Rapid7 - Q2 2024

Transcript

Operator (participant)

I'd like to welcome everyone to the Rapid7 second quarter 2024 earnings call. All lines have been placed on mute to prevent any background noise. After the speaker's remarks, there will be a question and answer session. If you'd like to ask a question during this time, simply press Star and the number one on your telephone keypad. If you'd like to withdraw your question, press star one again. Thank you. I would now like to turn the call over to Elizabeth Chwalk, Director of Investor Relations at Rapid7. Please go ahead.

Elizabeth Chwalk (Head of Investor Relations)

Thank you, operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's second quarter 2024 financial and operating results, in addition to our financial outlook for the third quarter and full fiscal year of 2024. With me on the call today are Corey Thomas, our CEO, and Tim Adams, our CFO. We have distributed our earnings press release over the wire, and it is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast, and following the call, an audio replay will be available at investors.rapid7.com. During this call, we may make statements related to our business that are considered forward-looking under federal securities law.

These statements are made pursuant to the Safe Harbor Provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to the company's positioning, strategy, business plans, and financial guidance for the third quarter and full year of 2024, and the assumptions underlying such goals and guidance. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the future results expressed or implied in these statements due to a number of risks and uncertainties, including those contained in our most recent quarterly report on Form 10-Q, filed on May 8, 2024, our most recent annual report on Form 10-K on February 26, 2024, and in the subsequent reports that we file with the SEC.

The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by applicable law. Our commentary today will primarily be in non-GAAP terms, and reconciliations between our historical GAAP and non-GAAP results can be found in today's earnings press release and on our website at investors.rapid7.com. At times, in our prepared comments or in responses to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results.

Please be advised that this additional detail may be one time in nature, and we may or may not update these metrics in the future. With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey?

Corey Thomas (CEO)

Hello, and welcome to everyone joining us on our second quarter 2024 earnings call. As previewed a few weeks ago, Rapid7 ended the second quarter with $816 million of ARR, which is in line with our expectations and represents 9% growth over the prior year. Growth was led by our threat detection and response business, as customers continue to prioritize their ability to efficiently monitor security data across their full environment while extending their teams with our deep security expertise. The strongest demand was for our consolidated Threat Complete offerings, which show over 40% of new ARR in the quarter. As we progress through the second quarter, the underlying market dynamics we've highlighted as tailwinds to our business continue to support our broad strategic plans. Security practitioners are increasingly struggling to manage visibility into their complete IT environments.

Current market offerings don't tackle these challenges effectively or economically, which the latter factor being particularly difficult for mainstream enterprises. As we continue to advance key investments in our innovation this year, these are the core customer challenges we remain focused on solving. Rapid7 is investing to build the strongest security operations ecosystem for mainstream enterprises, supported by a leading data platform for contextualizing risk across fragmented, complex environments. Over the past year, we've been strategically reorienting our company towards an integrated data platform, focusing on the highest value workloads in cloud and detection response, and building out a more efficient go-to-market motion.

We firmly believe that providing visibility across a customer's risk environment by integrating traditional vulnerability management with a broad set of cloud security solutions and pairing that with a world-class D&R SOC efficacy in one place, gives customers a more effective solution and overall better security outcomes at the price value they are seeking. Our strategic plan is to capture this opportunity while optimizing our business for better long-term growth. In order to meet these strategic objectives, we started this year by sharing our intentional and targeted efforts around three key areas: detection and response innovation, our partner ecosystem, and mainstream cloud security adoption. We've spoken to these critical areas on the last few earnings calls, and today I'm pleased to update you on the progress we made in each and every last one of them....

Our first area of focus is innovation to deliver world-class detection and response experience to our customers. Rapid7 has taken a deliberate approach in this market over the last few years, and we continue to invest in extending our capabilities with a committed focus on delivering the integrations, features, and usability that resonates most with mainstream enterprise customers. This overarching approach supports the steady growth we're seeing today in the following ways: The escalating frequency of ransomware attacks is driving security teams to favor solutions that monitor their full IT environments. We continue to focus investments towards expanding the breadth of alert coverage on our platform, which improves our ability to monitor and manage more third-party security data on our platform, and sets Rapid7 apart from our peers in SIEM and the XDR space. Rapid7 also stands out against point vendors that lack broad expertise and capabilities across security operations.

Our ability to offer integrated platform to solve adjacent security concerns, like full visibility into hybrid attack surface, delivers better security outcomes and more compelling economic value. And lastly, we are one of the few detection and response platforms that gives customers a seamless extension of their own security teams. By using our managed services and the extensive expertise that comes along with it, we continue to invest in the efficiency and scale of our SOC, including leveraging AI and analytics to make these teams more effective. Our second key area of focus this year is our partner ecosystem, which continues to increase in importance as we scale and prioritize efficient demand generation. Investing in our go-to services and partner ecosystem to increase our capacity for service delivery, as well as provide a strong source of efficient demand generation, will help us deliver more sustainable and profitable growth.

Sales pipeline generated across our strategic partners grew 15% year-over-year in the second quarter, which was an acceleration from Q1. Our team is seeing traction broadly as we continue to emphasize our MSSP partnerships, key channel relationships, and increasingly engage with customers in marketplaces like AWS. Our Comcast Business partnership is progressing nicely and will serve as a steady driver of scale for our detection and response business. Customer buying behavior continues to shift towards the hyperscaler marketplaces, and our ability to support this has doubled the volume of deals that we have closed year to date on AWS Marketplace. Furthermore, we're gaining mind share and momentum with our top channel partners, which is helping to support stronger pipeline growth and remains a growth opportunity for Rapid7.

