Rapid7 - Q2 2023

Transcript

Operator (participant)

Thank you for standing by. My name is Jessica, and I will be your conference operator today. At this time, I would like to welcome everyone to the Rapid7 Second Quarter Earnings Call. All lines have been placed on mute to prevent any background noise. After the speakers' remarks, there will be a question and answer session. If you would like to ask a question during this time, simply press Star followed by the number 1 on your telephone keypad. If you would like to withdraw your question, press Star 1 again. Thank you.

I would now like to turn the call over to Sunil Shah, VP of Investor Relations. Please go ahead.

Sunil Shah (VP of Investor Relations)

Thank you, operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's second quarter 2023 financial and operating results, in addition to our financial outlook for the third quarter and full fiscal year 2023. With me on the call today are Corey Thomas, our CEO, and Tim Adams, our CFO. We have distributed our earnings press release over the wire, and it is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast, and following the call, an audio replay will be available at investors.rapid7.com.

During this call, we may make statements related to our business that are considered forward-looking under federal securities laws. These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to the company's positioning, strategy, business plans, restructuring plan, financial guidance for the third quarter and full year 2023, financial goals for full year 2024, and the assumptions underlying such goals and guidance. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the future results expressed or implied in these statements due to a number of risks and uncertainties, including those contained in our most recent quarterly report on Form 10-Q, filed on May 10th, 2023, and in the subsequent reports that we file with the SEC. The information provided on this conference call should be considered in light of such risks.

Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements. Reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by applicable law. Our commentary today will primarily be in non-GAAP terms. Reconciliations between our historical GAAP and non-GAAP results can be found in today's earnings press release and on our website at investors.rapid7.com. At times, in our prepared remarks from a response to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be one time in nature, and we may or may not update these metrics in the future.

With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey?

Corey Thomas (CEO)

Thank you, Sunil. Welcome to everyone joining us on today's second quarter 2023 earnings call. I would like to start by acknowledging the plan we announced today to restructure and optimize our organization by reducing Rapid7's employee base by roughly 18%. While it was an extremely difficult decision, we believe this step is critical to build on the momentum we're seeing in security operations and to position us to be a more profitable growth company in 2024 and beyond. I will discuss more details about the strategic rationale behind this decision and the associated financial impacts later on today's call. Let's start with our second quarter results.

I'm pleased to report that Rapid7 ended the second quarter with $751 million in ARR, growing 14% over the prior year, and delivered revenue and operating income above our guidance ranges, alongside better than expected free cash flow. During the second quarter, we continued to see strong and improving traction with our consolidation offerings. Customers are gravitating towards our holistic security operations stack, particularly Threat Complete, which unifies risk and threat management into a single integrated offering. The performance of our packages once again exceeded our expectations, as over one third of new ARR in the second quarter was driven by either a Threat or Cloud Risk Complete deal as customers look to increase the effectiveness and efficiency of their security programs by consolidating their vendor footprint.

A great example of this consolidation was a six-figure ARR deal in the second quarter with an existing InsightVM customer that was looking to replace a legacy SIEM Solution managed by an MSSP. Building on our established VM relationship, Rapid7 was uniquely able to provide the customer a comprehensive security solution, and our best-in-class technology, coupled with the expertise of our SOC analysts, was amplified by the value proposition from our Managed Threat Complete offering. We competed against many large players in the extended detection and response space, and the customer chose Rapid7 based on the strength of our automation capabilities, our security and incident response expertise, and our predictable pricing model. This customer is indicative of the current environment, where customers are upgrading and consolidating providers while looking for better quality services and experiences.

Customer spending dynamics in the second quarter were broadly in line with our expectations, with ongoing macro sensitivity influencing customer budgets. We've optimized our sales efforts around this new normal by leaning into customers' needs for more cohesive, efficient solutions that are aligned with their resource constraints. Our strategic focus around SecOps consolidation continues to gain momentum, and we are driving focused innovation across our core products and capabilities to accelerate customer value. We are particularly focused on integrating a frictionless cloud security experience into risk management programs for mainstream buyers. A great proof point is our recently introduced Executive Risk View, a new capability that gives security practitioners unified visibility to risk across all combinations of on-premises, cloud, and hybrid environments. Executive Risk View's ability to holistically assess risk and track security program effectiveness is a complete differentiator for us across VM and cloud security.

It's also an example of our unique ability to add value for customers by leveraging the breadth of our Insight Platform. Our expertise in helping customers secure their cloud and hybrid environment is illustrated by a six-figure competitive win in the second quarter with an enterprise manufacturing company. As an existing customer, they had built out a strong risk management program for their traditional environment with Rapid7's vulnerability management and AppSec solutions. Despite a flat budget this year, the CISO security teams needed to extend risk visibility and management into their growing cloud footprint. After an extensive POC, Rapid7's cloud security capabilities set us apart from other well-known players for multiple reasons: our ability to provide unified visibility to risk across the full environment, the integration and ease of use of our platform, and our ability to offer extensive automation, including automated remediation.

Ultimately, these product differentiators, combined with the budget predictability and value proposition from our Cloud Risk Complete offering, led the customer to consolidate this part of their SecOps stack on the Rapid7 Insight Platform. Turning now to our strategic areas of focus as we enter the second half of 2023 and look forward. We remain anchored on our core customer mission: to make the best security operations technologies accessible to all. Let me share with you how we're optimizing to execute against this mission through our focus on the modern SOC. With the industry undergoing a customer-driven shift to consolidated security platforms, the early success around our integrated SecOps strategy is evident as our consolidation offerings track ahead of expectations. Looking ahead, we see an evolving set of critical customer dynamics in this space.

First, we have noticed a customer shift from cloud security as a specialized function to cloud security as an integrated capability within security and SecOps teams. We view this as a massive demand driver for integrated SecOps, and think that we have a significant opportunity to be the leader in delivering integrated risk and threat management across on-prem, cloud, and external attack surfaces. Second, as the threat landscape continues to grow in complexity, customers are showing more demand than ever for integrated expertise to support them in effectively managing their security technologies. The convergence of these key trends, security consolidation, integrated cloud security, and expertise-driven outcomes, are the foundation of what we view as the new modern SOC.

