Rapid7 - Q1 2023
May 9, 2023
Transcript
Operator (participant)
Good afternoon. Welcome to Rapid7's first quarter 2023 earnings call. All participants are in a listen only mode. After the speaker's presentation, we will conduct a question and answer session. To ask a question, you'll need to press star followed by one on your telephone keypad. As a reminder, this conference call is being recorded. I would now like to turn the call over to Sunil Shah, Vice President, Investor Relations. Thank you. Please go ahead.
Sunil Shah (VP of Investor Relations)
Thank you, Operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's first quarter 2023 financial and operating results, in addition to our financial outlook for the second quarter and full fiscal year 2023. With me on the call today are Corey Thomas, our CEO, and Tim Adams, our CFO. We have distributed our earnings press release over the wire and is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast, and following the call, an audio replay will be available at investors.rapid7.com. During this call, we may make statements related to our business that are considered forward-looking under federal securities laws.
These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995, include statements related to the company's positioning, strategy, business plans, and financial guidance for the second quarter and full year 2023, and the assumptions underlying such goals and guidance. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the future results expressed or implied in these statements due to a number of risks and uncertainties, including those contained in our most recent Annual Report on Form 10-K, filed on February 24th, 2023, in the subsequent reports that we file with the SEC. The information provided on this conference call should be considered in light of such risks.
Actual results and timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by applicable law. Our commentary today will primarily be in non-GAAP terms and reconciliations between our historical GAAP and non-GAAP results and guidance can be found in today's earnings press release in our website at investors.rapid7.com. At times in our prepared remarks or in response to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be one-time in nature, and we may or may not update these metrics in the future.
With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey?
Corey Thomas (CEO)
Thank you, Sunil. Hello to everyone on the call today. Thank you for joining us this afternoon on our First Quarter 2023 Earnings all. I am pleased to report that Rapid7 started the year with strong momentum as we work to deliver customers a comprehensive security operations platform at the most compelling economic value. Faster than expected traction from our Threat Complete and Cloud Risk Complete consolidation offerings, which together represented over 20% of new ARR in the first quarter, supported steady customer demand for our Insight Platform, driving 16% year-over-year growth in ARR to $728 million. Revenue and operating income both exceeded our expectations as customers gravitate towards our security operations solutions and as we manage the business for profitable growth.
The customer spending environment in the first quarter was broadly in line with our expectations shared on the February earnings call. Despite ongoing complexity in customer budgets, including elevated levels of deal inspection, we saw strong underlying demand for our Insight Platform to start the year. Our solutions solve a critical set of needs for security teams who are working through a complex threat landscape, constraints on talent, and worsening consequences from cybersecurity incidents. While overall demand trends were consistent with our expectations, I'm pleased to share that our teams are demonstrating the ability to execute in an environment with higher budget scrutiny and ongoing macroeconomic uncertainty. A few positive themes continued to resonate in our business throughout the first quarter. The first is that we are benefiting from a clear customer preference for consolidated security offerings.
There is a persistent and crucial need to gain visibility and assess risk across traditional and cloud environments. As security teams are laser focused on improving both the effectiveness and efficiency of their programs while maximizing their budget dollars. Our solutions lean into this dynamic by offering best-in-class automated capabilities across cloud security, detection and response, and vulnerability management, while being delivered through new and differentiated pricing and packaging models. As a result of this approach, we are at times seeing less competition for critical capabilities given the unique scope of our offerings, which in many cases customers aren't able to consolidate on a single platform with other vendors. These dynamics highlight our unique competitive position as we look to capture greater wallet share in a consolidating security operations market.
As customers gravitate towards vendor consolidation and our sales team ramps up on the new offerings, we are seeing the clear benefit in ASPs for our Threat Complete and Cloud Risk Complete deals, which average more than 2x our overall ASPs in the first quarter. Our marketing and enablement efforts around these offerings were largely competed in the first quarter. So far, over one-third of our sellers have sold at least one of our consolidation offerings. Another theme that continued in the first quarter was the growing traction with our differentiated cloud security solutions. InsightCloudSec provided customers real-time visibility into their cloud environments with a breadth of features, including posture management, agentless cloud vulnerability assessment, workload protection, cloud detection response, and automated remediation.
The ability to bring these capabilities onto a cohesive platform offering is increasingly resonating with customers, particularly as usability and time-to-value have long been core differentiators for Rapid7. Cloud security has evolved over the last few years from a niche, complex market into the one we see today, where mainstream enterprises show increasing demand for solutions that can solve their cloud challenges in an accessible, efficient, and automated fashion. Our approach to the market through a consolidated platform focused on accessibility and ease of use is making cloud security more accessible to a broader customer base. Cloud Risk Complete packages the breadth and depth of our top link cloud technology alongside our enterprise-grade vulnerability management, which provides visibility to traditional environments.
This comprehensive risk visibility across cloud and hybrid environments, combined with the compelling package pricing structure, is driving a strong value proposition for organizations of all sizes. A great example of the value we're bringing to customers through Cloud Risk Complete is a recent six-figure ARR deal with a mid-cap technology company. The customer was unhappy with their vulnerability management provider and searching for a replacement standalone VM solution. Our sellers were able to expand the conversation to include cloud security and application security as part of our new Cloud Risk Complete package offering. Rapid7's robust product features, combined with real-time event-driven data harvesting, stood out as competitive differentiators as well as our ability to unite vulnerability data with cloud security data for more actionable alerts and more automated remediation.
