Rapid7 - Q1 2024
May 7, 2024
Transcript
Elizabeth Chwalk (Director of Investor Relations)
Good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's First Quarter 2024 Financial and Operating Results in addition to our financial outlook for the second quarter and full fiscal year 2024. With me on the call today are Corey Thomas, our CEO, and Tim Adams, our CFO. We have distributed our earnings press release over the wire, and it is now posted on our website at investors.rapid7.com along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast, and following the call, an audio replay will be available at investors.rapid7.com. During this call, we may make statements related to our business that are considered forward-looking under federal securities laws.
These statements are made pursuant to the Safe Harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements relating to the company's positioning, strategy, business plans, and financial guidance for the second quarter and full year 2024, and the assumptions underlying such goals and guidance. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the future results expressed or implied in these statements due to a number of risks and uncertainties, including those contained in our most recent annual report on Form 10-K filed on February 26th, 2024, and in the subsequent reports that we file with the SEC. The information provided on this conference call should be considered in light of such risks.
Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call except to the extent required by applicable law. Our commentary today will primarily be in non-GAAP terms, and reconciliations between our historical GAAP and non-GAAP results can be found in today's earnings press release and on our website at investors.rapid7.com. At times, in our prepared remarks or in responses to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be one-time in nature, and we may or may not update these metrics in the future.
With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey?
Corey Thomas (Chairman and CEO)
Hello to everyone, and thank you for joining us this afternoon on our first quarter 2024 earnings call. Rapid7 ended the first quarter with $807 million in ARR, representing 11% year-over-year growth. We saw sustained momentum with our direct complete consolidation offerings, which continued ramping nicely. However, our ending ARR result was below expectations, driven by a slower-than-anticipated shift of our VM base into our integrated risk offering, Cloud Risk Complete. I'll spend some time addressing both of these dynamics on our call today in the context of our long-term investment strategy, which will also include steps that we are actively taking to improve our integrated risk momentum as we progress through the year. As a reminder, we are making deliberate long-term investments to build the strongest SOC ecosystem for mainstream enterprises and to deliver the leading data platform that contextualizes risk across a fragmented, complex environment.
In 2024, these discrete areas of focus include building on our detection-response momentum by leveraging AI to drive improved SOC efficacy and security operations. Expanding beyond VM to accelerate cloud security adoption by improving our integrated risk management offering that contextualizes data across customers' hybrid attack surfaces. Investing further in our substantial services and partner ecosystem to increase our capacity for service delivery as well as provide a strong source of efficient demand generation. We remain steadfast in our belief that these long-term investments will deliver the best value and economics for our customers. Over the past year, it remains clear that amid the current budgetary environment, customers are deeply focused on, one, consolidating, reconciling, and integrating their vast security ecosystems. Two, achieving better outcomes from their security providers at a more compelling value. Detection response is one area that we're seeing benefit of these trends.
Rapid7's consolidated detection and response value proposition is particularly compelling to these customers in today's landscape because of our unique managed service offering and ecosystem that allows teams to extend their technology capabilities with our deep security expertise. We're actively bolstering this growing business with expanded detection coverage, monitoring of third-party alerts, and AI innovations for speed, accuracy, and scalability. Specifically, our managed detection and response analysts are using AI throughout the alert lifecycle from machine learning-driven detections, intelligent triage, to AI-assisted investigation and remediation guidance. Our analysts are leveraging our internal SOC AI-assistant training on proprietary MDR insights to augment our workforce talent and reduce response time for customers. As we continue to invest behind these customer needs, we saw solid performance during the first quarter with our Threat Complete offering, which gives customers integrated detection and response capabilities across their attack surface.
Our overall D&R business maintained growth of over 20% year-over-year in the first quarter as mainstream enterprise customers continue to prioritize monitoring and detection of threats across their distributed environments. Shifting now to our focus on extending our core customer base beyond traditional vulnerability management and accelerating cloud security adoption with an integrated risk management experience across the complete attack surface. Last year, we launched an integrated risk management package, Cloud Risk Complete, which includes access to both CloudSec and VM capabilities. Although we saw increased attention and demand and accelerated cloud security growth, which validated the clear customer need, Cloud Risk Complete in its current version lacked the depth of integrated experience that drove far stronger momentum in our Threat Complete offerings.
We entered 2024 with a prioritized plan to innovate and deliver an improved Cloud Risk Complete experience that integrates distributed hybrid data sources with better economics for rapidly evolving cloud security markets, and we remain on track to deliver this improved integrated risk management solution this summer. As it relates to the first quarter, while we had a healthy start to the year with overall results that tracked well to our expectations in January and February, we saw this pace slow as we progressed through March. This is primarily due to a slower-than-expected transition in the quarter of selling our current integrated risk management package into our traditional VM base, both on new bookings and renewals.
We believe we are in a transition period during which customers are not yet able to see the benefit of the compelling foundational work that we are doing to increase customer value by evolving our Cloud Risk Complete package into an improved integrated experience. Another core component of this updated offering is the acceleration of our cloud security capabilities. We are launching significant capabilities, including revamped cloud vulnerability assessment and the general availability of Cloud VM across AWS, Azure, and GCP. This updated risk management offering will not only meaningfully improve attack surface visibility and capabilities, but the data integration at the platform level will greatly improve the economics and allow us to be a price leader in this space.