Rapid7's focus is to be the leading provider of integrated security solutions for the modern SOC by providing risk and threat management within the context of overall security, delivered as a service alongside expertise tailored to the needs of each customer. Let me walk you through three distinct opportunities for Rapid7 to support the modern SOC, and why we believe that we are optimally positioned to win. One, customers continue to upgrade from legacy log-centric detection to cloud-native detection and response programs. With over $300 million of our ARR in detection and response, with growth at over 25%, it is clear that customer demand is strong, and we have established both the scale and product leadership to win this opportunity. Two, customers can no longer treat their risk and threat functions as distinct. The modern SOC manages threats as a function of risk and vice versa.

With our integrated best-of-breed capabilities across risk management and threat detection in both cloud and traditional environments, we are uniquely positioned to deliver this integrated experience to mainstream buyers. Three, customers are increasingly reliant upon both greater levels of automation and integrated expertise alongside their technology. Having built best-in-class service augmentation with our global SOC presence, we see massive potential to drive high-margin managed services, both through existing offerings and investing in accelerating our strategic managed service partnerships. With that context, let's talk about the strategic decision we announced today to restructure our organization and reorient our cost structure, and how that positions us to better execute against our strategy. We recently completed a deep analysis of our cost structure through the lens of accelerating our investments to deliver the most comprehensive modern SOC offering for our customers.

Earlier today, we announced plans to reduce our global workforce by approximately 18% and to consolidate our global facility footprint. There are two clear outcomes from this reorientation. First, it is clear that we have an opportunity to run leaner as a business. About half of our planned changes are efficiency-related cuts that we expect to flow directly to the bottom line. These include streamlining management layers, reduction of role overlap, and optimizing our own and offshore talent mix. Second, we have a compelling opportunity to strategically reallocate investment to key areas that we believe will drive the most long-term value for customers. With a vast amount of our product expansion now behind us, we can reallocate and accelerate investment in capabilities and services that customers are purchasing around the modern SOC, including our managed service partnerships.

We expect these changes will meaningfully optimize our cost structure while enhancing future product capabilities and delivering a higher quality customer experience. Ultimately, these changes position us to drive strong and more profitable growth over time by aligning our investments with our customers' long-term SecOps needs, while at the same time establishing a strong free cash flow support for our business. Tim will guide you through more specific financial details later on the call. At a high level, net of the investments we're making in strategic focus areas, we expect these measures to substantially expand our profitability profile while driving significant progress towards our midterm Rule of 40 objective. Looking ahead to 2024, we believe these actions position us to deliver at least $160 million in free cash flow in 2024, doubling from our current 2023 guidance of $80 million.

Given the investment leverage in our business, we have confidence in our ability to scale free cash flow in 2024. While it's premature to set any revenue or ARR growth targets for 2024, this free cash flow expectation does not assume improvement in the macroeconomic environment, we're confident we can execute to this target even if our top-line growth were to be sustained at this year's levels. Shifting our focus back to 2023, I am pleased with the progress our team has made during the first half of 2023, laying the groundwork for us to drive ongoing customer impact with our integrated SecOps strategy, including executing to our first half growth targets. Looking to the back half of 2023, we continue to see line of sight to our original full-year ARR guidance range.

With that said, we believe it is prudent to establish a high confidence expectation range that accounts for a modest degree of disruption over the next three to six months as we implement the strategic realignment. As a result, we're reducing our full-year ARR guidance by approximately 2% at the midpoint to account for potential disruption. This is coupled with a significant ramp in our operating margin expectations, which we will now expect to improve by approximately 700 basis points over the prior year. Tim will share more specifics on this in his comments. In summary, we continue to focus on the highest value, most impactful areas of our business on behalf of customers.

While the changes we announced today are difficult, we have a compelling opportunity to position ourselves to deliver stronger, more profitable growth. We remain committed as ever to our enduring goals: help customers securely transition to the cloud, expand the capabilities and value of our Insight Platform, and balance strategic investments in durable growth with expanding profitability. Thank you all for joining us today.

I will now turn the call over to our CFO, Tim Adams, to share additional detail on our financial results and outlook. Tim?

Tim Adams (CFO)

Thank you, Corey, and good afternoon to everyone on today's call. Thank you for joining us. Before I turn to the results, a quick reminder that except for revenue, all financial results we will discuss today are non-GAAP financial measures, unless otherwise stated. Additionally, reconciliations between our GAAP and non-GAAP results can be found in our earnings press release. Rapid7 ended second quarter of 2023 with $751 million in ARR, consistent with our expectations and growing 14% over the prior year, reflecting continued demand for our Insight Platform, with the strongest growth contribution coming from the high-priority areas of detection and response and cloud security.

We continue to see Threat and Cloud Risk Complete offerings tracking ahead of our expectations at over 1/3 of new ARR in the second quarter, with the benefit coming from both landing new customers and driving upgrades and expansion within our base. We also saw balanced contributions from new and existing customers in our overall business during the quarter, with ARR per customer that grew 7% year-over-year to $66,500, as existing customers leveraged more capabilities on our platform. We saw a nice improvement in total net customer adds, ending the second quarter with nearly 11,300 customers, representing growth of 6% year-over-year. Second quarter revenue of $190 million grew 14% over the prior year and exceeded the high end of our guidance range.

Product revenue grew 14% year-over-year to $182 million and was better than expected on favorable linearity in the quarter. International revenue grew 17% over the prior year and represented 21% of total revenue, while North America revenue grew 13% year-over-year. Turning to our operating and profitability measures for the quarter. Product gross margin was 76% in the second quarter, and overall gross margin was 74%, both in line with our expectations. Sales and marketing expenses represented 39% of revenue in the quarter, down from 41% in the prior year. R&D expenses were 21% of revenue, unchanged from the prior year, and G&A expenses were 7% of revenue, compared to 8% in the prior year.

