yeah, it's tight. We stay within the range, but we came down to the lower half of the range. And the question about kitchen sink unit, which we actually could have done, because that's not the feedback that we're getting from the market. We're actually getting – we are having – if we were not seeing traction or success in DNR or even the exposure to demand, then that would be a rationale, citation, sink unit. What we're seeing is larger deal cycles. We're definitely seeing all the stuff that we've been talking about for a while, so it's not like it's an easy macro environment, but it's not incrementally negative on the outlook, and we thought that was the wrong thing, too. Nuance sometimes gets lost. Trust me, there's no one more frustrated with the stock performance than I am, and for no other reason, it massively undervalues the highly successful MDR business, which is probably worth in the whole stock combined just in and of itself. but our goal is to actually tell you what we're actually seeing and to be accurate and open about that as we actually go along I want to touch on that, just given an interest of time, I want to check if we have any questions from the audience, we can get them a mic, if not we can circle back speaking to this, in terms of the stock price, I think we're clearly seeing a valuation

Kingsley Crane, Analyst — Canaccord

dislocation in the market right now stocks trading artificially depressed you have more than half the business growing mid-teens um how do you think about operating in public markets versus private markets and just can you talk more about the conviction that you have and having that growth flow through to the other half of business yeah and so um so the first thing look public versus private we don't get religious on it i will say there's a dislocation and the public valuation just is not sensible if you actually piece apart the parts of what's happening there.

Corey Thomas, CEO

And we have to execute on that. We have to deliver on that. But that's clearly sort of a dislocation right now. And by the way, public markets have that at certain points of time. And certainly, if you look at the growth trends at the macro level, it's understandable what the concern is. And that's why we try to provide the color about what's happening under that. The second thing is, how do we actually think about the growth prospects overall? Look, our thesis is very consistent. I do think we actually have some credibility here, is that more and more customers around the world now realize that they actually have to do security, but they're actually looking for partners to actually take lots of the security operational load. And so they want to operate at the program level. They do not want to be managing, installing, operating, and having legions of people managing security when they got AI pressures, they got SaaS, but they have real competitive pressures based on the environment. So our model is to be the number one security partner for security operations. we started with detection response which is a lead we will take that same model and apply it to risk management to compliance and to third-party risk and other areas of security operations but it's all going to follow the trend and the theme of how do we actually sort of give customers a better way to actually leveraging both managed services and AI to have a great high quality security outcome we're starting that focus on MDR I know that causes mix in the model overall, but we'll apply that same model across the stack, and there's zero reasons to believe, I can't say zero, there's no reasons to believe that that's not going to be just as attractive for customers. If customers are willing to trust not just us, but many parties to actually do their core detection response, which is the most strategic, they're going to be happy if they have a high-value solution that does their compliance, that actually tracks their risk performance and profiles over time. But we're building into that. And we're building into that like one workload at a time. We started with the DNR workload because that's the most strategic. We're finishing up that. And then that'll be sort of like an ongoing area. And then we'll move to the next workload. And I think we'll see growth from there. That is, look, I acknowledge that that's a tough thing to actually navigate and see in public markets. But at the same time is that we're seeing the customer adoption and the momentum. And I'm confident that like markets to rationalize with time and data.

Kingsley Crane, Analyst — Canaccord

Yeah, I mean, I think you could make a really strong argument that today the stock is already undervalued on a sum of the parts basis, and that's not including, you know, any of these other initiatives that...

Corey Thomas, CEO

I mean, if you got rid of everything else and you just looked at the DNR business in and of itself, that is itself significantly undervalued.

Kingsley Crane, Analyst — Canaccord

So you mentioned your global business. You're building out an office presence in Pune, India. You know, gross important, margins are important. Where do you see that presence going over the next couple of years, and maybe what percentage of R&D employee headcount could that reach?

Corey Thomas, CEO

Yeah, look, I mean, right now, what I'd say is that we're well under pure benchmarks. So this is a catch-up area in terms of cost-structure talent. You know, right now, India is not just a low-cost. There's some great talent. They have some of the world's also leading research universities. It's a big country with lots of talent. It's a growing market. so we both like the talent and we're also under the allocations you will see you know your average tech company has between 20 to 30 percent of their work force in different talent locations and so it's something we definitely see as a potential opportunity is it 20 is it 30 it's probably too premature to tell you but what I'll say is that like it's a great talent market the cost structure is better overall and we think it's the way we actually get scale while producing some results in the overall business just to sort of tie a bow on all this if we think out to 2028 or a couple years out where do you want the company to be like what's the vision and how do you think that we're going to get oh yeah i mean look when you think about the old model of outsourcing it is massively manual and it is overloaded with both cost inefficiencies and typically like crappy experience. Our goal is to be the leading managed security AI partner for customers. So when you think about AI outsourcing of your security operations, is we help customers scale their security operations, and we do it at better quality, better efficacy. We do it in detection response. We do it in risk management. We do it in red teaming and penetration testing. We do it in compliance. And we help customers actually get high-quality results at a reasonable cost. That is an attractive value proposition for a lot of customers, and we believe that we're well positioned to do that with the experience that we've already gotten with DNR.

Kingsley Crane, Analyst — Canaccord

Look, I'd love to spend more time. We do have to keep the conference running really efficiently, so thanks again, Corey. Thanks again, Sunil. Really appreciate you taking the time. Thank you very much.