Looking forward, we expect this transition to temporarily weigh on our growth outlook through the remainder of the year as we expect to launch the updated Cloud Risk Complete this summer and begin to regain momentum exiting 2024. Now that we've covered our strength in detection response and the ongoing evolution of our integrated risk management offering, I will touch briefly on how we are increasing both demand generation and service delivery through our partners and channels. We discussed last quarter that we are strategically shifting to more efficient pipeline sources with stronger conversion. For example, our partner ecosystem added over 80% of new ARR in the first quarter, and our top partners drove a 20% increase in partner-sourced leads over the prior year.
We remain focused on the strategic nature of these relationships and scaling both the relative and absolute contribution they deliver to our business on a global basis. As we work to drive efficiency across our organization, this channel is an extremely compelling lever for growth and scale. While we are seeing promising strength in the channel as a primary demand generation driver, we are not yet making up for the pipeline sources that were de-emphasized as we entered the year. Our focus on long-term growth investments in demand generation efficiency led to what we believe is a temporary slowdown in new pipeline generation as we have transitioned away from lower-quality, less efficient sources. In addition to the promising channel strength here, we're actively accelerating and seeing early traction with actions around partnerships and marketing campaigns and improved sales enablement.
Our updated ARR guidance range assumes that pipeline growth improves modestly in the second half of the year but not at the rate initially assumed in our February guidance range. Despite these transitional dynamics, we maintain confidence that we are pursuing the right long-term strategy. We firmly believe that providing visibility across a customer's risk environment by integrating traditional vulnerability management with a broad set of cloud security solutions and pairing that with world-class D&R SOC efficacy, all in one place, allows customers a more effective solution and better overall security outcomes at the price value customers are seeking. As we build better, more connected customer experiences across our security operations platform, I am happy to welcome Craig Adams to Rapid7 as our Chief Product Officer. He will oversee our product management, operation, and overall user experience and design.
Craig has an extensive cybersecurity background in high-growth companies, including spending 20 years at Akamai. We are thrilled to have Craig on board and believe he will provide expertise and structure for our teams to deliver innovative solutions and compelling value propositions to our customers. While we are working through these transitional challenges this year, we are making progress on our overarching strategic plan and are confident that we are pursuing the right strategy for the long-term and value creation. Rapid7 has a compelling opportunity to be a leading platform consolidator in security operations as we build better, more connected customer experiences across our platform. We believe that the foundational work we are doing, while somewhat disruptive in the moment, will position us to drive market share gains and higher durable growth over the medium to long term.
Overall, we are focused on responding quickly to address the changes that need to be made in our business to shift more swiftly towards consolidated risk management offerings and to accelerate more efficient sources of pipeline growth. We believe that our integrated risk solutions will address customers' needs and accelerate consolidation on our platform for mainstream enterprises. We believe the changes and strategic investments that we are making in our business today will support better top and bottom line growth and a strong value proposition for customers that need to solve increasingly complex security challenges. At the same time, I'm proud of our team's commitment to drive business efficiency and scaling our free cash flow.
As we continue to realign our business to be more efficient overall, we will benefit from the operational flexibility within our cost structure and financial model and remain squarely focused on and are on track to scaling free cash flow and reiterating our $160 million free cash flow target for the full year 2024. With that, thank you for joining us on the call today. I'll now turn the call over to our CFO, Tim Adams, to share additional detail on our financial results and outlook. Tim?
Tim Adams (VP and CFO)
Thank you, Corey, and good afternoon to everyone on today's call. Thank you for joining us. Before I turn to our results, a quick reminder that except for revenue, all financial results we will discuss today are non-GAAP financial measures unless otherwise stated. Additionally, reconciliations between our GAAP and non-GAAP results can be found in our earnings press release.
Rapid7 ended the first quarter of 2024 with $807 million in ARR, representing growth of 11% year-over-year. Revenue was at the high end of our guidance range, and we delivered strong operating income that exceeded expectations despite our ending ARR being below expectations for the quarter. We saw healthy traction in our detection and response business, particularly for our Threat Complete consolidation offers. However, our total ARR was impacted by a lower-than-anticipated contribution during the first quarter from the transition to integrated risk management offers. We saw ARR growth in the first quarter coming from both new and existing customers, with ARR per customer that grew 7% over the prior year to $70,000 and a global customer base that grew 4% year-over-year to end the quarter with over 11,000 customers.
As it relates to our sequential change in customers, moderate positive sequential growth in our platform customer base was more than offset by a sequential decline in our non-platform customer base as we saw slower-than-anticipated traction in our integrated risk offering, Cloud Risk Complete. First quarter revenue of $205 million grew 12% over the prior year and was at the high end of our guidance range. Our recurring product subscription revenue grew 13% over the prior year to $197 million. International revenue grew 22% year-over-year and represented 23% of total revenue, while North America revenue grew 9% and represented 77% of total revenue. Turning to our operating and profitability measures for the quarter, product subscriptions gross margin was 76% in the first quarter, and overall gross margin was 74%, both in line with the prior year.