Our last key area, and the one that I'm most excited about today, is our focus on leading mainstream cloud security adoption. To give some context to the unique challenges and opportunities in this space, it's helpful to remember that many security teams don't exactly know what their IT environments look like. While this knowledge is foundational to protecting those environments, mastery of the customer attack surface is limited by data collection, which tends to be expensive and challenging, especially as it relates to securing cloud security environments. Because there are multiple sources of data to integrate, we are lowering the barrier to visibility by allowing customers to secure their attack surface by integrating diverse sets of security data, including network, identity, and cloud telemetry together on the Rapid7 Command Platform. This leads me to the announcement you may have heard and seen yesterday.

We introduced our new Command Platform at Black Hat. This fully integrated platform extends our traditional Insight capabilities by allowing customers to integrate more of their critical security data in one place, whether that data comes from Rapid7 or other providers, giving security operations teams greater visibility that they can trust. Our flagship Exposure Command offering aims to provide integrated risk visibility across the full attack surface and optimal cost effectiveness. This single unified view can help customers understand what does my complete environment look like and what are my biggest exposures, is the core of our new Exposure Command offering. The hybrid attack surface clarity offered by Exposure Command across both traditional and cloud environments is now built into our vulnerability management and improved suite of robust CNAPP capabilities for an integrated, threat-based approach to risk reduction.

Exposure Command is bolstered by our recent acquisition of Noetic, which provides an integrated, high-confidence view of assets across the attack surface. We believe that the Noetic technology and their top-notch team will be crucial pieces of Rapid7's broader offering, and we're thrilled to have them on board. Starting officially this week, the Rapid7 team will be executed on the following opportunities for our company and our customers related to Exposure Command. First, the opportunity to drive meaningful expansion from our existing InsightVM base to Exposure Command, with frictionless upsell offers for customers looking to unlock better attack surface visibility and expand into the cloud. Second, we expect this new platform offering can enhance retention, not only through Exposure Command, but by offering additional attack surface management functionality as part of their existing VM offering at a minimal uplift.

Third, Exposure Command adds a second flagship land offering with disruptive market pricing to position us strongly in competitive deals and to help us expand the market to new mainstream customers. We believe there are many underserved mainstream customers that lack visibility into their broader environments, in part due to the complexity and cost structure for existing CNAPP offerings... And finally, we believe accelerating cloud security adoption via Exposure Command will further support D&R growth. As customers know well, you can't effectively monitor and respond to threats without visibility into your attack surface. And having visibility into your full environment is a driver for greater urgency around monitoring and responding to threats.

As we look ahead, we believe that the long-term investments we are prioritizing this year in the three critical areas I just described, supporting D&R momentum, building our partner ecosystem, and accelerating mainstream cloud adoption, will ultimately deliver the best security outcomes and the strongest economic value for our customers. We remain steadfast in our commitment to enhancing value for our shareholders, and we are working to capture upside and opportunity through our focused strategic plan. We're currently in the market with our two flagship offerings, Exposure Command and Detection and Response, to address the highest priority areas of spending within security operations. We continue to innovate on our underlying product capabilities and improve our land and expand motions to meet customers' needs in the existing market.

We are confident that our recently streamlined leadership organization focused on profitability and efficient growth, and a clear strategy to provide leading security operations platform to mainstream enterprise customers, will support long-term growth for Rapid7. Thank you for joining us on the call today. I will now turn the call over to our CFO, Tim Adams, to share additional detail on our financial results and outlook. Tim?

Timothy Adams (CFO)

Thank you, Corey, and good afternoon to everyone on today's call. Thank you for taking the time to join us today. Before I turn to our results, a quick reminder that except for revenue, all financial results we will discuss today are non-GAAP financial measures, unless otherwise stated. Additionally, reconciliations between our GAAP and non-GAAP results can be found in our earnings press release. Rapid7 ended the second quarter of 2024 with $816 million in ARR, consistent with our expectations and growing 9% over the prior year. Our Q2 ending ARR result reflects continued strength in our detection and response business, particularly for our Threat Complete offerings. As Corey shared, this consolidated offering drove over 40% of new ARR in the quarter and underscores the customer demand we are seeing for broad, effective, well-integrated solutions at compelling price points.

Trends in the rest of the business during the second quarter were in line with our expectations as we work towards the launch of our Exposure Command, our new integrated risk management offering. ARR growth in the second quarter was weighted towards our sales expansion, as ARR per customer grew 7% over the prior year to $71,000, while our total customer base grew 2% year-over-year to end the quarter with nearly 11,500 customers. We continue to see growth in our higher value platform customers that is partially offset by a decline in lower value non-platform customers. Second quarter revenue of $208 million grew 9% over the prior year and exceeded our guided range.

Recurring product subscription revenue grew 10% over the prior year to $200 million, which was better than expected on favorable linearity in the quarter. Professional services revenue declined sequentially as we continued to actively de-emphasize certain lower value services. Our revenue mix continues to shift towards International, which grew 19% year-over-year and now represents 23% of total revenue. I'll turn now to our operating and profitability measures for the second quarter. Product gross margin was 76% in the quarter, and total gross margin was 74%, both of which are in line sequentially and with the prior year. Sales and marketing and R&D expenses were 33% and 15% of revenue, respectively, compared to 39% and 21% in the prior year. G&A expense was in line with the prior year at 7% of revenue.