Higher revenue, combined with slower hiring in the quarter, drove stronger than anticipated operating income of $13 million in the second quarter. Our adjusted EBITDA was $19 million in the quarter, and diluted net income per share was $0.18, better than our guided range on higher operating income. There are two additional items from the second quarter I want to mention that are non-cash and do not affect our non-GAAP results. First, our GAAP net income reflects a $13 million non-cash charge related to a capped call transaction from our 2023 convertible bonds. These bonds were retired as part of a refinancing nearly two years ago, but the associated capped calls require us to record a mark-to-market adjustment at the end of the second quarter. This capped call transaction was settled in early August, resulting in a cash receipt of slightly over $17 million.

Second, as part of the restructuring plan, we will be consolidating our global real estate footprint. As a result, we incurred a non-cash charge of $27 million in the second quarter related to real estate assets that we determine are not necessary to support our strategic growth objectives. Moving to the balance sheet and cash flow statement. We ended the second quarter with cash, cash equivalents, and investments of $296 million. This is before the $17 million we collected in August related to the capped call transaction on our 2023 convertible bonds. Operating cash flow was $31 million, and we generated $26 million of free cash flow in the second quarter, driven by stronger profitability and more favorable collection trends.

Now, turning to our outlook for the remainder of the year. The restructuring plan we announced today is a focused effort to align our organization and our investments around the areas of business that are driving the most value for our customers. This was not a decision we made lightly, and we believe these actions will enable stronger and more profitable growth as we invest to meet customer demand for consolidated SecOps solutions. We expect to incur charges of approximately $24 million-$32 million related to the restructuring plan throughout the third and fourth quarters of 2023, of which the majority are expected to be cash expenditures and weighted towards the third quarter. We also expect to incur $3 million-$4 million in non-cash impairment charges from the consolidation of our real estate footprint throughout the second half of 2023.

These restructuring charges will be excluded from our non-GAAP operating income and non-GAAP net income results, though the cash expenditures will be reflected in our operating cash flow and free cash flow. As such, the cash benefit of reduced headcount will be offset by the associated severance-related cash charges. As a result, we are maintaining our expectation of approximately $80 million in free cash flow for the full year. As Corey mentioned, we are updating our full year ARR outlook range to $800 million-$805 million, or approximately 12%-13% in growth over the prior year. This is roughly a 2% reduction in year-over-year growth at the midpoint, which despite healthy year-to-date momentum in our business, we believe is appropriate to account for modest disruption risk in the business as we make these important strategic changes.

We are adjusting our total revenue guidance for the full year to $771 million-$775 million, or roughly 13% growth. The $3 million reduction at the midpoint is wholly driven by lower professional services revenue, tied specifically to our restructuring cost actions, which we now expect should be approximately flat compared to last year. We are raising our full year operating income guidance to a range of $86 million-$90 million, which represents approximately 700 basis points of operating margin expansion over the prior year. We expect full year net income per share to be in the range of $1.23-$1.29, based on an estimated 67.5 million diluted weighted average shares outstanding.

Turning to quarterly guidance. For the third quarter of 2023, we expect revenue in the range of $196 million-$198 million, which represents growth of roughly 12% year-over-year. We expect operating income for the third quarter in the range of $29 million-$31 million, and non-GAAP net income per share of $0.41-$0.44, which is based on 71.7 million diluted weighted average shares outstanding. As we look out at next year, we expect to generate at least $160 million in free cash flow in 2024, doubling from our current 2023 guidance of $80 million. We feel good about our results year-to-date and about our ability to pursue the strategic opportunities ahead of us as a leaner, more agile company.

Thank you for taking the time to join us on the call today. With that, we will now open the call for questions. Operator?

Operator (participant)

At this time, I would like to remind everyone in order to ask a question, press star, then 1 on your telephone keypad. We'll pause for just a moment to compile the Q&A roster. Please note we will limit each caller to 1 question. If you would like to ask an additional question, please press star 1 again to rejoin the queue. Our first question comes from the line of Matt Hedberg with RBC. Matt, go ahead.

Matt Hedberg (Software Research Analyst)

Great. Great, guys. Thanks for taking my question. Just one. Let's see. You know, I just wanted to maybe get a better perspective on the full year guide. I mean, obviously, the, the Q2 results were good. I just want to be clear, is the full year reduction just a function of the restructuring, or is it that you're seeing macro trends you're, you're assuming macro trends deteriorate? Just maybe a little finer point on sort of the assumptions on the 2% reduction would, would be super helpful. Thank you.

Corey Thomas (CEO)

No, a very reasonable question, Matt. The first thing is that we were really focused on looking at our cost structure both this year, but more importantly, as we went into 2024. We decided that if we were gonna have the right cost structure going into 2024, this was the right time to actually make these changes. A secondary impact is we have to really assess is what's the risk of these changes in the business? As you know, we had a back-end loaded year. What I would say is, foundationally, we were trending well towards what we had set out. But when we think about the amount of change that we're doing with the 18% reduction, in a back-end loaded year, we want to make sure that we actually gave a guidance range.

That was a very high confidence guidance range. That was the primary driver of the change in the guidance. Thank you.

Operator (participant)

Great, thank you. Your next question comes from the line of Saket Kalia with Barclays. Saket, go ahead.

Saket Kalia (Managing Director)

Okay, great. Hey, guys. Thanks for, for taking my question here. I'll keep it to one as well. Corey, maybe, maybe for you, you know, you talked about, about using this restructuring as, as a way to, to also reallocate resources. I mean, clearly, there's a profitability benefit, but, but also as a way to reallocate resources to the areas where customers are seeing the most value. I was wondering if you could just go one level deeper into that. What product areas do you think are maybe gonna get a little bit of a, you know, increased investment? Where do you think you can get a little bit more profitability? Tell us how you thought about that.