Sales and marketing expenses represented 32% of revenue, down from 39% in the first quarter of last year. R&D and G&A expenses were 16% and 6% of revenue respectively, compared to 20% and 8% in the prior year. We delivered first quarter operating income of $40 million above the high end of our guidance range and representing an operating margin of 20%. Our adjusted EBITDA was $47 million in the quarter. GAAP net income per share was $0.03, and non-GAAP diluted net income per share was $0.55. Moving to our balance sheet and cash flow, we ended the first quarter with cash, cash equivalents, and investments of $464 million compared to $439 million at the end of 2023. Cash from operations during the first quarter reflects a benefit from stronger-than-expected cash collections, helping drive $28 million of free cash flow in the quarter.
This brings us to our outlook for the rest of the year. As Corey shared in his remarks, we are revising our guidance ranges to incorporate our slower-than-expected start to 2024. Specifically, we are de-risking our expectations for contributions from integrated risk offerings throughout the middle of the year and now anticipate only a modest contribution in Q4 from our upcoming summer launch of our improved Cloud Risk Complete offering. As a result, for the full year 2024, we now expect ending ARR of $850 million-$860 million, which represents growth of 6% to 7% over the prior year. While we are disappointed in this range of growth, we remain confident that we have the right long-term strategy to deliver the best value, outcomes, and economics for our customers and to ultimately re-accelerate this growth rate.
While we do not customarily provide quarterly commentary on ARR given the slow start to the year and as we work through the executional dynamics that Corey detailed, we feel it would be prudent to share some forward direction today. For the second quarter, we anticipate a high-single-digit sequential increase in millions of net new ARR dollars, with further sequential improvements in net new ARR in the back half of the year as we improve our execution. We are revising our revenue guidance range to reflect our new ARR growth outlook and now expect total revenue for 2024 in the range of $830 million-$836 million, representing growth of 7% to 8%. Turning to full-year profitability, I am pleased to share that we are maintaining our full-year profitability targets for both operating income and free cash flow.
Despite a lower top line outlook for the year, we believe we have sufficient flexibility and expense levers to maintain our original profitability targets. As such, we continue to expect 2024 operating income of $150 million-$158 million and net income per share in the range of $2.10-$2.21 based on an estimated 75 million diluted weighted average shares outstanding. We remain committed to scaling free cash flow in our business, so we are also maintaining our expectation to generate at least $160 million of free cash flow for full year 2024. Moving to quarterly guidance, for the second quarter of 2024, we expect total revenue in the range of $203 million-$205 million, representing growth of 7% to 8%.
We expect non-GAAP operating income for the second quarter in the range of $35 million-$37 million and non-GAAP net income per share of $0.50-$0.53, which is based on 74.6 million diluted weighted average shares outstanding. Thank you for taking the time to join us on the call today. With that, we will open the call for questions. Operator?
Operator (participant)
For all. At this time, I would like to remind everyone, in order to ask a question, press star, then the number one on your telephone keypad. Your first question comes from the line of Fatima Boolani with Citi. Please go ahead.
Fatima Boolani (Managing Director and Co-Head of U.S. Software Equity Research)
Good afternoon. Thank you for taking my question. Corey, I wanted to just dig in a little bit more deeply on some of the comments you made in the prepared remarks as it relates to some of the package slowdown momentum being derailed by the fact that customers aren't "necessarily seeing the value." So I wanted to really unpack those comments a little bit further and, frankly, just pair them against or compare them against some of the dynamics you are already seeing as it relates to elongated sales cycles. So why, with the packages having been in the hands of the sales force for the better part of the year, are some of these slowdowns manifesting sort of even more pronouncedly and, again, some of the more nuanced feedback on why customers aren't seeing the value here? And a follow-up, please.
Corey Thomas (Chairman and CEO)
Thanks, Fatima, and thanks for the opportunity to clarify that. So I just want to be very clear: on the Threat Complete, we're actually seeing consistent momentum, and the performance is in line or better than expectations. So we're very comfortable there. I would say the big thing that we actually did was we took the learnings. Last year, we saw acceleration and a healthy pickup in the CRC dynamic, but we were pretty clear that it wasn't as strong as the Threat Complete demand. And as we dug into it, we saw a couple of things. One, I think we've talked about before, we needed to actually continue to make investments to accelerate the cloud, which we've actually done. And that's actually on track, and part of it's already launched and more of it's launching now. But the other part is actually driving more integrated experience.
Now, I would just say that part of it that we didn't nail as well as we could have was the execution around that transition. We started talking to our teams about the fact that we were going to be moving to this more integrated offering, taking some of our learnings, and really focusing on taking our Cloud Risk Complete and our integrated risk offering to the next level. Part of that was also going to be how we actually reassessed packaging and pricing around that specific offering. And I would just say how we managed that transition caused a little bit of a slowdown, especially in new sales, as our sales teams were actually waiting for us to actually release and actually bring forward the updated solution over the course of the year. Both our planning and our communication around that could have been better.