Operating income of $39 million was above our guided range and represented a roughly 19% operating margin, approximately 12% higher than the second quarter of last year. Adjusted EBITDA was $45 million in the quarter, and net income per diluted share was $0.58. Moving to our balance sheet and cash flow, we ended the second quarter with cash, cash equivalents, and investments of $494 million, compared to $464 million at the end of the first quarter. We generated $29 million of free cash flow in the quarter, up from the $28 million we reported last quarter. This brings us to our guidance for the remainder of the year.

We continue to expect full year ending ARR to be in the range of $850 million-$860 million, which represents growth of 6%-7% over the prior year. Our second quarter was broadly in line with our expectations, and as we look out at the rest of the year, our assumptions for the second half have not meaningfully changed since we updated guidance in May. While the demand environment continues to be choppy, we expect relative stability in customer spending trends to continue.... While we expect improving pipeline momentum exiting the year, only a modest contribution from Exposure Command is assumed in the fourth quarter. Lastly, we continue to expect that our detection and response business will remain healthy.

Similar to the comments we made last quarter, given the ramp of ARR in the second half of the year and the timing of our recent Exposure Command launch, I would like to share some directional commentary on our ARR expectations for the third quarter. We expect a high single-digit sequential increase in millions of net new ARR dollars, similar to the increase in the second quarter. We are raising and narrowing our full-year revenue range to $833 million-$837 million, representing growth of 7%-8%, up from the $830 million-$836 million. On profitability, we are maintaining the midpoint and narrowing our full-year operating income range to $152 million-$156 million.

Our updated operating income range is the result of better expense control in the second quarter that is offset by new incremental costs in the second half of the year related to the Noetic acquisition, as well as higher advisory and legal fees. We expect full-year net income per share in the range of $2.15-$2.20, based on an estimated 74.7 million diluted weighted average shares outstanding. Our full-year expectation for free cash flow is now $150 million-$160 million. While we remain strongly committed to expanding profitability and continue to see a reasonable path to our original target of $160 million, our updated range reflects the new incremental costs in the second half of the year related to Noetic and higher advisory and legal fees. Moving to quarterly guidance.

For the third quarter of 2024, we expect total revenue in the range of $209 million-$211 million, representing growth of 5%-6% over the prior year. We expect non-GAAP operating income in the second quarter in the range of $36 million-$38 million, and non-GAAP net income per share of $0.50-$0.53, which is based on 74.9 million diluted weighted average shares outstanding. Thank you for taking the time to join us on the call today, and with that, we will open the call for questions. Operator?

Operator (participant)

Thank you. As a reminder, if you'd like to ask a question, please press star one on your telephone keypad. Your first question comes from the line of Matt Hedberg from RBC. Line is open.

Matt Hedberg (Research Analyst)

Great. Thanks for taking my questions, guys. Corey, nice to see the stability in the results. I guess, you know, I wanted to drill down a little bit on some of the go-to-market changes that you talked about a month or so ago. You know, just maybe just a little bit more of the rationale there and, you know, how do you think about that, you know, potentially impacting second half performance?

Corey Thomas (CEO)

Yeah. No, thanks. It's a great question, Matt. So the primary drivers, we're gearing up for the evolution of our go-to-market motion as we really focus on both the Command and Exposure Command launches. You know, a big part of that is upgrading our VM customers to our new Command Platform, which we think is gonna be more relevant to the future, than traditional vulnerability management, and we had a high urgency around that. We had three established leaders who have a, a strong track record, strong tenure with the company, that were ready to actually take over sort of like integrated roles across each of the regions.

The second part of it is, I've been spending the last several years really focused on our product and R&D, and I really wanted to actually sort of, like, spend more direct time with our sales leaders as we were actually making this, as we were making this transition and as we were looking to accelerate the business going forward.

Matt Hedberg (Research Analyst)

Got it. That makes a lot of sense. And then, I guess, somewhat related, the second question, in your prepared remarks, you called out sales pipeline from partners grew nicely. And you, I think you called out, you know, sort of MSP and AWS and maybe a couple others. You know, how does that, you know, as you think about the evolving go-to-market motion, you know, how important are partners gonna be, especially with new product rollouts and just broader distribution from that sense?

Corey Thomas (CEO)

Look, I think it's critical. You know, if you just take a step back, remember, we have, like, two big things that we're really focusing on, is, one, making sure and making the transition to make sure that our products and our services are relevant for the next five years, not the past five years. We've had a lot of focus on the product strategy around detection and response, managed detection and response, and now sort of like integrated Exposure Command with our new attack surface management offering. And so we've been highly focused there overall. But the second part is, how do we actually set ourselves up for efficient growth as we actually go forward?

As you know, we had to make some sort of, like, hard but important decisions to actually look and say, like, "How do we become the growth-oriented security operations company over the next five years?" We saw partners as critical to that. We think we're making good traction there. We're still in the middle of the transition there, but we're seeing the things pointed in the right way. Partners like our offering. We're increasing our investment, we're increasing our service around it. We think it's good for partners, it's good for our customers.

But we think that these two big things that we've been actually doing, ensuring our product strategy is right for the next five years, which is really a long-term orientation, and ensuring that our go-to-market strategy has the most leverage for both our customers and the company, are two big things we're doing, and partners are key to that.

Matt Hedberg (Research Analyst)

... Thanks a lot, Corey. Best of luck.

Corey Thomas (CEO)

Thanks, Matt. Appreciate it. Operator?

Operator (participant)

Thanks. Your next question. Sorry, I apologize. Your next question comes from the line of Fatima Boolani from Citi. The line is open.