Ultimately, our sellers were able to bring together the customer's on-premise and cloud security teams to win this deal by combining three silo solutions into a unified platform with a single cost-efficient contract. Another first quarter example of our expanding value proposition for customers is a six-figure ARR deal with a regional healthcare company. The customer was struggling to use a legacy SIEM solution managed by an MSSP due to the complexity of the data and reports as well as the quality of the alerts. They needed a way to identify user behavior in one unified way and define automated solutions that reduced manual work. Our Managed detection response offering, combined with InsightConnect automation, allowed us to win the deal based on strong underlying technology, amplified by the security expertise of our best-in-class SOC analysts.
As part of our continued focus and commitment to customers, I'm thrilled to welcome Larry D'Angelo to Rapid7 as our Chief Customer Officer. This is a newly created role that oversees our sales organization and all of our customer success teams across advisory, onboarding, and support. Larry has extensive background at various software companies and private equity firms, Some of you may remember that he served as Chief Sales Officer for LogMeIn for over eight years, helping the company scale from $100 millio-$1.4 billion in revenue. We're excited to have Larry on our team and believe that customers will benefit from having a cohesive customer organization to support their growth throughout the end-to-end customer lifecycle.
As we look out over the remainder of the year, we are encouraged by the underlying demand for our cloud-native Insight Platform, our ability to execute in a tighter budgetary environment, and our unique position in the customer-driven consolidation wave for security operations solutions. We are on track to meet our growth and profitability targets for 2023 and believe we're well-positioned for long-term growth as we execute on our strategic vision to bring Rapid7 to the center of customer security operations programs. As we refine our go-to-market strategy and invest to support innovation, we are focused on delivering better security outcomes to the large market opportunity in front of us, while maintaining a deliberate focus on expanding the efficiency and profitability of our business. With that, thank you for joining us on the call today.
I will now turn the call over to our CFO, Tim Adams, to share additional detail on our financial results and outlook. Tim?
Tim Adams (CFO)
Thank you, Corey, good afternoon to everyone on today's call. Thank you for joining us. Before I turn to the results, a quick reminder that except for revenue, all financial results we will discuss today are non-GAAP financial measures unless otherwise stated. Additionally, reconciliations between our GAAP and non-GAAP results can be found in our earnings press release. Rapid7 ended the first quarter of 2023 with $728 million in ARR, representing growth of 16% year-over-year and consistent with our expectations. We continue to see year-over-year growth driven in large part by our anchor offerings of detection and response, cloud security, and vulnerability management, which represent the foundational capabilities of our Threat Complete and Cloud Risk Complete consolidation offerings.
The breadth and effectiveness of our Insight Platform, along with our ability to drive value with our complete offerings, are resonating with customers as they continue to navigate an evolving budgetary environment. We see ARR growth coming from both new and existing customers, with ARR per customer that grew 9% over the prior year to $66,000, while our global customer base grew 6% year-over-year to over 11,000 customers. As Corey mentioned earlier, over 20% of our new ARR in the first quarter was driven either by a Threat Complete or Cloud Risk Complete offering. We see traction here both with landing new customers and expanding with our current customers, with new ARR for Complete deals seeing healthy contributions from each type of customer.
First quarter revenue of $183 million grew 16% over the prior year and exceeded the high end of our guidance range. Over 95% of revenue in the quarter was recurring, and product revenue grew 17% over the prior year to $174 million. International revenue grew 21% year-over-year and represented 21% of total revenue, while North America grew 15% over the prior year. Turning to our operating and profitability measures for the quarter. Product gross margin was 76% in the first quarter, and overall gross margin was 73%. Both were within our stated range of expectations, which is mid-seventies for product gross margin and low seventies for overall gross margin. Sales and marketing expenses represented 39% of revenue, compared to 43% in the prior period.
R&D and G&A expenses were 20% and 8% of revenue, respectively, compared to 23% and 9% in the first quarter of last year. We delivered strong first quarter operating income of $11 million above the high end of our guided range. Our adjusted EBITDA was $17 million in the quarter, and diluted net income per share was $0.16. Moving to our balance sheet and cash flow statement. We ended the first quarter with cash equivalents and investments of $270 million. Cash flow from operations was $6 million and free cash flow was ahead of our expectations and just below breakeven. This brings us to our outlook.
We continue to believe that the largest drivers of ARR growth performance this year will be related to executional improvement, including continued momentum for our consolidated offerings, as well as the impact of the broader macroeconomic environment on customer buying behavior. We are pleased that our first quarter results track to the plan across all metrics despite a noisy environment. We are reiterating our full year 2023 ARR guidance of $815 million-$825 million, representing year-over-year growth of 14%-16%. We are raising total revenue guidance for the full year to $773 million-$779 million, reflecting outperformance in the first quarter. This range represents growth of 13%-14%, with high single-digit growth contribution from our professional services revenue.
On profitability, we are also raising our operating income guidance of $59 million-$63 million for the full year, which represents operating margin expansion of at least 300 basis points. The increase reflects the portion of the first quarter outperformance that was unrelated to timing of spend. We expect full year net income per share in the range of $0.83-$0.89 based on an estimated 67.6 million diluted weighted average shares outstanding. For free cash flow, we continue to expect approximately $80 million for the full year, which is approximately double our 2022 level and reflects over 400 basis points of free cash flow margin expansion. Moving to our outlook for the second quarter of 2023. We expect total revenue in the range of $187 million-$189 million.