Corey Thomas (CEO)

That's a good question. In fact, one of the things that we actually saw is we were seeing extraordinarily strong, healthy performance conversion rates in certain parts of our business. We saw with the package strategy that we actually laid out, we had to make sure that our entire organization was aligned around that, frankly, it just wasn't. That gave us-- This gives us an opportunity to actually get the alignment right. The areas, specifically, Saket, to your very, good question, is really, I think about three core areas that we're really gonna focus on. One is what we think about as the modern SOC, is customers are looking to upgrade their SOC to drive efficiency. They need both great technology, yes, it's also a consolidation play, they also need expertise on demand.

If you look at the investments that we're making, we're really bringing the modern SOC together, which people have to actually monitor their traditional environments, but they also have to really monitor their cloud environments, and they have to both manage risk and threats. We've seen increase in demand and traction with that strategy. Frankly, their packages are actually going ahead of what we actually laid out, but there's an opportunity to actually build a deeper, more integrated solution and to fully take that to market in a very compelling way. I would say we're seeing some of the benefits of that, but we plan to accelerate the benefits. The second thing, which I actually alluded to in the previous statement, was the accelerating our investment to continuing cloud. Cloud is at its early evolution, its early innings.

The most important thing now is it's actually going from a niche thing where you actually have separate things, and as more customers focus on complex integrated environments, it needs to be a mainstream thing. Our goal is to be a leader in mainstream security operations, where people are able to actually both monitor risk and threats across their traditional environments and their cloud environments, and that to be a seamless experience. We have great traction and great progress, but look, it's a competitive market, we're not resting on our laurels, and we actually are reallocating and refocusing our investment in that area.

Then the last area, I would just say, is more than anything, a realignment focus area, is that as we've actually executed our strategy quite well on broadening our product portfolio, we've just actually had different experiences for different buyers of different products and services, and so we're streamlining and aligning that. That, frankly, is a, both an efficiency benefit, but it's a better customer experience for our customers. So those are the areas of major focus that we have. Thank you for the question, Saket.

Operator (participant)

Thank you. Your next question comes from the line of Eric Heath with KeyBanc Capital Markets. Eric, go ahead.

Eric Heath (Equity Research Analyst)

Hey, great. Thank you. I'll, I'll ask two questions, if I may. just, just first, I mean, Corey, can you help us just give us an understanding on kind of the, the type of growth profile you're setting yourself up for in, in 2024 following this restructuring plan? one follow-up, if I may.

Corey Thomas (CEO)

Yeah, no. I can answer that one pretty quickly. It's way too premature to actually talk about the growth profile of 2024, mostly 'cause I am not at all qualified to talk about what the economy is gonna be like in 2024. We'll update you on that later. I think the important thing to think about when thinking about the growth profile is we knew we wanted to actually strengthen our free cash flow. We wanted to establish a strong foundation there. What we did was really pressure tested the growth profile to make sure that it was gonna be resilient, I mean, the free cash flow, that it would actually hit our free cash flow aspirations and targets in a range of different scenarios. We have a lot of confidence in free cash flow.

What I will tell you, too, is that we're making investments inside of the business, such that as the economy normalizes, whenever that happens, we should actually see growth accelerate from where we expect it to be this year. Again, it's too early to actually talk about what's going to happen in the economy. We're definitely making the investments to actually, yes, get more free cash flow and efficiency, but we plan to be a competitive grower in the market. As the economy normalizes, our absolute focus is making sure that we're actually growing stronger than what we're seeing at this level today.

Eric Heath (Equity Research Analyst)

Great, thanks. Just on your comments about cloud, could you just maybe be a little bit more specific on, on where you'd like to invest in cloud security? Does this mean more kind of aggressively in CNAPP space? Is that how I should think about it? Just if you had any color on kind of how big the cloud security business is at the moment, that'd be great color as well.

Corey Thomas (CEO)

Yeah, so we're seeing traction in cloud. We, we, we didn't release the specific numbers on it. What I would just say as a high level for cloud is we're actually seeing great traction. In fact, the traction has accelerated, which is part of our confidence in investing in it. There's two different areas that I think. We actually have core capabilities and strength in cloud vulnerability management, cloud vulnerability assessment, and CSPM and cloud automation today, and we have a good position in other areas. There's two things I would say is, one, it's a continuing investment in overall cloud security to make sure that we have the leadership position there. And so there's some aspects of CNAPP, absolutely, we'll be investing in. The other one is that cloud is still early stages.

It's not you know, like, how do you think about securing AI in the cloud? It's also a non-static, it's a highly dynamic market, and we also want to make sure we have the investment capacity to make sure that we actually are leaning into the investment. Because with cloud, you actually have to be leaning into the investment to stay relevant. The, the last thing I'd say is that we do see big advantage in the traction that we've seen, is customers are looking to manage cloud in the context of other things that they're doing in their environment. I would say we see a major differentiator in integrated security operations management that includes cloud in the context of the traditional environment, and allows people to manage their overall security footprint cost effectively.

We think that as the market goes mainstream, that's a massive opportunity, and that will be one of our drivers, to your previous question, that actually helps us continue to actually accelerate growth, as the economy normalizes. Thank you.

Operator (participant)

Thank you. Your next question comes from the line of Matt Saltzman with Morgan Stanley. Matt, go ahead.

Matt Saltzman (Research Analyst)

Hey, team. Thanks for taking the question. Corey, just, just to start, a quick one for you. When you think about the competitive landscape for Rapid7, I would assume things have certainly shifted, particularly as you've brought in the product portfolio and really honed in on these, on these bundled, go-to-market motions. I'm curious in the RFP process, if you're seeing a broadening of the vendors that you're competing with, and just kind of any commentary that you can give around win rates. I know it's, it's still relatively early in terms of, you know, the bundles being in the market, but anything you can give us around win rates against kind of new competitors would be really helpful.