Speaker 18

Hi, good afternoon. This is Joel on for Fatima. Thanks for taking our questions. So, maybe just the first one, to follow up on the GTM conversation. So in relation to some of the GTM and sales org changes, from earlier this year, could you just talk about how sales productivity and attrition levels have trended, relative to your internal expectations? And then also from that perspective, what's embedded in your guidance for the year?

Corey Thomas (CEO)

Yeah, so on the sales, I assume you're talking about the salespeople themselves. We've seen very healthy retention of the sales force. It's in line with our expectations overall and where we expect from the sales force maturity. I can tell you that our sales team is extraordinarily excited by the new Command launch and the new products that we actually have coming into the market. I haven't seen this much momentum in a long time. We think that that's bolstering some of the retention in an overall, I would just say, challenging high-level macro environment. We're seeing lots of excitement and momentum as we enter the second half of the year from our sales team.

Speaker 18

Mm-hmm. Got it. And then maybe just to follow up for you, Corey. On the CRC V2, any shareable anecdotes from customers, and maybe how early momentum is tracking relative to your expectations?

Corey Thomas (CEO)

Yeah, so the biggest difference between... So we launched our new Command Platform, and you can think about the, you know the Insight platform was a Rapid7 platform that actually offered a common set of products on a common platform. The Command Platform is an all-security data platform that includes plus Rapid7 data, but critically, customers wanna actually see all of their security data about their attack surface, and they don't wanna have to be the system integrator on that. The problem that we actually solve with the Command Platform and with Exposure Command is we provide the lowest cost, highest efficacy view of the overall attack surface, while actually integrating all the security telemetry across the ecosystem overall. And so that's the primary drive and purpose of the Command Platform overall.

And with that set up, I would just say that we're actually seeing a lot of early interest. Now, it's too early to tell, but I'll tell you, we saw, you know, pre-launch, the pipeline build, for which is just our sales force, has been the highest of any launch that I've seen in Rapid7's history. We've already got the first set of deals in when, you know, that was sort of like 'cause it was addressing a real customer need. That said, is that we're pretty pragmatic about the expectations for this year. Our primary goal this year is to build pipe so that we're set up for sort of like re-acceleration next year. But if sales cycles come in, that's great, but it's not something we're factoring into our overall plans.

Speaker 18

Got it. Thank you.

Corey Thomas (CEO)

Thank you!

Operator (participant)

Thank you. The next question comes from the line of Jonathan Ho from William Blair. The line is open.

Jonathan Ho (Partner)

Hi there. Can you hear me okay?

Corey Thomas (CEO)

Yes. Yeah. Hey, John.

Jonathan Ho (Partner)

Good afternoon. Just wanted to get a sense for how you're thinking about this Command Platform upsell and perhaps, you know, how you're seeing the market change. You know, whether there's any shifts in terms of, you know, customer spending behaviors, you know, that are maybe, maybe moving more towards the CTEM or attack surface management value proposition.

Corey Thomas (CEO)

Yeah, no, it's a great question. Look, we've been worried about this for a while. We started investing, as you know, several years ago. We've been accelerating the investment. That was a big part of the restructuring that we did last year. Because what we really wanted to position ourselves up was to position ourselves for future customer needs, and not customer needs out in the past. Right now, customers' biggest challenge is that you ask almost any customer, they do not have a clear understanding of their overall attack surface. Vulnerability management has done a decent job, but it's still sort of providing a silo of data about parts of the attack surface, but it provides it with a lack of context. What we heard from lots of customers is they wanted to actually have a high confidence view of their overall attack surface.

They wanted to actually integrate the data from all of their security telemetry, not just from one vendor. That's the flaw in many asset inventory systems. They actually wanted to lower the cost of actually the ability to get an understanding to the overall attack surface, which is one of the challenges that you have on the cloud side. So we are seeing a shift to CTEM, or I think Gartner calls it the Exposure Management space. It's not just sort of packaging vulnerability management together and cloud together. It's the ability to make sure you have end-to-end visibility across the environment.

But just as important, where we put lots of investment, where we actually combine our innovations with Noetic's innovation, is the ability to integrate all that data in, to actually have the highest confidence view of the state of the overall attack surface at any moment in time, and then to be able to integrate, all that different data in and be able to drive in, investigate, respond, prioritize across all the data, across all of the attack surface. So far, in early discussions, that's providing real value to customers in ways that traditional vulnerability management didn't, which was just another data source that customers then have to spend a lot of time and people to actually go figure out, like, all right, how do I relate that data to other data in the environment?

Jonathan Ho (Partner)

Fantastic. Thank you.

Corey Thomas (CEO)

Thanks, Jonathan.

Operator (participant)

Thank you. The next question comes from the line of Joel Fishbein from Truist Securities. Your line is open.

Joel Fishbein (Analyst)

Thank you. Thanks for taking the question, congrats on the Command Platform launch. Corey, For you, I just would love a little bit more color on, and I know it's early days, pricing, packaging, and go-to-market for the Command Platform. And what will it actually include and not include? That would be really helpful. Thank you.

Corey Thomas (CEO)

Yeah. So while it's early days, what I would just say is that, look, similar to what we did in D&R, our goal is to actually make the ability to have 100% visibility with confidence into customers' environments, affordable and achievable. So it will be an uplift, but it's a relatively, I think, reasonable uplift for existing vulnerability management customers. We think that if we actually do that, it'll not just improve, sort of like, in our expansion growth, it'll also lock customers in for longer and make them stickier because we're solving a bigger, better problem. The second thing that it actually gives us by taking that approach is when customers better understand what their attack surface is, it turns out that there's more to monitor, and we can actually monetize it with our detection and response offerings.