We expect non-GAAP operating income for the second quarter in the range of $7 million-$9 million and non-GAAP net income per share of $0.09-$0.12, which is based on 67.4 million diluted weighted average shares outstanding. Thank you for taking time to join us on the call today. With that, we will open the line for questions. Operator?
Operator (participant)
If you would like to ask a question, please press star followed by one on your telephone keypad. In the interest of time, we ask that you please limit yourself to one question. If you have any additional questions, please rejoin the queue. Thank you. Our first question comes from Matt Hedberg from RBC Capital Markets. Please go ahead. Your line is open.
Matt Hedberg (Managing Director and Software Research Analyst)
Great. Thanks for taking my question. To keep it to one here, I guess maybe for Corey, you know, the success on the Complete offerings is really great to see. Obviously, there's clearly, I think, a security efficacy benefit there when customers select one of those bundled offerings. I'm wondering if you could talk to the ROI element from a customer's perspective when they consolidate on RP. It seems to be a big part of the narrative here. I wonder if you could talk to that part.
Corey Thomas (CEO)
Yeah, you're right, Matt. I think there's two things. One, customers are more interested in consolidation because they have to do more with less budget growth. You know, I remind you that budgets are still growing. They're just growing at a slower rate that they were in the past, with a little bit more uncertainty. What customers are trying to figure out by and large is really two separate things, is one, they wanna figure out how do they actually continue the security improvements that they've committed to that are necessary, that are critical, in a more, I would say, tighter budgetary environment going forward. They also importantly wanna figure out how they boost the productivity of their team. Remember, it's not just the budgets that we talked about, it's also their teams and their team's effectiveness and their team's productivity.
The value proposition around our both the Threat Complete and the Cloud Risk Complete is really focused on how do you actually solve the problem of either managing threats or managing risks, but really doing that at high levels of efficacy and high levels of productivity. One of the side benefits of that is that it's also cost effective to leverage spend on a common platform. The primary benefit is that we're driving productivity and efficiency. The way that we actually do that with Threat Complete is providing the complete stack, and solution around how people collect all the data across 100% of the environment to detect attacks, then the analytics to respond, and then the automation to make sure that that response is robust.
On the Cloud Risk Complete, it's really that integration of looking at the best in class across both the traditional VM, but also increasingly people are migrating to the cloud, and they wanna find a way to actually manage the risk in their cloud environments holistically. Again, it's a productivity boost and about how they get more out of their talent and their staff, but also by consolidating on platform, they get a direct economic boost that gives them scale by investing with us.
Saket Kalia (Managing Director of Equity Research Analyst)
Thanks, Corey.
Corey Thomas (CEO)
Thank you very much.
Operator (participant)
Our next question comes from Saket Kalia from Barclays. Please go ahead. Your line is open.
Saket Kalia (Managing Director of Equity Research Analyst)
Okay, great. Hey, guys. Thanks, thanks for taking my question here. Corey, just to make sure that this question is asked publicly, I was wondering if you could just comment at all on just the public headlines earlier this year around a sales process. Of course, the same question I asked last quarter, but also maybe as part of that, comment on whether that is a process that's still ongoing.
Corey Thomas (CEO)
Apologies, we had a little technical difficulty. Saket, I believe you broke up toward the end, but I believe you were asking about the rumors that I addressed on the last call. I would just say it's still the same comment. We don't really comment on rumors. That said, we have a pretty exciting opportunity in front of us. We have momentum that I think is demonstrated by our results this quarter, and so we understand why people would actually talk about us in that lens, but we're squarely focused on continuing to drive our performance in the business, deliver results for our customers, and we think that's gonna deliver a great return for shareholders.
Saket Kalia (Managing Director of Equity Research Analyst)
Got it. Fair enough. Thank you.
Corey Thomas (CEO)
Thank you.
Operator (participant)
Our next question comes from Rob Owens from Piper Sandler. Please go ahead. Your line is open.
Rob Owens (Managing Director and Senior Research Analyst)
Yeah, good afternoon. Thanks for taking my question. wanted to focus in a little bit around net new ARR, obviously it's been under pressure for the last year. I think given your holding ARR guidance for the year, does require some acceleration, in the back half. Is that a function of sales productivity? Is that a function of where the pipeline, sets up at this point? Just some color would be appreciated. Thanks.
Operator (participant)
Ladies and gentlemen, we are experiencing technical difficulties. Please stay on the line.
Corey Thomas (CEO)
I'm sorry. We had a couple of technical difficulties. Rob, can you hear me okay?
Rob Owens (Managing Director and Senior Research Analyst)
I can hear you, Corey. Can you hear me?
Corey Thomas (CEO)
Yes.
Saket Kalia (Managing Director of Equity Research Analyst)
Yeah, we can now.
Corey Thomas (CEO)
We can now. Apologies for that. Did you hear the answer that I gave?
Rob Owens (Managing Director and Senior Research Analyst)
I did not. It went completely dark after my question, so I don't think I stumped you. Go ahead and.
Corey Thomas (CEO)
Yeah. You didn't stump me.