But that's also why we're optimistic that we'll see some of the benefits of that as we actually progress throughout the back end of the year and move into next year. But I did want to clarify it was primarily the momentum we saw last year, taking the learnings, and actually making adjustments to the Cloud Risk Complete strategy. That was where we saw the pressure. The Threat Complete strategy is still executing quite well, and the momentum is strong.
Fatima Boolani (Managing Director and Co-Head of U.S. Software Equity Research)
Great. Tim, just to put a quantitative flair or point on some of this discussion, I know you don't actively or consistently talk to dollar-based net expansion rates or net retention rates. But I'm curious, in light of some of these slower conversions and some trends around feet dragging as it relates to moving over to these new packages, is there anything you can speak to with regards to churn in the base or potentially cannibalization of traditional VM spend in the base that is also a contributing factor to the 30%-40% cut you're taking to revenues and ARR? Thank you.
Tim Adams (VP and CFO)
Yeah. Hey, Fatima. Good question. It's Tim. So we did see the customer count go down modestly sequentially Q1 to Q4, but the platform customers were actually up sequentially quarter over quarter. So it's really more of a function of some of the non-platform customers that were lost in the quarter where we saw a little bit of a headwind to churn into the customer count. But when it comes to a platform basis, the count was actually up in the quarter.
Corey Thomas (Chairman and CEO)
The only thing I had for you was just to get to the hard question. I do think that we saw some pressure. We expect some this year over what we saw last year picking up was selling CRC into our install base. And we do expect that to be a modest headwind over the next sort of few months. But we expect that to improve as we actually exit the year. But yeah, on the net expansion rate, that was a pressure. And I think that we feel very good about the launch that we actually have coming up, but we did see a moment of pressure there. Thank you.
Fatima Boolani (Managing Director and Co-Head of U.S. Software Equity Research)
Thank you.
Operator (participant)
The next question comes from the line of Saket Kalia with Barclays. Please go ahead.
Saket Kalia (Managing Director)
Okay. Great. Hey, guys. Thanks for my questions here. Corey, maybe for you on Cloud Risk Complete and maybe the demand there not being quite as strong as we expected, can you just remind me what are the biggest differences between Threat Complete and Cloud Risk Complete as we just think about sort of maybe the product areas where customers were maybe thinking a little bit more in terms of scrutiny?
Corey Thomas (Chairman and CEO)
Yeah. Saket, it's a good question. I don't think it's actually a demand issue. I think it's more of an execution and how we actually timed getting we're going to be introduced so let's just talk about what it is first. So Cloud Risk Complete is the integrated risk across the environment, whether it's on-prem, endpoint, or cloud, and providing visibility, assessment of risk across the environment, and the ability to look at attack paths across the overall environment and the threat exposure of the environment. So that's Cloud Risk Complete. Threat Complete is primarily used as a detection response offering. We've always said that that's pretty high up in the priority stack, and we continue to see momentum there overall. That said, I do want to be clear. I don't think it's a demand issue. I think there's sort of two dynamics.
One, I think we froze ourselves out a little bit as we were doing the transition to updating our packaging on our Cloud Risk Complete and our integrated risk offering. And so I think as we actually introduce that, I think we'll see momentum on that pickup as we actually exit the year. And so I think that that's more of going from one product to have an upcoming launch and how we actually execute that transition. So that's the first part of it. The second part is I think people are pretty hungry for both integrated risk visibility, having the ability to do that across their entire environment at a reasonable price point and reasonable cost. And I'll remind you that our integrated risk strategy is about how you get visibility and risk across the environment, but also doing that at a reasonable cost and more affordable rates.
Because mainstream enterprises, if you think about the Russell 3000, you think about Wells Fargo, they still are laggards on adopting cloud security because, one, it's expensive, and two, the experience needs to be productive and integrated.
Saket Kalia (Managing Director)
Got it. Got it. And maybe the follow-up there, just to make sure I completely understand and sorry if this was mentioned during the early part of the prepared remarks, but as you kind of go through just maybe some revised or maybe the question is, what is some of the revised pricing packaging that you're going through on Cloud Risk Complete? I believe that as well as Threat Complete have been packages that have been around for a little bit of time now. It sounds like something changed, and that created a little bit of miscommunication or friction. Can you just dig into what that change was?
Corey Thomas (Chairman and CEO)
Yeah. There's two dynamics. One is we attempted to do integrated risk across the environment. Cloud is just priced very differently than the traditional environment. You have one price on assets, one price on resources. The multiple of cloud and the price of cloud is astronomically high versus traditional asset. And typically, they're in different silos. Our goal is to actually rationalize that and make sure it's affordable and just look at how you actually simplify getting visibility across the environment. If you look at what we actually did with Threat Complete, part of the success of that and part of the success of IDR overall was simplifying how you actually did detection response across your environment.
Instead of charging for storage, we just said, "Listen, we'll look at all the assets across the environment and charge per asset." Similarly, on the risk complete side, we're actually rationalizing and simplifying the model, making sure the price is affordable. And asking the question, just like we did on the Threat Complete side, is, "How is it affordable for every organization to be able to monitor risk across the environment?" Now, while that is a change, I think it's one that will benefit our customers. I will say, Saket, that we probably could have actually communicated sooner and more effectively about how we were actually executing that change so that we actually didn't freeze ourselves in the process. And thank you for the question.