Corey Thomas (CEO)

Yeah, no, it's a good one. Look, I think the biggest new where we have the most advance, is gonna be clearly in the modern SOC space. That's the evolution of the SIEM market, but we also have a consolidation play. You will see a range of different competitors. You see the traditional SIEM players, you see some of the MDR players, you have a range of competitors. What I would say is that we're actually having a lot of traction and momentum. That's part of why we're continuing to double down in that business, in that space. The conversion rates are high, the growth rates are good, it's an at-scale business, it's extraordinarily healthy. We're seeing lots of ability to attach around that business.

So part of what we're doing is really oriented around that modern SOC and how we embed cloud in it. That's the first thing. So our win rates are actually consistent and growing and high, and we feel very good. We're actually having, with Managed Threat Complete, I would just say re-record conversion rates in that offering, which is a proxy for win rates, although we haven't publicly disclosed the win rates. The second thing I would just highlight is, you know, there's two ways to think about the cloud space, is Our strategy right now, because this cloud space is both competitive and expensive, is, you know, we knock it out the ballpark if we actually do an effective job of upgrading our vulnerability management install base, which is a substantial base and sticky.

That's the motion that we really got focused on this year, and that's the purpose of CRC. We're doing an extraordinary job right now with a very recent start in actually starting to upgrade that CRC base. It's early. We have that vulnerability management base. We are not going out specifically trying to actually land lots of net new cloud customers, because it's just not the most efficient motion for us right now. We see our early momentum over the next couple of years as really upselling and upgrading our vulnerability management install base to Cloud Risk Complete. You start to see evidence of that, I think as I've talked about on the story. The pipeline ability is there, the conversion rates are there, we're managed to do that, but that's the strategy and focus areas that we actually have there.

Inevitably, I think as you're alluding to, as we continue to actually build on that cloud momentum, we'll absolutely see more cloud competitors, and it's a hyper-competitive market, and we'll tackle that as that comes. To be clear, is that you talk about accelerating growth, we knock it out the ballpark by just upgrading our vulnerability management install base, and that's where we've sort of currently putting the focus.

Operator (participant)

Thank you. Your next question comes from the line of Brad Reback with Stifel. Brad, go ahead.

Brad Reback (Managing Director)

Great. Thanks very much. Corey, 18% is a really large number. So as you manage the business going forward, how do you prevent, I'll call it morale breakage? Then how do we think about how long it'll take to reinvest those savings back into the business? Thanks.

Corey Thomas (CEO)

Oh, Brad, one, you're quite right, 18% is large. Of course, we don't do this lightly. Let me just talk about how we actually thought about this and around. The first thing is that from our employees, the things that we're able to say to our employees today, is while we don't control it, incrementalism is not helpful to anyone. There's lots of companies that have had to do this multiple times, we actually just had a bias about, "Hey, let's go deeper and actually do this once, if we're gonna have to do it." That's the 1 thing that we actually focused on. The second thing is that we definitely, like all companies, had inefficiencies. We start by tackling inefficiencies.

The inefficiencies are absolutely a smaller number, but part of what we actually saw in the momentum is we actually have parts of our business that are actually growing quite healthily, have incredible stickiness, are showing great signs of the expansion and, and anchoring ability, and we did not have all of our team and resources aligned around that for obvious reasons, if you think about the legacy of the business. When you think about you're going to do something like a RIF or restructuring, you can just tackle the efficiencies. You can go shallow, which actually causes more pain to employees over the longer term frame. You could actually go a little bit different in an effort to actually do it once.

We think that's the best for employees, so they actually have some visibility and confidence as we go forward. The thing that gives me the most confidence and the thing that I've heard from most of our employees that they're excited about, is that second part of actually making the hard decision to do some of the realignment, that allows us to focus on the areas that people see the momentum. 'Cause our employees see where we actually have momentum, and us putting a line in the sand and saying, "We will actually be investing behind these opportunities," is a confidence builder for lots of our employees who are actually looking at the opportunity in the market. That's our decision. Make sure that for employees, we actually do this once with everything that we actually know is possible.

Making sure that they are then investing in tackling the big opportunities that we're already getting progress on. That's the type of thing that we think actually motivates and excites the employees that are actually moving forward with us.

Tim Adams (CFO)

Corey, just on the second part of Brad's question about, you know, the timeliness of the reinvestment. We're gonna be very thoughtful and very deliberate in terms of what we do, but Brad, you would expect to see some of that happening in the back half of this year and certainly carrying into next year. Again, we're very confident with that improvement in free cash flow doubling year-over-year to the $160 million that Corey mentioned earlier for next year.

Corey Thomas (CEO)

Thank you for the question.

Operator (participant)

Thank you. Great, thank you so much. Your next question comes from the line of Joel Fishbein with Truist Securities. Joel, go ahead.

Joel Fishbein (Software Equity Research Analyst)

Thanks. Just a quick follow-up on Brad's question and then one about acquisitions. You guys are reaching a point where, you know, you have easier comps going forward, and if you've thought about how this may impact, you know, in terms of go-to-market or talk about any impact to your go-to-market, you know, feet on the street, salespeople, that restructuring might have. I know that's not focused there. Also just as a follow-up to that, how the restructuring or focus on free cash flow might impact your acquisition strategy going forward? Thanks.

Corey Thomas (CEO)

Yeah, no, two very good questions. The first is that we made every effort to make sure that we actually minimize customer impact in the short term, and in the mid-term, we have said it's, it's very positive to actually customer impact. We're actually rotating more people to be frontline, customer-facing, and engaged. You know, a simple way to think about the restructuring is that it's very mild impact on our quota-carrying people, our frontline support people in terms of the number of net people in the organizations that are doing customer-facing stuff. There is a lot of impact in some of the overhead that's built up in lines, the management layers, the efficiency, and so that is an impact.