Rob Owens (Managing Director and Senior Research Analyst)
Sales productivity, net new ARR, just put it into context for us. Thanks.
Corey Thomas (CEO)
Yeah, we had a bit of a power surge. Yeah. Thanks for that, Rob. Look, our outlook was really based on two common themes, is one is execution of the sales force transformation, which I think look, we're well underway. I would just say we're ahead of schedule, and that's gonna trend exactly as we expected to. The second thing is, could we actually build the critical pipe in the platform consolidation areas that we're looking for? Which we are ahead of schedule and the pipeline build continues pace. The third thing is, are the conversion rates for those areas where we expected them to be? The conversion rates are quite strong in those areas.
As we sit here today with the pipeline build, the sales force adoption being not just deep but also broad, and the conversion rates continuing to be strong, we're set up well for the second half of the year, and it's really predicated on those trends continuing. Not a really a shift in the trend, it's just a continuation of those trends that's based into our core model.
Rob Owens (Managing Director and Senior Research Analyst)
Thank you.
Corey Thomas (CEO)
Thank you very much.
Operator (participant)
Our next question comes from Shrenik Kothari from Robert W. Baird. Please go ahead. Your line is open.
Sunil Shah (VP of Investor Relations)
Hey, Shrenik, go ahead. We cannot hear you.
Operator (participant)
Shrenik Kothari, your line is open now.
Corey Thomas (CEO)
Operator.
Eric Heath (VP of Equity Research Analyst)
Hey.
Shrenik Kothari (VP of Infrastructure Software and CyberSecurity Equities)
Sorry, can you guys hear me now?
Corey Thomas (CEO)
Yeah, we can hear you now.
Sunil Shah (VP of Investor Relations)
Yeah, we can hear you. Thank you.
Shrenik Kothari (VP of Infrastructure Software and CyberSecurity Equities)
Great. Thanks a lot. So, very quickly on the traction that you guys highlighted on InsightIDR and Cloud Risk Complete, it's kind of driving multi-product adoption for you guys. I mean, and you guys also highlighted kind of this gravitation towards vendor consolidation. This is something which we have been hearing from your peers and rivals as well, and the benefit that you're seeing in ASP. So can you just comment quickly on the win rates and the competitive environment that you're seeing right now? I know there's a lot of noise out there, but would appreciate some comment there.
Corey Thomas (CEO)
Yeah, I mean, look, I think we're well-positioned if you think about consolidation in security operations space. There's few folks that actually span, cover the span of security operations. You look at us, we're a VM, multiple aspects of cloud security, CSPM, cloud vulnerability management, workload protection. We also have a quite impressive SIEM technology that forms the core of our security operations platform for managed detection response, along with security automation. If you look across security operations, I think we're set up better than anyone else I can think of to actually really drive consolidation in that space. We don't have lots of direct competition.
When you think about end-to-end security operations, how do you manage risk across both the cloud, on-prem, endpoint environments from a risk visibility and management perspective, and how you detect and respond to attacks across the environment, from a security analytics and automation orchestration perspective. The win rates is extraordinarily high. Again, it's really 'cause they're not challenged in that space. What our sales force has actually learned is frankly to actually make that the primary focus with our consolidation offerings. 'Cause when we actually shift it to how do you actually think about accelerating your security operations momentum at the best efficacy and the lowest possible long-term cost, that really differentiates the dynamic for our sales team. That's what we're seeing in the space.
What we see competition is primarily in the point solution space, not the consolidation space of security operations.
Sunil Shah (VP of Investor Relations)
Corey, I would just add, we know it's still early with our consolidation offerings. In Q1, over 20% of the new ARR came from the new packages, and we're seeing more and more of our sellers engage and be successful getting that sale. That's up from what we saw in Q4. It's two data points that are looking very positive. You know, as you said, this was always intended to really gain full momentum towards the second half of the year.
Corey Thomas (CEO)
Thank you for the question.
Shrenik Kothari (VP of Infrastructure Software and CyberSecurity Equities)
Thanks, Corey.
Operator (participant)
Our next question comes from Michael Turits from KeyBanc Capital Markets. Please go ahead. Your line is open.
Eric Heath (VP of Equity Research Analyst)
Hey, guys, this is Eric Heath from Michael Turits. Just wanted to make sure I understand just kind of high level. Just curious, it sounds like go-to-market execution is progressing better than you expected. On the macro, it sounds like maybe it got a bit worse in the quarter, but no more than you were kind of already factoring in 90 days ago. Just one, curious if that's right. Then, kind of secondarily to that, if that kind of gives you some more confidence in that ARR guide for the year?
Corey Thomas (CEO)
Yeah, I think that's the right descriptor. I would say we factored in a little bit of pressure this year, and I would say the pressure materialized largely in line with what we expected. So that's why I say the market expectation is in line with our expectations, which frankly we feel good about at this stage. Then, to your questions about the sales force, you know, the two things that actually give us confidence as we actually look out to the year are, one, the breadth of participation of the sales force, the retention of the sales force. Also look, you know, sales forces live and breathe on confidence.
The fact that we actually have people both building the pipe and the pipeline converting, while it's still early because the pipe's relatively fresh in the cycle, that actually gives the broader team confidence, and it also gives us better visibility and more predictability as we go forward. I would say incrementally, because we've executed against the plan so far this year, that yes, boosts our confidence. You have a plan, it's a, you know, it's a high confidence plan when you start off, but you wanna see that you're executing against that plan, and we make steady execution against that plan as we go forward.