Saket Kalia (Managing Director)
Got it. Very helpful. Thanks.
Operator (participant)
Your next question comes from the line of Matthew Hedberg with RBC Capital Markets. Please go ahead.
Mike Richards (AVP of Equity Research)
Hey, guys. This is Mike Richards on for Matt Hedberg. I was just wondering, with the sort of guideline in the top line but keeping the profitability for the year, I was just wondering how your investment philosophy has changed from 90 days ago and sort of where investments might change moving forward for the rest of the year.
Corey Thomas (Chairman and CEO)
Yeah. That's a very fair question. So one, we had a fair amount of flexibility that was actually built into our overall model. Where we're leaning heavy is that we're focused heavily on making sure that we're building our product and our technology for the long term. We actually think that the strategy that we actually have about making security operations, detection response, managing the attack surface both affordable and effective is where we actually want to actually put our focus. We are keeping our other investments, frankly, quite tight, but we're delivering superior products and superior service to our customers. And that's where we're putting most of our investments. And that strategy, we think, allows us to be set up well to actually not just sort of show improvement exiting the year but also set up well for sustained long-term growth as we go forward.
It is a strategy that is actually focused on the long term while we take some short-term pain, but we think it's the right one that actually does both the best for shareholders but also for customers over the sustained period. Next question.
Operator (participant)
Your next question comes from the line of Gray Powell with BTIG. Please go ahead.
Gray Powell (Managing Director)
Okay. Great. Thank you for taking the question. And I apologize for some background noise here. I'm just traveling today. So yeah, I want to make sure that I have the slope for net new ARR correct for the rest of the year. I think you said that for Q2, you expect a high-single-digit improvement. First of all, is that correct? And then does that mean you get up to adding $20 million+ per quarter in the second half of the year? And can you just sort of talk about the confidence in that ramp and what underpins it? Thank you.
Corey Thomas (Chairman and CEO)
Yeah. Maybe Tim and I will tag him. I'll just provide some broad context. So what the team did is we just kept what the trends that we actually saw in the early part of the year consistent. So we expect continued growth overall in the detection response space, which is still growing well over 20%. And so we feel very comfortable about that. But we did actually sort of moderate our expectations on the impact of the results that we see this year with the transition as we're actually executing. We're launching in summer. We're rolling it out. And so we want to be very modest in the expectations there. The thing, at least from my perspective, I'd remind you of. I think Tim will talk too, and he gave the expectations for Q2. I think Q3 tends to be very modest.
I think you just didn't see a bigger Q4 just in the fiscal calendar of our business. But Tim, you have additional detail.
Tim Adams (VP and CFO)
Yeah. No, Corey, that's right. Great. Thanks for the question. We did say on the prepared remarks, high single digits in millions of ARR dollars in Q2. So if I just try to simplify that and go to the midpoint of what that would be, it's in the neighborhood of $7.5 million. To Corey's point, we do expect to see a sequential increase in Q3 and then another step up in net new sequential increase in Q4. And that'll get you to the midpoint of the updated guide. But to Corey's point, we really tried to focus on what is working well. The D&R business, growing north of 20%, is still a very healthy business for us. And that's what we tried to anchor on in the updated plan.
Gray Powell (Managing Director)
Got it. Okay. And then just a quick follow-up.
Corey Thomas (Chairman and CEO)
Sure.
Gray Powell (Managing Director)
What percentage of Cloud Complete? I'm sorry. What percentage of the complete bundles has been Threat Complete versus Cloud Complete? I thought the cloud side was just a much smaller contributor to incremental growth in the past.
Corey Thomas (Chairman and CEO)
Yeah. So one, while it was smaller, that's mostly because Threat Complete was fairly large. And so we actually did see pretty substantial positive growth last year there. So Threat Complete was dominant, but Cloud Complete was healthy, and it actually saw pretty substantial growth last year. That said, we actually thought that we needed to do some things to actually make it even more attractive to, frankly, customers that were on the sidelines in that mainstream enterprise. And so that's the actions that we actually undertook this year.
Gray Powell (Managing Director)
Okay. Got it. Thank you very much.
Corey Thomas (Chairman and CEO)
Thanks.
Tim Adams (VP and CFO)
Thank you.
Operator (participant)
Your next question comes from the line of Hamza Fodderwala with Morgan Stanley. Please go ahead.
Oscar Saavedra (Equity Research Associate)
Hi. You've got Oscar Saavedra for Hamza. Thank you for taking my question. I want to dig into what's embedded sort of in guidance. So last quarter, you indicated that for guidance, it doesn't assume an improving macro environment and no material contributions from those investments you've been making on the partner ecosystem. But given the performance in Q1 and the lowering of the guidance, to what extent are you seeing maybe to what extent is a worsening spending environment affecting your ability to land new customers versus the shift in sales motions that you mentioned? And maybe a follow-up later.