To your, to your point, I think part of what we actually had to look at is we had a lot of positive-- we have a lot of positive signals. I mean, the momentum in the business is good. We had a good Q2, we built good pipe, we've seen great conversion rates. What we really wanted to balance that with is making sure that we actually take proper care to actually manage the risks that comes from a change of this order of magnitude and size. Part of that is making sure that we're deeply focused on making sure we try to minimize customer, any customer friction that can come along with this, have good communication. Part of this is also why we actually reduced the guidance range, to actually make sure that our team is focused on building a long-term, healthy business.

Again, there's some unknowns in there as you actually go through a change in a relatively tight window. That's the setup that we actually have around that. I think that we're quite set up well to actually manage our customers, engage in the momentum in the short term, but in the mid-term, we actually think it'll be quite successful. Then you had a second question. You remember, Tim?

Tim Adams (CFO)

It was on the M&A side. Free cash flow.

Corey Thomas (CEO)

On the, on the M&A side, I think there's, well, two obvious points, is that, one, generating more free cash flow gives us a more range of flexibilities of options about how to do that. Of course, we'll actually look at what's the best benefit for long-term shareholders. That's gonna be a focus area. It just gives us a lot more flexibility and a lot more options to how we manage the business, which is why I had a really, really big focus with Tim and the rest of our leadership team on establishing a much stronger foundation of free cash flow as we're going forward, because it allows us a lot more options. When we do M&A, I mean, look, I can never say we'd never do anything. We have a significant bias for tech and team things that are strategically aligned and oriented.

That tends to be where we actually like to play and what we actually like to focus on in M&A. I would think about the free cash flow as just giving us a lot more capacity and options about how do we actually generate value in the business. Thank you.

Operator (participant)

Thank you. Your next question comes from the line of Shrenik Kothari with Robert Baird. Shrenik, go ahead.

Shrenik Kothari (Senior Research Analyst)

Hey, thanks for taking my question. Yeah, Corey, it's, it's good to see that your, your Threat and Cloud Risk Complete offerings are tracking ahead of your expectations, and it's hit over one third of your new ARR and overall better than expected, kind of favorable linearity in the quarter. From, from international revenue standpoint, it seems like it again grew quite strongly, about 13%. Can you provide some, you or Tim provide some geographical color around both the favorable linearity as well as the, the overall retention rates, sequentially from, from last quarter? Really appreciate it.

Corey Thomas (CEO)

Yeah, I'll tag team that with Tim. You know, the first thing I would just say is we're seeing. You know, last year was pressured in the international, especially EMEA. Tim talked about retention last year. I would say we've seen a very healthy stabilization and a good place to actually continue growth and health from here. So we feel very good about what's happening in international teams. We feel very good about the execution and leadership, and we think we're set up well as we actually go forward. A lot of that is just it's improvements over last year, which we had a rough 20%, we had a rough 22%, when it came to international. So you saw stabilization, and now you're starting to see some improvements of the fundamentals going forward. Tim?

Tim Adams (CFO)

Yeah. No, I would just add, Corey, certainly a big opportunity still internationally. The growth rate has been, you know, better, higher than what we've seen in North America. Still a huge TAM over there, a big opportunity, and to your point, just on retention rates, something we pay a lot of attention to, and the team does a lot of work there, and they've remained stable. Thank you for the question.

Operator (participant)

Thank you. Your next question comes from the line of Jonathan Ho with William Blair. Jonathan, go ahead.

Jonathan Ho (Research Analyst)

Hi there. Good afternoon. I wanted to see if I could get a little bit of additional detail on the MSP opportunity that you referenced. You know, just like, why is the MSP opportunity a little bit more attractive than in prior periods? You know, how does the restructuring maybe impact that as well? Thank you.

Corey Thomas (CEO)

No, it's a great question. We've been talking a little bit for a while about partnership, the partnership focus, but also the big opportunity around MSPs. Look, the way that we see it, Let me word this. Customers overwhelmingly need both technology and services. As people try to tackle a very complex security environment, there's just not enough talent, enough expertise. We have to scale with a strategy of both technology that's great, well integrated, and a good service experience. Rapid7 does some of this, but we have no aspirations to actually do all of it. Two, we actually think MSPs are great partners.

Part of what we're doing in the efficiency and the streamlining is not just internally aligning our teams, we're actually leaning heavily into a partner strategy that actually, for partners that actually provide value to customers, to be investing more in those partners, co-selling more with those partners, investing in integrated technology solutions and support services with those partners. We are rotating our orientation to be. Look, partners have actually grown well with our business. We have key partners that are actually doing quite well, but you'll see even more of that in the future. We have some great demand with some very key and strategic partners that we've already shown momentum with this year, and we see a lot of opportunity to actually partner with key folks in the ecosystem going forward. That's a big focus.

At the end of the day, customers need great technology, yes, it needs to be integrated, but they also need service augmentation. Our strategy is to actually do that, not just ourselves, but heavily in conjunction with our partners. Thank you, Jonathan.

Operator (participant)

Thank you. Your next question comes from the line of Gregg Moskowitz. Greg, go ahead.

Speaker 16

Yeah. Hey, guys. This is Mike on for, for Gregg here. Just two quick ones. Firstly, just wondering, were there any changes this quarter in average sales cycles, average deal sizes, or duration, as compared with the Q1? Just second, what sort of ASP uplift did you see for Threat Complete and Cloud Risk Complete this quarter? Thanks.

Corey Thomas (CEO)

Yeah, I would say no change from Q1. You know, if, if you think about Q4, Q1, Q2, it's been what we've seen. It's a pressured economic environment. Things take a little bit longer, but it's a stable trend is what I would actually see. Look, again, I just wanna be clear, our, our demand outlook is healthy and stable. It's just you have the, you have a environment where customers are under a little bit of pressure, and we have to be thoughtful about how that pressure manifested. We're also seeing things convert. We're seeing lots of health. So we feel very good about the stableness of the demand environment so far. Things can always change, but we feel very good about what we actually saw in Q2, and what that portends for as we actually move forward.