Eric Heath (VP of Equity Research Analyst)
Great. Thanks, Corey.
Corey Thomas (CEO)
Thank you.
Operator (participant)
Our next question comes from Gregg Moskowitz from Mizuho. Please go ahead. Your line is open.
Gregg Moskowitz (Managing Director of Enterprise Software)
Thank you for taking the question. It's great to hear about the traction with Threat Complete and Cloud Risk Complete, including that ASPs have been showing more than a 2x uplift. Is it fair to assume that you're seeing more of an uptake for these packages from enterprises as opposed to mid-market? Secondly, now that you have a few more months of data, do you have a sense of whether or not this strong ASP uplift could be sustainable? Thanks.
Corey Thomas (CEO)
Yeah. Yeah, it's a great question. As you would expect, yes, we do see early on, a bit more of the bias around the consolidation offerings come from more enterprise-oriented or larger customers in the mix. That said, we do expect that to change. We have high resonance and excitement on our mid-size team. You know, from an expectations perspective, the mid-market is in line with what we expected, but our team has lots of excitement about the pipeline that they're actually building there. The conversion rates, while very early, are healthy there. We do expect that to span. We actually think the case for consolidation is extraordinarily strong, not just in the enterprise but also in the mid-market space.
Sunil Shah (VP of Investor Relations)
Okay, that's helpful. Thanks, Corey.
Corey Thomas (CEO)
Thank you.
Operator (participant)
Our next question comes from Brian Essex from JPMorgan. Please go ahead. Your line is open.
Brian Essex (Executive Director of US Software Equity Research)
Hi, good afternoon. Thank you for taking the question. maybe Corey, just maybe if we can dig in and understand the setup for the second half of the year, both from a macro as well as a sales productivity standpoint in terms of like what your expectations are embedded in, you know, the guidance for the rest of the year. I guess on the sales front, are you assuming any kind of, I guess, maybe what was the linearity of hiring last year? And is there a certain maturity baked into your assumptions that you need to see from the sales force? And then from a macro perspective, is it stay the same, deteriorate? Like what's the setup?
Corey Thomas (CEO)
Yeah, it's a great question. You know, I will sort of like break down the balance. One, on the Salesforce side, I would say, look, our biggest assumption was that we would be able to retain the critical parts of the sales force and that they would actually be able to continue to be productive. We retained the productivity as improved Pipeline building is where we expect it would need it to be. I would say the Salesforce piece is set up well. Keep in mind that we actually have a good setup when you think about a year-over-year comparative basis. We have a more experienced sales team. They've had sort of a ramp period of the new offerings. The offerings are competitive, the conversion rates are stable.
From a Salesforce setup, we feel extraordinarily strong about the setup for the back half of the year. There's work to do, but both on a comparative basis and an outlook basis, we actually feel relatively good there. You know, the second part of the assumption for the second half of the year was predicated on the first half of the year, that we could actually build the right pipe. I would say we're still building the pipe, but the pipeline build that we're actually doing is actually increasing at the rate that we actually have. We think we'll have enough things even in this pressured environment for the back half of the year, and we expect the conversion rates to stay consistent with what we've seen in the recent quarter.
Now, all that tees up to our expectations for the back half of the year is continues to be a pressured environment. We are not expecting the economic outlook to actually get better. We're still expecting volatility, we're still expecting pressure. What gives me confidence is our sales team has shown that they can actually deal with that environment. That's a little bit of why we actually are having higher pipeline requirements, because we expect, you know, more things to be noisy in cycle. It's a little bit why our sales teams have to learn how to navigate, I would say, changing deal cycles. We expect longer sales cycles, but all that's baked into our assumptions.
I would say our trends as we're set up today are for what we're seeing to continue forward for what we saw in Q1 and continue forward Q2 into Q3 into Q4.
Sunil Shah (VP of Investor Relations)
Corey, it's worth underscoring that point because our sellers are really adapting to this environment. We know there's budget scrutiny across customers across the board, I think they really appreciate and they're understanding how to sell better in that environment.
Corey Thomas (CEO)
Absolutely. Thank you for the question.
Brian Essex (Executive Director of US Software Equity Research)
Super helpful call. Thank you.
Corey Thomas (CEO)
Thanks.
Operator (participant)
Our next question comes from Brad Reback from Stifel. Please go ahead. Your line is open.
Brad Reback (Managing Director)
Great. Thanks very much. Corey, last quarter you talked about international retention rates being a bit of a headwind. Maybe you can talk to where they were this quarter and what the expectations are for the rest of the year. Thanks.
Corey Thomas (CEO)
Yeah, I'll tag team that with Tim. What I would say is that in general, from our expectations are the international team is performing in line, if even slightly better than what I expected. I feel so pretty good about the outlook for the year going forward as far as our international team goes.
Sunil Shah (VP of Investor Relations)
Yeah. No, Corey, that's right. Look, we've made that investment internationally. We're starting to see signs that it is paying off. Internationally, the retention is improved, let me say modestly in Q1. Overall, retention is in line with our expectations and continues to be stable in North America. Something that's very important, we put a lot of effort into it and pay a lot of attention to it.
Brad Reback (Managing Director)
Great. Thanks very much.
Corey Thomas (CEO)
Thanks for the question.