Corey Thomas (Chairman and CEO)
It's a fair question. I don't presume that there's any material change in the environment versus last year. That said, it's not any better either. You still see long sales cycles. You still see high deal inspection. And so that's not a change versus last year. We're still seeing continued momentum on the detection response side of the house, which is an indicator. And so we're attributing this mostly to actually how we, as quickly as possible, better soundly sort of ensure that we get the updated pricing, packaging, and customer experience to market and not a fundamental shift in the overall environment. There's been noise in the cloud environment for a while, but we factored that in. That was part of our assumptions coming into the year about how we were going to do pricing and packaging. So that expectation, I don't think, is off at all.
I do think that we probably misestimated that once we decide to pursue this is the slowdown that would occur leading into that change.
Oscar Saavedra (Equity Research Associate)
Got it. And maybe as a follow-up, as we think about the ARR guidance, over the past four quarters, sort of the split between land and expand as display and growth, expand has relatively been stable at 7%, and land has been decreasing. The guidance is 6%-7% year-over-year growth. So is that assuming that land sort of drops zero or maybe expand drops a little bit and land still contributes? What's sort of the percentage?
Corey Thomas (Chairman and CEO)
Yeah. That's a good question. So the easiest way to look at it is to think about the impact from a product line perspective. We think detection response will continue. That has, I would just say, a reasonable mix of land and expand associated with it. I would just say the cloud probably has a bit more of expansion bias, which puts a little bit more pressure on the expansion. And that goes to Fatima's question early on. And so that puts a little bit more pressure in the near term. We actually think from a pipeline perspective that that'll be quite fine and healthy from a pipeline perspective. We are being, I would just say, cautious about sort of the expectations about deal time.
And so if you think about sort of deal sort of cycles elongated, if we're actually launching that in summer, we have some modest expectations of impact this year, but we didn't want to be out over our skis in terms of the impact in year of something that we're actually introducing in summer and that we're training and equipping our sales team around.
Oscar Saavedra (Equity Research Associate)
Got it. Thank you very much.
Corey Thomas (Chairman and CEO)
Thanks.
Operator (participant)
Your next question comes from the line of Mark Cash with Raymond James. Please go ahead.
Mark Cash (Associate Analyst)
Yeah. Thanks. This is Mark going for Adam. So Corey, if I can start with you, these accounts that are taking longer to move to the platform, I mean, how would you characterize the delays? Is this a budgetary concern on their end, or are they waiting to see the product features you're talking about coming out in the summer, or is there a competitive and pricing dynamic going on? And then have a follow-up, please.
Corey Thomas (Chairman and CEO)
Well, that's a good one. So one, keep in mind, we're selling into a fragmented market. So I think our biggest obstacle overall, keep in mind, is the do-nothing obstacle. When we talk about the mainstream enterprise, you're talking about that Russell 3000 mix. You're talking about that midsize enterprise, of which cloud security is still pretty pricey around sort of that overall thing. And so one, I would just say that the need from the security teams is still quite high. But in order to get funding, they got to make sure that they can actually meet all of their needs. That's all we think of providing an affordable enterprise-wide solution is going to be attractive to that audience because I think they're priced out of the market somewhat today. So we view ourselves as unlocking the market overall there.
I think the second part of your question that you actually got to is sort of like, is the driver? So I think that's one part about the value proposition and the simplicity and the ability to not just do a part but the overall environment, is that clear? Our goal of our packaging is actually to make that clear, simple, and compelling. The second part of the question is sort of like, what drives the slowdown? Just as much, I think that's driven by the fact of how we actually focus and incentivize and align our sales team. I think that they are ramping in the back half of the year on the new solution. We had an initiative early last year and mid last year where we were focused on the CRC.
I would say that we probably focused a little bit more heavier on the detection response leading into this year, knowing that we were actually going to be updating the integrated risk strategy in CRC. And we probably should have planned a little bit better about the timing of that transition.
Mark Cash (Associate Analyst)
Okay. Thank you so much. Tim, if I could ask you, so coming into the fiscal year, you expected monetary cash flow contribution in Q1 and then to have a notable ramp in Q2. So I was just kind of wondering what kind of free cash flow cadence is now expected now that, kind of nitpicky here, but the guidance for free cash flow has been adjusted to be about $160 million from previous saying at least $160 million.
Tim Adams (VP and CFO)
Yeah. So Mark, it's a good question. We were very pleased with the strength of free cash flow in Q1. And that was really fueled by what I said earlier on the call, the strong collections in the quarter. We feel very confident in at least $160 million of free cash flow for the full year. Similar to what we saw last year, we expect Q4 also to be a very strong quarter for free cash flow, again, driven by the collections. So what you'll see in Q2 and Q3 is just a modest step up sequentially over the previous quarter, starting with $28 million in Q1. But again, strong collections in Q1 and Q4 really driving those two quarters.
Mark Cash (Associate Analyst)
Great. Thank you so much.
Tim Adams (VP and CFO)
Thank you.
Corey Thomas (Chairman and CEO)
Thank you.
Operator (participant)
Your next question comes from the line of Shrenik Kothari with Baird. Please go ahead.