So you can expect it to be a small uplift from the incremental vulnerability management perspective, but we really are pricing this to actually give customers complete visibility into their overall attack surface. And then from there, we actually have several different offerings on top of that that we can actually monetize. But it all starts on the basis of every customer has 100% confidence and understanding of their attack surface.

Joel Fishbein (Analyst)

Thank you.

Corey Thomas (CEO)

Thank you.

Operator (participant)

Thank you. Your next question comes from the line of Alex Henderson from Needham. The line is open.

Alex Henderson (Sell Side Analyst)

Before I throw a question at you, I just wanted to clarify something. Did you say your pipeline was up 15% for the company as a whole, or was that just the VAR channel?

Corey Thomas (CEO)

Yeah, that was-

Alex Henderson (Sell Side Analyst)

Questions.

Corey Thomas (CEO)

Yeah. So that was our overall partner ecosystem was up 15%. The commentary on the company is just that we have seen pipelines stabilize and improving, but we wanna see that improvement continue as we build up momentum for next year.

Alex Henderson (Sell Side Analyst)

Okay. So if I were to look at the two major products that you've got now, what you're calling your two foundational platforms, if I was a new customer, say, in the June quarter of next year, and I acquired these two product lines simultaneously for, you know, a reasonable-sized company, what would be the relative sizing of the two acquired properties? Would one be larger than the other? Is the, you know, Exposure Command product larger or smaller than the detection and response platform?

Corey Thomas (CEO)

Yeah. You're just talking about raw pricing, is that correct? I just wanna make sure I understand the question.

Alex Henderson (Sell Side Analyst)

Yeah, just roughly, you know, if I'm a new customer, say, 1,000 employees-

Corey Thomas (CEO)

Yeah. So it's—

Alex Henderson (Sell Side Analyst)

Which is larger?

Corey Thomas (CEO)

Yeah, absolutely. So the way to think about it is that Surface Command is designed to sort of be very low cost and give you complete coverage of the environment, and so people can actually integrate the data across the environment. Exposure Command combines the integration capabilities of Surface Command with all of the raw sort of like capabilities. So think about it, it will be disruptive against traditional cloud pricing, but it's meant to actually really drive adoption. So it's meant to be affordable and drive overall coverage in the environment. And then there's lots of... The way to think about it is detection and response is gonna be at a premium price point, and frankly, it's gonna be more customizable to customers' needs.

We really get our monetization in the detection and response space because that's critical, and we have a wide range of price points from technology only, to managed service with partners, to managed service with us, to customer learning. But we have a wider range of price points with detection and response, and that's also super strategic for customers. And part of why we take the disruptive approach on Surface Command and Exposure Command is because the more people understand their attack surface, the easier it is for us to monitor and secure that attack surface with the customers.

Alex Henderson (Sell Side Analyst)

So should we be thinking about this as somewhat of a loss leader, you know, entry product that then allows you to upsell the detection and response platform, and therefore is a much smaller contribution to revenues, but does drive the overall business proposition over time? Is that the right way to think about what we're-

Corey Thomas (CEO)

Yeah, the way that I would think about it is it will actually be a contributor. We expect it to be a contributor to growth, but I would say it's probably a smaller contributor to growth than detection and response. But it's still a net positive contributor to growth, just to be clear. And I think that the disruptive, sort of like packaging and pricing, doesn't interrupt that. It does set up for higher expansion and growth in the detection and response business. That's true, but we're not pricing it where it's a negative to growth. It is accretive to growth. We expect it to be accretive to growth, but we expect detection and response to be a larger growth driver. That's true.

Alex Henderson (Sell Side Analyst)

Okay, thanks.

Corey Thomas (CEO)

Thank you so much.

Operator (participant)

Thank you. Next question comes from the line of Joshua Tilton from Wolfe Research. The line's open.

Joshua Tilton (SVP and Security Software Analyst)

Hey, guys. Thanks for taking my question. Can you hear me?

Corey Thomas (CEO)

Yes, can you just fine. Yeah, we can.

Joshua Tilton (SVP and Security Software Analyst)

Yeah, look, I just have one from me, and I guess, you know, I heard the prepared remarks, especially around the guidance, but just maybe help us get a little confidence around, you know, your confidence interval on the implied second half net new ARR. I understand you guys talked to, like, strength and consolidated offerings, which is 40% of net new ARR, you know, this quarter, but we're talking about pretty small numbers for net new ARR in the first half versus what's implied in the second half, and kind of feels like the rest of the business needs to pick up to kind of hit the numbers you're talking to.

Just maybe help us gain a little bit more confidence around, you know, what your guys' decision to leave the full year—to reiterate the full year ARR outlook today.

Corey Thomas (CEO)

Yeah, that's great. So if you really look at it, I, I think while you're right on the first half guidance, it's really Q1 was just like, sort of like really poor in terms of it. Our big question that we actually had was really stabilizing Q2 and having a stable outlook from Q3. We feel very good about that. In addition, Q4, we have just more longer term deals in there. So we have a little bit more in the bank going into Q4, but really, what you're talking about is getting back up to, you know, a little bit above a flat year-over-year net ARR from last year. And we feel good about that trend line.

I mean, frankly, from the Q1 spot to the Q2, just even though it was a small number, getting that momentum back and having that outlook be stable for Q3 was the trend that we're actually looking to actually get on. And that puts us, I think, in the guidance range. And actually, we feel comfortable-

Timothy Adams (CFO)

Yeah

Corey Thomas (CEO)

... about landing in the guidance range right now.