Operator (participant)
Our next question comes from Matt Saltzman from Morgan Stanley. Please go ahead. Your line is open.
Matt Saltzman (Software Equity Research)
Hey, team. Good afternoon. Thanks for taking the question. Fully appreciate the ARRs, the key top line metric that we want to focus on here. Just in thinking about how that all flows through the model, can't help but notice that billings were a little bit lighter than expected in Q1. I'm curious what the driver of that was and kind of where you expect to make that up, you know, over the course of the year to still achieve the updated revenue guide. Thanks.
Sunil Shah (VP of Investor Relations)
Yeah. Hey, Matt. No, I appreciate the question. look, ARR is the core metric that we share with everyone, which embeds a lot of different things to get to that number, the new, the expand, retention, et cetera. I think you do have to be a little careful when you're looking at a quarterly billings number. We do look at that, but I do think a better way to look at it is on the last 12 months worth of billing. If you do that, you'll see that growth rate is more in line with the growth rate that we're seeing in ARR. There can be some anomalies. There's not a lot of those in terms of timing of billings with certain customers.
I would encourage you maybe to take that longer term view, and I think it's probably the more indicative view that's gonna link to ARR.
Corey Thomas (CEO)
Thanks for the question.
Operator (participant)
Our next question comes from Adam Tindle from Raymond James. Please go ahead. Your line is open.
Adam Tindle (Managing Director)
Okay, thanks. Good afternoon. Hey, Corey. Coming off of RSA, cloud security was certainly a big theme. On one hand, you know, kind of viewed as a hidden asset within the Rapid7 model. On the other hand, there were some private companies with very healthy funding suggesting that they're taking share in cloud security and coming out with hybrid and runtime capability in the back half of this year that'll go after some of the more traditional vulnerability management players like Rapid7. I just wanted to give you the floor, you know, the truth behind some of those fears and competing with Wiz and how you're thinking about potentially defending that threat in the back half of this year. Thanks.
Corey Thomas (CEO)
First of all, I actually think it'll be great. It'll help market for customers that the way they should think about this across their complete environment. When you have customers that say, "I wanna look at risk across on-prem, endpoint, and the cloud," we will actually dominate in that space. There's a couple different reasons. Is one, I think Wiz or any other player will find this an incredibly long tail on vulnerability management. You can do some of the easy Windows pieces, when you think about what customers are looking for enterprise-grade vulnerability management, you have to be able to collect all the data, look at all the content, assess that, and look at cost that. That's not a 12-month engineering effort. If it was, this market would've been disrupted a long time ago.
Most importantly is we've been investing in the maturity of the cloud security. We've been under-marketing it, under-selling it. From a head-to-head perspective, we actually have a quite a compelling capability in cloud, and now we've been ramping up in our focus on the sales and marketing of that. When you combine all that together, it benefits us to actually have the market think about the way that we think about it. Is that you should manage your risk holistically, whether it's hybrid, whether it's on-prem, whether it's at the endpoint, or whether it's at the cloud. The faster that the market thinks about that, the easier it will be for Rapid7 to actually execute a strategy. In that, in that model, I think that we will be anyone head-to-head from a technology comparison basis.
We welcome any competitor in the market helping us frame the way that customers should think about it holistically from an end-to-end perspective, because we think that that benefits us, and we're certainly gonna be investing in helping customers understand that they should be investing in those end-to-end risk management platforms.
Brian Essex (Executive Director of US Software Equity Research)
Great points. Thank you.
Corey Thomas (CEO)
Thanks.
Operator (participant)
Our next question comes from Joel Fishbein from Truist. Please go ahead. Your line is open.
Joel Fishbein (Managing Director)
Thanks for taking my question. Corey, one for you. Just I know it was a small acquisition, but Minerva, you did a little while ago. I know it wasn't very big, but I'd love to understand how that fits into the overall scene going forward, what the, you know, whether it'll be fully integrated and, you know, whether, you know, how it will be sold going forward. Thanks. Appreciate it.
Corey Thomas (CEO)
You know, great question. It's a tech and team deal, and it really enables us to unlock our Threat Complete strategy. You know, as you're aware, is that we have lots of demand for customers to actually help them manage from the endpoint to the cloud, the ability to detect, respond, and remediate threats. Now, one of the things that our customers asked us for is that they had a wide range of endpoint technologies and antivirus. The ones that could actually sort of like afford to or focus or had advanced endpoint protection technologies, we integrate with those. We'll continue to integrate with those, and we're happy with a partnership or co-opetition approach.
For those that actually truly just had simple AV, and they relied on us to provide their end-to-end detection and response capability, Minerva allows us to actually do advanced in-memory protection on those endpoints that allows us to make sure that when we detect a threat, those customers are empowered to stop those, the same way our automation and our SOAR technology allows them to actually orchestrate the across the environment and stop, the same way that we actually are able to stop processes, isolate resources, contain users. That same mentality is what actually has us actually helping our customers respond to their need for cost-effective detection response. Frankly, customers shouldn't have to make this trade-off between spending lots of money to actually have a highly effective and efficient end-to-end detection response capability.
Again, our focus is meeting customers where they are, endpoint to the cloud, and providing the capabilities they're asking for to deliver a robust detection response platform.
Joel Fishbein (Managing Director)
Great. Thank you.
Corey Thomas (CEO)
Thank you.