Zach Schneider (Equity Research Analyst)
Hey. This is Zach Schneider on for Shrenik. Thanks for taking the question. It appears that a transition away from standalone VM and your overall strategic pivot has brought you into closer competition with some larger players like Microsoft and Palo Alto. Could you just elaborate a little more on how Rapid stacks up against them and sort of the success and strategy going forward for your market penetration efforts?
Corey Thomas (Chairman and CEO)
Yeah. I think you were talking about specifically on the integrated risk side of the equation. So yeah, I do think we have more exposure, probably more to the Palo Alto if you just look at it from a cloud security perspective overall. If you look last year, we saw healthy growth in the business, as I actually talked about earlier. We did not think again, what we were looking at is lots of our customer base does not have. It's not a competitive dynamic, is that they don't have any material cloud security adoption, which is the primary thing that we're looking at about how do we drive adoption. We know they're adopting cloud. We know that they need it. We know that they're actually not using the native cloud technologies from a security perspective because of the complexity around that.
And so our primary focus overall is how do we actually sort of deliver a mainstream enterprise solution? Again, this is very similar to what we did in the detection response space and take something that was SIEM that was just at the high end of the market and make it mainstream, accessible, but with the level of sophistication, with the ease of use that everyone could use. And so that's our number one sort of focus areas, how do we actually unlock that market? The second thing is when you look at the differentiation that we actually have, our view overall is that we want to provide the best experience of looking at risk end-to-end, endpoint to the traditional on-prem environment, to the cloud environment, and have that be integrated across the entire environment and not three or four different sets of technologies and experiences overall.
Thanks for the question.
Zach Schneider (Equity Research Analyst)
Great. Thank you very much.
Operator (participant)
Your next question comes from the line of Patrick Colville with Scotiabank. Please go ahead.
Patrick Colville (Director and Equity Research Analyst)
Hey. Thank you so much. Great to be on the call and also fantastic to be part of the Rapid7 story. I want to ask about, I guess, the balance between top-line growth and profitability. I mean, this quarter, non-GAAP operating margins were 19.5%, which is really impressive. But ARR was a bit soft and guidance was trimmed. So how should we think about the kind of balance between top-line and the bottom line in light of the headcount reductions we had in 2023?
Corey Thomas (Chairman and CEO)
Yeah. So I think, look, you have to actually figure out where you're going to focus your resources. We thought that the moves that we made in 2023 set us up well this year to make sure that we had a healthy amount of free cash flow. Then the second question is just like, okay, where do you invest? And we decided not to actually just split it equally. We decided to make a very focused investment in how do we actually make sure our products and services are actually ready for the next five years, not backwards looking. Now, that clearly has some implications in the short term. But we believe that setting ourselves up to make sure that we're investing in our product, in our technologies, in our teams, around services is the path for what I would consider long-term healthy growth.
Overall, we think that we've gotten our profit margins to a healthy state. Our expectation is that we're focused on not how we grow in the moment, but how do we actually have healthy growth and, frankly, accelerated growth from today's levels over the next several years. We think the best strategy to actually do that is actually focus on making sure that our product strategy, capabilities, and pricing are set up for the mid to long term. That was the focus of the decision that we made. Now, I would just say, being that close and focusing on the R&D and the services and the customer experience around service and not putting all of our money in sales and marketing has some short-term implications.
But we actually think that overall, we can actually add back sales and marketing spend as we actually go forward, build off of a much stronger base of technology, a platform and pricing strategy that's actually compelling to customers, and an overall service experience that delivers high-quality service. But that's how we did our investment.
Patrick Colville (Director and Equity Research Analyst)
Great. Okay. Okay. I guess I want to just ask in my follow-up about net new ARR for the year. I mean, the commentary you gave in the prepared remarks around the linearity of net new ARR was extremely helpful. So thank you for that. What it implies is that this quarter is the kind of the trough, and then we have a decent net new ARR recovery through the year. Can we just circle back, just so I've fully understood, just the confidence you have in that kind of recovery in net new ARR through the year?
Corey Thomas (Chairman and CEO)
Yeah. I would just say, if you look at our guys, I think we have pretty strong confidence in it. I think that we didn't get out over our skis. The year tends to be a little bit back-loaded. We have seen some of the pipeline and some of the deals get larger overall. But our assumptions are that we see only modest benefit from sort of our reorientation and our updated launch of Cloud Risk Complete this year. So we didn't want to be too aggressive on the timeline of something that was going to be introduced in the summer. So I think that our expectations were quite modest there. And so I would just say that if you look at what we've actually laid out, we have pretty high confidence that we can actually execute against that plan.
What we really took out, we really sort of based it off of the dynamics that we were seeing in sort of the first half of the year and then had very modest assumptions about improvements in the back half of the year. There are some, but I would just say they're relatively modest in orientation.
Tim Adams (VP and CFO)
Yeah. Patrick, it's Tim. Welcome to the Rapid7 coverage team. As you'll see, if you go back to prior-year Q4s, that is always the strong quarter from a seasonal perspective on the net new add. We expect that again this year, similar to other quarters.
Corey Thomas (Chairman and CEO)
But it builds up. I would just say from a net new add. It steps up a little bit. Modest Q2, modest Q3, and then again Q4.