On your second question is that the uplift that we saw on the packages was still double. It's roughly 2x. We feel good about that. We do have to get, we have to do a, a job of managing, you know, more deals that could have, that have higher ASPs in there. That's also a factor to take into consideration when we think about guidance and other things. Again, it's roughly 2x, and that's been a positive trend in the business.

Operator (participant)

Thank you. Your next question comes from the line of Gray Powell with BTIG. Gray, go ahead.

Gray Powell (Director)

Okay, great. Thanks for taking the question. Yeah, maybe just one on my side. I wanna make sure I have the stat right. I think you called out detection and response at over $300 million in ARR with 25% growth. That, that's great to hear. I know you're not disclosing vulnerability management revenue anymore, but is it safe to say that that's still growing, you know, in line or, or maybe better than the overall VM market? Just, just how should we think about that mix?

Corey Thomas (CEO)

Yes. one, if you, I'll answer two questions. One, at the heart of it, when you think about competitiveness from a usage and adoption, we believe, and we're seeing healthy traction in usage and adoption of vulnerability management and new customer adoption of vulnerability management solutions. It gets a bit apples and oranges because this is the challenge when you actually have allocations. As you do more platform sales, more solution sales, more packages, and so then you're actually attributing. What I would just say there is that it really doesn't make sense to actually, do the allocation base, 'cause, again, it's just more of an allocation base from a revenue perspective.

The way that we actually are really measuring this, both this year, which again, is, is sort of started off a bit more challenged, but we're seeing the right ramp and the right trends and the right trajectory. As we actually go forward, is that we expect us to grow better than the overall vulnerability management market in the mid to long term, because we actually have a better overall growth profile and opportunity. Yes, we have to actually get through these near-term changes. Yes, the economy is in flux some ways, but we think we have a very healthy setup for that, and that's the main thing, versus actually talking about, like, how do you actually allocate dollars to specific line items. Thanks for the question.

Operator (participant)

Thank you. Your next question comes from the line of Roger Boyd with UBS. Roger, go ahead.

Roger Boyd (Analyst)

Great, thanks for taking the question. Corey, I'd love to go back on MSSPs for a second. A lot of your competitors in VM, Cloud, SIEM, et cetera, are also emphasizing the growth opportunities they see in this channel. I wonder if you could just talk about the competitive environment there with MSPs and what makes Rapid7 a better partner versus some of your competitors? That'd be great. Thanks.

Corey Thomas (CEO)

Yeah, I think there's. I appreciate the opportunity to answer the question. The first thing is when you think about MSSPs, let's just talk about what they need as a side. One, not all people will be successful in MSSPs. You're seeing a lot of movement in the market where almost every, I would say, channel partner, tech company, VAR, even lots of tech companies, are doing more managed services. Just to be clear, that's 'cause customers need it. Let's just understand that, like, this is an area of core customer need. Now let's talk about why Rapid7 is, is ideally positioned and why we're having lots of momentum, and in fact, why we're putting even more investment in this area. We're not interested in commodity low-value managed services that do a poor job of security for customers.

We want to have world-class services that are good. We're also not interested in low-margin businesses. What we've actually had to really focus on over time in Rapid7 is how do you actually build an integrated platform? The first thing I'll say on differentiation is very few people in the market actually offer an integrated solution that spans all security operations, which is what lots of these partners are looking for. If you think about our solution, it gives them a compelling solution that allows them to compete in detection and response, the overall cloud security space, the traditional vulnerability management space, the risk and compliance space, and even now, with some of our partnerships and some of our enhancements with Minerva, the endpoint space. It gives them the ability to go to customers with a holistic solution.

That's critical, and that's what actually our partners support. The second thing that partners need, though, is they don't want, they don't want poor margins. And so what we've actually built in is heavy automation for ourselves. Again, we looked at ourselves as a lighthouse customer. We have highly competitive, highly attractive managed service and MDR solutions that have a high win rate, but also run at very, very high gross margins. And so when you think about competitive positions, we have a comprehensive solution with a lot of automation and intelligence that can be run at high gross margins, and we set ourselves up to actually partner well with those service providers today. This is why we actually have lots of the rand, this is why we actually have competitive advantage, and that's also why we're accelerating our investments in those partnerships.

Yes, it's a little bit disruptive in the short term, but it gives us long-term scale in the business, and that's incredibly important to us.

Operator (participant)

Thank you. Your next question comes from the line of Alex Henderson with Needham. Alex, your line is open.

Alex Henderson (Senior Analyst)

Great. Just, just start off with a clarification. You said your, your demand trends are stable, and you were comfortable, but I was hoping you could just tell us, is your pipeline as robust coming out of the June quarter as it was, say, coming out of the first quarter or out of the end of the year? That there's no change in that trajectory as we go into the restructuring. The change in revenue is only a function of the destabilization, not a pipeline issue. Could you talk a little bit about the linearity during the quarter? Was there any falloff in orders or closure rates late in the quarter that we should be aware of? Thanks.

Corey Thomas (CEO)

No, super fair quality questions, Alex, considering the amount of things that we announced today. The first thing I would just say is our overall pipeline is actually stable to up, and our conversion rates are improved, coming out of the quarter. We actually feel very good about the conversion rates. We feel good about the pipeline coming out. Again, the trends in the business are, are healthy from that perspective. Just to put a fine point on it, 'cause I, I think the fair question you're asking is, like, A, how much of the guide down is the structural changes in risk management, and how much of the guide down is sort of like just, you know, trends that you actually saw?

To, to just be very specific about that, is that it is about the structural risk management. Look, here's what it comes down to, is we actually have a good opportunity. The year was already back and loaded. We saw good trends. We actually don't want to be overly precise about an 18% cut and what the implications of that are. The question that we actually exited after we decided sort of like how to set up for 2024, how to set up the free cash flow, is what's inappropriate from a guidance perspective? knowing that we're actually gonna be going through changes.