Operator (participant)
Our next question comes from Gray Powell from BTIG. Please go ahead. Your line is open.
Gray Powell (Managing Director)
Great. Thanks for taking the question. Yeah, it was good to see the increase in the Complete mix to 20% of net new ARR. I think that number was 10% last quarter. Can you maybe just was that more on the cloud security side, or is that more the Threat Complete products? Just be curious what drove that improvement.
Corey Thomas (CEO)
No, we got traction on both sides of the equation there. The pipeline build has been healthy for both. So we'll continue to focus on both. We don't, I can't recall, we don't do the line item reporting here on it, but we actually have gotten traction across both of those portfolios.
Sunil Shah (VP of Investor Relations)
Yeah. Greg, you're right, it was 10% of new ARR in Q4, so it's up significantly in Q1.
Gray Powell (Managing Director)
Got it. All right. Thank you very much.
Corey Thomas (CEO)
Thank you.
Operator (participant)
Our next question comes from Jonathan Ho from William Blair. Please go ahead. Your line is open.
Garrett Burkam (Equity Research Associate)
Hi. Thanks for taking my question. This is Garrett Burkam for Jonathan Ho. You mentioned the sales transition is ahead of schedule, ahead of your expectations. Can you just expand on that a little bit, just maybe what specifically is progressing well there and maybe where there's still room for improvement? Thanks.
Corey Thomas (CEO)
Well, I think there's room for improvement in this is we have to hit the plan. We're ahead of schedule on the plan, because you're ahead of schedule, you still have to manage to the plan. That's. There's no big gap on sort of like where we expect it to be. Specifically, you know, what's ahead and what's the next step in the plan is. You know, there's a couple elements that we've actually emphasized. One is that could you do the transition and retain the sales team? Check, we've actually done a very good job of actually doing the transition and retaining the sales team with confidence. The second part is could you actually get pipeline build not just across a few people, but across a broad base of people?
Nicely, we're seeing pipeline build continually starting to actually ramp and increase across a broader and broader selection of the sales force. Third, I think Tim highlighted this in his remarks, it is not just a few reps, but is a larger and larger cross-section of reps landing deals. This is why that sort of moving from 10% to 20%, over 20% matters, is because you need the success to actually follow it. In Q1, we actually saw that progress. That was ahead of where we wanted to be, and we need to continue to see that progress in Q2. Our outlook for Q2 presumes that that progress continues, because that's the setup that we have both in the pipeline and the conversion rates that we've seen.
Those are the elements of the sales force is are they, you know, are they there? Are they motivated? Are they building the pipe in the right areas? Are they converting that pipe? Are they closing deals? So far versus plan, it's at or better than what we expected across all of those metrics. Thank you for the question.
Garrett Burkam (Equity Research Associate)
Got it. Thank you. Yep, thanks.
Operator (participant)
Our next question comes from Joshua Tilton from Wolfe Research. Please go ahead. Your line is open.
Joshua Tilton (SVP of Equity Research)
Hey, guys. Thanks for for taking my question. I know there's been a lot on it, but I kinda just wanna come back to the guidance. It does imply that you guys have to kinda triple your net new ARR by 4Q. Assuming that this all does go to plan and you achieve that, you know, what percentage of net new ARR by the end of the year is gonna come from these complete consolidated offerings? I'm only asking because it does feel like in addition to just these bundles ramping, you need to see a pretty meaningful improvement in the rest of the business. One, am I looking at this the right way? Two, can you maybe just unpack for us the other 80% of net new ARR?
You know, what's driving that, and how will that trend for the rest of the year?
Corey Thomas (CEO)
One, the primary drivers of the other part of the business, AR, is what you would expect it to be. It is our traditional detection response that doesn't have the complete consolidation packages around it. Think about that's a standalone SIEM category. It's vulnerability management, it's standalone cloud. Really what you actually have there is, I would say, it's less efficient. You can clearly see that from the ASP dynamic than the packages, you get efficiency as you actually build out the packages. To clarify a couple things for you. One, in no way do we expect it to be 100% of our sales that are in the platform consolidations. We don't assume it. It's not in our base model. It's not remotely close to it.
We still have to execute on ensuring that we actually are successful in landing and closing the, you know, traditional SIEM, MDR, vulnerability management, cloud security, those elements. We still have to sell and cross-sell. We have to add threat intelligence on them. We have to add SOAR on them. All of those things are part of the business. The way that I would actually just think about sort of like the back half of the year is, one, I would just think about the backdrop and the setup. It's not just how it relates to this year, it's also what's the comparative base to last year.
Keep in mind, we actually talked about sort of like the challenge at the end of last year, but we actually have those year-over-year comparables with a much stronger sales team that's actually more mature and in process with a stronger product portfolio. One, if you just think about the setup, it's actually a much more favorable setup than the headline, I think, analysis that you actually did would indicate. The second thing is that we have to have a robust pipe. We're building that. We're trending towards the pipe that we actually need for the back half of the year. We have to execute on the packages. It's clearly gonna be above 20%, but we still have to execute on the other aspects of the business, but we are executing on those other aspects of the business.
Cloud is actually our performance in cloud is actually getting better. Even though VM is where we expect it to be, and I think we're in line with the market there, we still will close business. Most importantly, we're still gonna be executing on the cross-sell and upsell. The expansion in the install base, which again is still a material part of the business, will be executed on that. If you take that total setup, the setup, the packages, the upsell and the cross-sell, and then executing run rate against the parts of the business that we've already been executing against, I think we're set up quite well for the second half of the year and Q4, though I agree with the analysis that you actually gave from a numeric perspective.