Patrick Colville (Director and Equity Research Analyst)
All right. Thank you so much. Really appreciate it.
Corey Thomas (Chairman and CEO)
Thank you.
Operator (participant)
Your next question comes from the line of Josh Tilton with Wolfe Research. Please go ahead.
Patrick O'Neill (Equity Research Associate)
Hey. This is Patrick on for Josh. You had mentioned the churn customers in the quarter, and for the most part, they weren't platform customers. Just curious if you could expand more on sort of the broader reasonings for why they churned and how we should think about that going forward, and then maybe how much of an overall impact on expansion opportunities within the base that you foresee have that looking ahead. Thanks.
Corey Thomas (Chairman and CEO)
Yeah. I would say the thing that we probably did not do a great job of in Q1 was actually driving expansion in our install base. And that's mostly based on we were still working through pricing and packaging and did not want to get too far ahead of ourselves. So if you think about net expansion rate, the expansion was definitely not as strong in the start of the year as we expected to be exiting the year. So the clear expectation is that we will actually have clarity coming out of the summer on what the pricing packaging is, the ability to actually sell that into our install base and drive expansion overall.
So when you think about net retention rates, I would say, yes, we had significant pressure in the first half of this year on the expansion, mostly because we're reworking a lot of things, and we want to make sure that they're right before we go in and sign those. But we could have executed that better. But we do expect that to be a fairly temporary thing and that actually normalizes as we actually exit the year, if not actually have some momentum as we go into next year.
Patrick O'Neill (Equity Research Associate)
Appreciate it.
Corey Thomas (Chairman and CEO)
Thank you very much.
Operator (participant)
Your next question comes from the line of Eric Heath with KeyBanc Capital Markets. Please go ahead.
Ritu Kashyap (Senior Equity Research Associate)
Hi. This is Ritu on for Eric. I was wondering, what are pricing dynamics that you're seeing in the market right now and from some of your peers? And how does that play into the pricing strategy that you laid out in your prepared remarks?
Corey Thomas (Chairman and CEO)
It's a good question. So I think so I'll keep the detection response pricing has not materially changed. I think we were probably one of the largest changes when we changed from pricing and from storage to an asset resource basis. So I don't think there's any material change in that. If you look at part of the thing that we struggled a little bit with is that if you think about the risk market and you want to integrate it, the pricing in cloud is very different than the pricing in the on-prem environment. And then the value proposition of the visibility on the endpoints is different. And so if you really want to simplify for customers, you have to rationalize both the pricing models and also the pricing levels.
You have cloud that is volatilely priced by the providers and, in general, quite expensive and keeps a lot of customers out. You have vulnerability management, which is effective, but people are mix-shifting to the cloud. Then you have endpoint where you have lots of visibility sources that you actually have to reconcile. Our goal specifically on pricing is how do we actually rationalize and take out the complexity, so make it as simple as possible for customers to actually price across the environment? Our goal, because we actually have detection response, is to be a price leader. We actually want it to be we want customers to have full visibility into their environment.
Because full visibility into their environment, we think that we can actually do a good job, and we're fueled to do a good job of that by then monetizing and selling customers the value of detection response. So in many ways, we think sort of cost-affordable price leadership and integrated risk management is a great platform and a long-term good upsell for detection response. So we want to be pushing the boundaries there of how to get customers the best possible visibility at the best possible value. And then we can continue the success that we've seen in detection response.
Ritu Kashyap (Senior Equity Research Associate)
Got it. Thank you.
Corey Thomas (Chairman and CEO)
Thank you.
Operator (participant)
Your next question comes from the line of Rob Galvin with Stifel. Please go ahead.
Rob Galvin (Associate Equity Research Analyst)
Hi. Thanks for taking the question. These past two quarters, the gap between international and North America growth has widened, and international growth remained pretty stable versus the year-ago period while North America growth compressed by about 600 basis points. In the morning, if you could provide any commentary into what might be driving that difference in growth rates recently? Thanks.
Corey Thomas (Chairman and CEO)
Yeah. No, it's a good question. I don't think it's going to actually be something that's going to sustain. I agree it's happened over the period. Keep in mind is that I think it was in 2022, we saw lots of pressure in Europe. So you had sort of deceleration there. So you had a widening gap there. I think that normalized coming out of last year. And so you do have some fluctuations in the baseline that you're actually looking at depending on what period of time you're looking at. Our general expectation is that ignoring currency rates, that we'll see fairly sort of consistent growth around the world. And so we think that those are short-term differences, not long-term expectations of differences overall.
Rob Galvin (Associate Equity Research Analyst)
Thanks.
Corey Thomas (Chairman and CEO)
Thank you.
Operator (participant)
I will now turn the call back over to Corey Thomas for closing remarks. Please go ahead.
Corey Thomas (Chairman and CEO)
Well, thank you very much. I appreciate everyone taking time, especially on an incredibly busy week. We look forward to talking to you and, more importantly, updating you on the next earnings call. Thank you.
Tim Adams (VP and CFO)
Thanks.
Operator (participant)
Ladies and gentlemen, that concludes today's call. Thank you all for joining, and you may now disconnect.