Timothy Adams (CFO)

Yeah. Corey, in your prepared comments, you talked about the strength in the partner pipeline build up 15%, which, you know, year-over-year, which was up from Q1. So we are seeing the momentum on that side, and we know that Q4 is historically always been a strong quarter for us.

Corey Thomas (CEO)

Yeah

Timothy Adams (CFO)

and we anticipate that again this year.

Corey Thomas (CEO)

But even that, we expected it to be relatively, like, stable from last year, and we've seen enough momentum and build for that.

Joshua Tilton (SVP and Security Software Analyst)

Super helpful.

Corey Thomas (CEO)

Thank you.

Joshua Tilton (SVP and Security Software Analyst)

Just a very quick follow-up,

Timothy Adams (CFO)

Sure

Joshua Tilton (SVP and Security Software Analyst)

- on my end. Can you guys maybe just broadly speaking, actually, not broadly speaking, just in general, I don't know if you give an update. I don't remember exactly when you give it to, but can you just help us understand, like, the strength you're seeing or, or like, what the run rate is, or just an update on the IDR business? Has that kind of been a shining light for you guys over the last two quarters?

Corey Thomas (CEO)

Yeah. IDR is much higher in the preference stack, and it's been the biggest contributor of overall growth this year. And we see the demand there, and in fact, you know, we are working to expand our IDR services, because we see customers looking for us to actually do more, from a detection response perspective. So we see that as something that's high in the value stack. Customers are looking at help, both on the technology side and on the managed service side from us and our partners. And so we see that as a big opportunity, frankly, not just now, but over the next several years.

Timothy Adams (CFO)

Yeah, Corey, we didn't break it out this quarter, and maybe we have in the past, but we both said in our prepared comments, it's really been an anchor for us, a very strong positive anchor, and it grew very nicely in the quarter.

Corey Thomas (CEO)

Yeah. Thank you.

Joshua Tilton (SVP and Security Software Analyst)

Thank you, guys. Much appreciated.

Timothy Adams (CFO)

Thanks, Josh.

Operator (participant)

Thank you. Your next question comes from the line of Brian Essex from J.P. Morgan. The line is open.

Charlotte Bedick (VP in Equity Research)

Hi, this is Charlotte Bedick on for Brian Essex. Thank you for taking the question. I know you gave some color in the prepared remarks, but could you expand a little bit about the platform customer count versus your total customer count and how that's trending? And if you're seeing better traction in the enterprise, that can be different aspects like that, that'd be really helpful. Thank you.

Corey Thomas (CEO)

Yeah. I think in the past, we've broken out platform versus traditional. Look, we continue to see falloff of our small dollar transactional customers. Our platform customers grew faster than that, and so you can think about, like, mid-single digits in terms of that, which was, I would just say, in line with expectations and healthy. We always want to grow customers, but we're happy that the growth is coming on the platform side. We think that sets up for better long-term growth.

Timothy Adams (CFO)

Yeah. Corey, it was up sequentially and year-over-year on the platform side, and it's a line share of the customer base, and it's performing well.

Corey Thomas (CEO)

Perfect. Thank you.

Charlotte Bedick (VP in Equity Research)

Great. Great. Thank you.

Corey Thomas (CEO)

Thanks.

Operator (participant)

Thank you. Your next question comes from the line of Rob Owens of Piper Sandler. The line is open.

Speaker 19

Great. Thanks for taking my question. This is Ethan on for Rob. Corey, I just wanted to ask on the VM space as a whole, do you see some of the headwinds in growth that you're seeing here, you and other, your peers are seeing as kind of cyclical or more secular longer term? Thanks.

Corey Thomas (CEO)

Yeah. So look, I think the biggest thing is we've been worried and focused and building our platform for a little while, because we've seen the pressure that in the strategic value, that vulnerability management was gonna have. And so we really have taken an intentional approach to actually shift our, our value stack up, first with detection and response, and now with our CTEM or overall Exposure Command offering, to make, to solve a more strategic problem for customers. Because at the end of the day, it's about the customer. And vulnerability management solves a problem, but that problem is becoming less and less strategic for customers. I think that's the pressure that you're seeing in the market. It's one that we've been sort of like, worried about and focused on for a little while.

So while I think that's true, I think vulnerability management itself is still critical, and that's why we see it as an important capability of our solution. But it's a capability of the solution, it's not a standalone solution, as we see it, and we think standalone solutions will continue to see pressure. But we do think that if you're solving the broader visibility, risk, understanding of the attack surface problem, then we actually think that's something that customers are gonna find valuable. We're seeing good early momentum, but it's too early to tell the pace of that, but we are seeing very good early traction there.

Speaker 19

Great. Appreciate the color.

Corey Thomas (CEO)

Thank you.

Operator (participant)

Thank you. The next question comes from the line of an anonymous caller from Morgan Stanley. Line is open.

Oscar Saavedra (Equity Research Associate)

... Hi, this is Oscar Saavedra on for Hamza Fodderwala from Morgan Stanley. Thank you for taking my question. I wanna dig in a little on your commentary on pipeline generation by partners. Nice to see that it was up 15%. Last quarter, I know you mentioned you indicated that the contributions from the new focus was not yet making up the contribution loss from what you de-emphasized. I was just wondering if you can comment on how that trended this quarter, to what extent that gap was closed compared to last quarter? And as we look ahead, how should we think about maybe the timeline and for that to sort of break even? Thank you.