Sunil Shah (VP of Investor Relations)
Corey, I would just underscore, we know the market opportunity. It's over $30 billion, so it's huge. We know the demand environment is there. Yes, there are some challenges from macroeconomic budgets being tightened, but security is still critically strategic for all of our customers and our prospects. We see the pipe opening, we see the conversion rates, we have the mature sellers, and we have the breadth of products, and we have the packages. Now it just comes down to execution, which we said will be heavily oriented towards the second half of the year. We're off to a good start, but we have more work to do.
Corey Thomas (CEO)
Absolutely. Thank you for the question.
Operator (participant)
Our next question comes from Alex Henderson from Needham & Company. Please go ahead. Your line is open.
Alex Henderson (Senior Research Analyst)
Great. Actually, a pretty good follow-up to the question that was just asked, and I thought that was a good question as well. I was hoping you could give us some sense of what a success trajectory would look like for the new ARR from these packages. If it's 10% going to 20%, is it, you know, 35% or 40% next quarter and 50%, 60% in the out period? What portion of new ARR should be coming from it to hit your model as we go through 2Q, 3Q and into 4Q?
Corey Thomas (CEO)
It's a good question. It's directionally up. We're not gonna provide a specific number at this time and at this stage. What I would say is we would expect it to continue to expand. Most importantly, keep in mind, it's not just the packages. We also expect to continue to be doing cross-selling and upselling. When we think about our ARR and expansion, there's a number of different elements that are involved there. I would say we absolutely directionally expect it to continue to expand, but it's too premature to provide you a specific number of what it's gonna be like per quarter by quarter right now.
Alex Henderson (Senior Research Analyst)
Yeah. Well, if you're not gonna answer that one, maybe I could ask another one. Can you give us any sense of whether there was any disruption associated with the financial debacle impacting the CFO behavior of your customers in, you know, late March? Was there good linearity or hesitation?
Corey Thomas (CEO)
Yes, I'll give you a very quick re-response there. One, what I would say is like, just like the whole world, I think lots of people took a moment and a breath to actually say, like, "What does this mean?" We definitely saw some impact and some customers actually slow down a little bit to say, like, "Hey, what does this mean? Is this sort of an indicator of a future select banking crisis?" What I would say is both from our sales team perspective and our customer perspective, that was only like a breath. It was a moment, and they got back to the business, and we actually had a fairly strong close to the quarter overall, but there was a breath that actually happened there. All right. Thank you for the questions, and let's keep going.
Operator (participant)
Our next question comes from Mike Walkley from Canaccord Genuity. Please go ahead. Your line is open.
Daniel Konikoff (Equity Research Analyst)
Hey, guys. Good afternoon. It's Daniel on for Mike. Thanks for taking the question. Yeah, I guess I just wanted to see if you guys could provide some detail on how the productivity of your sales reps are trending, especially as they're now selling the two complete bundles. Is this, I guess, sort of in line with what you had previously been expecting or are they ahead of progress?
Corey Thomas (CEO)
It's in line with what we were expecting. I would just say the progress goes a little bit to the earlier questions about the mix shift in the pipeline build. That's where we're actually ahead. Frankly, the sales of the new packages and bundles, that's where we're ahead. I would say the overall productivity is in line to expectation. Again, our expectations assumed that there was gonna be a ramp based on training, which we're seeing and we're expecting and we're delivering against. You know, we are seeing some of the larger deals that we actually talked about earlier, which do have slightly longer deal cycles in addition to the environment. I would say productivity is exactly where we expect it to be.
As we look forward, that actually gives us the confidence that we are building pipes that can actually close at the productivity rates we expect in the back half of the year.
Operator (participant)
Our last question will come from Shebly Seyrafi from FBN Securities. Please go ahead. Your line is open.
Shebly Seyrafi (Managing Director of Technology and Software Research)
Yes. Thank you very much. Your 10-K showed that your sales and marketing employee headcount grew by 16% in 2022. What kind of headcount growth in S&M do you expect in 2023?
Corey Thomas (CEO)
Yeah. I think as Tim sort of like conveyed earlier, I think we are looking for a pretty modest growth there. I think we expect more productivity increases. We have the benefit of actually having the people in place. It was allowing them to get more tenured, to get the training, the enablement, and the ramping. I would expect modest, and that's really the focus on the productivity. I think we're trending well there.
Sunil Shah (VP of Investor Relations)
Yeah. Shebly, as you know, we've doubled our profitability guidance from a year-over-year and free cash flow, and we are certainly very committed to that. We got in front of the headcount hiring curve over a year ago, and it's something that we're just gonna watch very carefully along with all of the expenses, the way we invest in the business.
Corey Thomas (CEO)
Absolutely. Thank you for the question.
Sunil Shah (VP of Investor Relations)
Thanks.
Operator (participant)
We have no further questions. I would like to turn the call back over to Corey Thomas for closing remarks.
Corey Thomas (CEO)
Well, thank you all for spending time with us this evening. I hope you all have a great rest of the day and a good week.
Operator (participant)
This concludes today's conference call. Thank you for your participation. You may now disconnect.