I would say, Alex, it's, there's no precision that you can actually do to say, like, "Oh, I'll take $1 million off, take $1.2 million off." We said, "Listen, we wanna actually give a number that even with the changes, with the range of outcomes." Knowing, by the way, that in every quarter, I'll answer your other questions. Let me just answer your other your other, other question was, what was the linear? We saw great and consistent conversion rates throughout the quarter. Nothing fell off in the last week. In fact, we have had another consistent period of very strong closes on the thing. That said, is some things actually closed, some things pushed. That's what we expected.

In a year that's already back-end loaded, where you can actually have things pushed and still close, what we didn't wanna do was be over-precise about what the impact of a change of this magnitude was. We actually asked the opposite question and said, "All right, what's the range of outcomes if actually some things go well, some things don't, some things take longer, some things push?" We actually wanted to have a high confidence guidance range. That was the primary driver of guidance that we actually saw.

Did I answer all?

Alex Henderson (Senior Analyst)

That's great. Just one last question, if I could stick, stick it in. The timing of these restructurings, given the announcement here is in August, is most of the cost improvement then going to start kicking in in the fourth quarter and into 2024, or do you get some of it in the current quarter?

Tim Adams (CFO)

Yeah, Alex, you'll get a little bit in the, in the third quarter. The majority of the team, the 18%, is happening right now, this week. You'll have some folks that are transitioning through the balance of the year, but then you get the full quarter impact in Q4, and of course, for next year as well, which you see in the free cash flow, guide for next year.

Corey Thomas (CEO)

Thank you, Alex.

Operator (participant)

Thank you. Your next question comes from the line of Rob Owens with Piper Sandler. Rob, go ahead.

Speaker 17

Hey, thanks for taking my question. This is Ethan on for Rob. I wanted to ask about net new customer additions. They looked pretty strong here, so, both on a sequential basis and a year-over-year basis. I was kind of hoping you could add some more color there. Where did you see strength? Was it, you know, with the new packages, with the MDR services? Just curious if there was anything to call out there and why there's such a stark improvement. Thank you.

Corey Thomas (CEO)

Yeah, you know, it was a little bit surprising, probably from what we had commented on, around really rotating our focus on expanding the customer install base. What I would say, and I wanna just remind you, is that we started with the focus first on the packages. And we the follow-on motion in training and enabling was about how do we actually engage deeper and sell more into our install base. That motion really got started in Q2. I, I would expect the trend to change over time. I probably was a little bit imprecise in the timing on the last call, because that motion was starting. I still expect us to see more.

In fact, we saw a little bit more, I would expect to see a skew towards expansion in the install base over the next year. We did actually, that was a follow-on motion from the package motion that we actually did to start the year. Then to answer your core question, it was pretty broad-based across regions, products, and territories, so I can't really localize it to one thing. What I would just say is that the, our sales team has a lot of confidence and a lot of momentum. I would say we're focusing heavy on expansion as we actually go forward, but that may rotate over at a slower pace, is, is the way that I would take away from this quarter. Thank you for the question.

Operator (participant)

All right, thank you. Your final question comes from the line of Brian Essex with JPMorgan. Brian, go ahead.

Brian Essex (Executive Director and US Software Equity Research)

Hey, great, thanks for taking the question. Corey, I just wanted to follow on to that actually last topic. You know, echo my, my congrats on some healthy net new adds here from a customer perspective. Just wanna get a sense, anything you can provide us for, you know, attach rates within the install base? How much running room do you have to go to kind of, you know, upgrade existing customers, with, with adoption of packages? Are you seeing anything in your pipeline that's yielding, greater confidence in, sales productivity from a selling the platform perspective?

Corey Thomas (CEO)

Yeah. One, I actually think we have a massive amount of runway. Part of what we actually are solving and, and, and sometimes, you know, you use words like restructuring, you miss sort of like the realignment and optimization pieces. A big opportunity that we actually see is that, look, for better or for worse, it actually worked, but we actually spent the last couple of years both doing innovation that made us relevant. We have relevant offerings today in areas. Yes, there's continuing work to do, but we actually set ourselves up for relevance to make sure that we're in growth markets as we actually go forward. We had to actually do that by selling into areas that, frankly, vulnerability management did not buy us lots of tailwinds.

When you think about the SIEM market, when you think about text response, when you think about MDR, when you think about automation, when you think about cloud, is, you know, there's a setup there, but we have to get traction. We have traction, and we actually have momentum. A part of what we're doing in this restructuring is a lot of realignment. We have not honed our engine to actually really focus on expansion in the install base, and that's an opportunity that's in front of us.

A big part of what we actually did, our baselining, we did our research, when we look at best practices and benchmarks, is we actually have a lot of ground that we can actually gain that's relatively straightforward for a company of our size, when it comes from the internal operationalization of how we actually expand and operationalize in our install base. We're applying that. It's not rocket science, but it's applicable. Now is the right time to actually do that because we actually have established critical mass. Keep in mind, most companies when they add new product extensions, never get critical mass. We actually have critical mass in growth areas, and this is a good place to really focus about how do we expand in the install base, and most of that opportunity is in front of us.

Again, at over $500,000 ARR per customer, and still being sub $100,000 ARR per customer, and having historically, frankly, immature processes around expansion, not a lot of focus. Focus, maturing our processes, focusing on our alignment, our pricing and packaging, those are the areas that we're focusing on to drive that expansion in the install base, and that is a big part of the restructuring alignment.

Tim Adams (CFO)

Yeah. Corey, and to your point, you see it in that ARR per customer continues to grow, which has been very healthy, but there's so much room to grow from the mid-60s into the 100,000 numbers.

Corey Thomas (CEO)

Yep, absolutely.

Tim Adams (CFO)

Lot of headroom to go.

Corey Thomas (CEO)

Thank you for the question, Brian. All right, I think that that is all the questions that we actually have for today. Look, I know this was a lot to cover. I'm deeply appreciative of everyone's time and attention, and I hope all of you have a great evening.

Operator (participant)

Ladies and gentlemen, that concludes today's call. Thank you all for joining. You may now disconnect.