Corey Thomas (CEO)

Yeah, as part of some of the changes that we actually made, it's something I'm paying a lot of attention to. What I would say is that we saw it stabilize and grow better than it has in a while in the quarter. But we are looking to actually manage it to grow faster. Now, the partner stuff takes time, and I would just say that that's a core, sort of like part of the transition period. But we feel that we're on the right trajectory, enough so that we're actually increasing our investment allocation to the partner ecosystem, because we're seeing the yield and the results there.

Really, what we're focusing on is, you know, how do we, of course, make sure that we actually are executing against this year's targets, but also how do we actually build that momentum as we actually go into next year? So I'll just say it's trending the right way. Of course, like everybody else, we wanna see more sooner. We're managing our investments thoughtfully on that path, but we're seeing the right direction. We're just looking to actually get more out of it faster.

Oscar Saavedra (Equity Research Associate)

Got it. Thank you.

Corey Thomas (CEO)

Thank you very much.

Operator (participant)

Thank you. The next question comes from the line of Mark Cash of Raymond James. Line is open.

Mark Cash (VP and Equity Research Analyst)

Hi, guys. Thank you. This is Mark on for Adam. So, Corey, if I can start with you. You know, some exciting, exciting changes on the product front happening, and a lot of those just move to regional go-to-market structure and not replacement to overall. So are those changes related, or is the move to a regional sales structure something that's already being worked on? And why move to that structure?

Corey Thomas (CEO)

Yeah, the changes to actually the regional sales structure are actually being worked on. We have been looking at how to, within the region align, the, you know, the land, expand, you know, retain businesses, drive not just efficiency, but especially since we have a more partner-centric business, to make sure that we actually had more alignment there. So that work was already underway, and our previous Chief Commercial Officer actually did lots of the homework, working with the regional sales leaders to actually, to actually help bring that plan forward and to make it a reality there. So but the reason for it was not just an efficiency, thing, it was also an execution about how do we actually make sure that we're actually upgrading our install base to the new command platform in a timely fashion while working with and expanding our partner ecosystem.

Mark Cash (VP and Equity Research Analyst)

Okay. Thank you for that. And Corey, if I could ask... I'm sorry, maybe actually for Tim, if you don't mind. I guess, you know, generate $150 million-$160 million of free cash flow this year, substantial margin improvement year-over-year. So how are you now thinking about rank ordering the use of cash, so you have this more durable cadence of cash coming to the business?

Timothy Adams (CFO)

Yeah, in terms of more of a capital structure, use of cash. So first priority is to make sure we always have enough cash to run the business, which has never been a problem. You know, I would call that a, you know, $200 million that you would leave on the balance sheet. Corey and I have talked very publicly of, you know, one acquisition per year to at least have the room to do that, similar to the acquisition. You know, we welcome the Noetic team to Rapid7, and that is a tech and team, a smaller size deal.

So I would call all of that priority number one, and then priority number two is we're very mindful of the debt stack that we have, and we have plenty of time to manage that accordingly, but ultimately, to repay the debt. So I'd put it in that order of priority.

Mark Cash (VP and Equity Research Analyst)

Okay, thank you so much.

Operator (participant)

Thanks very much. Thank you. Our next question comes from the line of Michael Romanelli from Mizuho. Line is open.

Michael Romanelli (VP)

Yeah, yeah. Yeah. Hey, guys, this is Mike on for Greg. It may be two for me. I guess just, you know, firstly, from, you know, from your perspective, have you seen any change in customer behavior since the CrowdStrike IT outage very recently? And then just on average discounting rates. So I guess, what do they look like in 2Q? You know, were there any changes sequentially? Thanks.

Corey Thomas (CEO)

Look, the CrowdStrike item was a, it was a big deal for our, our customers and for the security industry in general. It, it took a lot of time, lots of people put heroic efforts in to get their businesses back online while they were staying secure. We have overlapping customers, and we were trying to make sure that we supported our customers. And so I think people are sort of like, while systems are back online, I think that took a lot out of security teams. And so I think that was probably the bigger pressure point. I think it's too early to know anything else, but I just know security teams and IT teams put in Herculean efforts, and I think it really matters, and, and they should be appreciated. Your second question, remind me what it was again?

Timothy Adams (CFO)

Just on the relative discounting and-

Corey Thomas (CEO)

Oh, relative discount. I don't think we saw anything material on the relative discounting.

Timothy Adams (CFO)

No, no real change.

Corey Thomas (CEO)

Yeah.

Timothy Adams (CFO)

Right.

Corey Thomas (CEO)

Yeah. Okay, thank you very much. Operator, any more questions?

Operator (participant)

Thank you. Yeah, I apologize. Thank you. Yep. Our next question comes from the line of Kingsley Crane. Line is open.

Speaker 17

Hi, thanks for taking the question. So in light of some of your peers focusing on profitability, I wanted to double-click on product gross margins. How much room do you feel you have to expand product gross margins over time? Is 80% a reasonable goal, or do you expect most future margin improvements to be from sales and marketing, for example?

Corey Thomas (CEO)

You know, it's a really good question. I would say the one, Look, I, I think customers get a vote here, and I will say that customers are also looking for more assistance and enablement. So I, I think right now we have confidence that we can grow margins overall. We have the flexibility to actually, you know, grow it at the gross margin line or from operating expenses. But customers are looking for more help and assistance. Now, I think part of the reason that we actually have room on the gross margin line is really two things. Is one, we are gearing up more partners and managed services partners, which actually help with that. And our team is investing in AI, which actually has the benefit of helping our customers, get more coverage and support, while also, allowing us to expand our margin profile.

We haven't sort of, like, fixed the model. We don't want to sacrifice our ability to support customers, engage with customers. Right now, we have very high confidence that we can expand our overall margin as a company while accelerating growth. It's going to actually, sorry, the overall demand level of customer service, which has been going up hugely, where customers want to have Rapid7 and its partners help them more with their security programs, that's gonna be offset by AI and the ability for us to continue to ramp partners. Great question. Thank you.

Speaker 17

Well, that's really helpful. And just one more. So when I think through geo dynamics, we've seen some challenges in the States for a lot of security companies. You've added almost as much in net new revenue last year in international as you did in the States. So just want to talk more about what you're seeing in the U.S. market in particular and what you're hearing from customers. Thanks.

Corey Thomas (CEO)

You know, there are two things. One, customers are still under lots of budget pressures. So I just want to be clear that, like, that has not gone away. Customers are trying to figure out how to address security and frankly, how to do it in a tighter budget envelope overall. But we see most customers trying to really address security, and they're trying to address the budget envelope overall. That hasn't changed. What they're focusing on is the most critical security problems, and that's why we've had this urgency to really drive and make sure the problems that we solve are the most meaningful problems that we can possibly solve in the security stack. That's why you've seen us aggress so heavily in long-term product service and technology.

Because that's the moment to do it so that we're actually doing a more important job for customers overall. But most customers are struggling with this, "How do I actually make sure that I'm addressing my business budget needs, while also making sure I'm securing our business?" That's not going away. We see that in North America, too, just like most security companies.

Speaker 17

Very helpful. Thank you.

Corey Thomas (CEO)

Thank you.

Operator (participant)

Thank you. Our next question comes from the line of Brad Reback from Stifel. The line's open.

Brad Reback (Managing Director)

Great. Thanks very much. Corey, as we look out to next year, can you envision a scenario where total customer count is actually down?

Corey Thomas (CEO)

Look, in this world, you can never say never. I would just say that our strategy right now is to focus on quality of customers. I think that, like, if you look at our strategic platform customers, if you look at what we're doing with the Command platform, I have high confidence that the Command platform customers will be up. I have high confidence that the strategic customers will be up. I would just say we're less concerned about some of the historical transactional business, and that creates noise. And so, you know, on the overall customer count, who knows? But I'll just say on the things that actually matter, we have very high confidence that that'll continue to improve, and we're expecting to see healthy transition and healthy adoption of our overall Command platform.

Timothy Adams (CFO)

Yeah, and the platform customers, Corey, as we mentioned earlier, continue to grow sequentially and-

Corey Thomas (CEO)

It has, absolutely.

Timothy Adams (CFO)

Yeah.

Corey Thomas (CEO)

But that's why I said on the total customer count, it's just that there's some things that we're managing and some things that we're not. I think one of the things that, you know, us and the team were talking about is just how to provide, over time, more consistent transparency to the things that matter. But I would just say on the things that matter, we feel very good about our ability to grow that customer segment.

Brad Reback (Managing Director)

That's great. Just one follow-up on that. Any reason you wouldn't start providing the absolute platform customer count going forward?

Corey Thomas (CEO)

Yeah. So right now, our team's looking... You know, every year we go through the cycle of looking at, like, what's the right thing to provide. I know that among a bunch of other things are in consideration about what we actually share and provide going forward. They look, our goal is to provide the most meaningful insight to our investors. And I know that Elizabeth and the team are working through that right now. So I can't make any commitments now, but they work through that every year, and I know they're looking to do it again now as we get ready to enter next year.

Brad Reback (Managing Director)

Perfect. Thanks very much.

Corey Thomas (CEO)

Thank you.

Operator (participant)

Thank you. Our next question comes from the line of Schneider from Baird. Line is open.

Zach Schneider (Equity Research Analyst)

Hi, this is Zach Schneider on for Schneider at Baird. Thanks for taking the question. I just wanted to ask about upselling to existing customers and specifically how you plan on sustaining its momentum in the face of budget constraints and elongated sales cycles. If you could talk to any specific initiatives that are being implemented to enhance customer engagement and drive higher upsells, and additionally, how you're addressing customer concerns regarding pricing and ROI. Thanks.

Corey Thomas (CEO)

Yeah. So look, absolutely. Look, we have what I think of as a very high ROI story. We solve a big problem. I would just say relatively modest and reasonable incremental spending cost. And we think that that formulation has the impact of making it easier for customers to say yes, making it easier to actually secure existing renewals, because we're providing a lot of incremental value to customers, for what's a relatively modest incremental price point. And so we're taking that out to all of our customers. Again, the initial feedback has been good, but we're in the early stages of taking that strategy out to customers. We're doing it across all of our sales teams.

And I think we're set up well for success there, but again, we want to make it really, really compelling, and that's why we did not pick, like others, a purely monetization strategy, which is about the company. We picked, how do we solve the biggest possible customer problem, at the most reasonable economics? And we think that's a strategy that's gonna be attractive.

Zach Schneider (Equity Research Analyst)

Great. Thank you.

Corey Thomas (CEO)

Thank you.

Operator (participant)

Thank you. Our next question comes from the line of Trevor Rambo of BTIG. The line's open.

Trevor Rambo (Software Equity Research Associate)

Hi, this is Trevor on for Gray Powell. Thanks for taking my question, and congrats on some nice results. So maybe dovetailing off a question before, but what needs to happen for ARR growth to improve back to double digits over the next year or so, in terms of growth? What levers do you guys have at your disposal to get there? Is that something more of Exposure Command gaining traction? And when should we think about that becoming a possibility at this point?

Corey Thomas (CEO)

Yeah, so look, we clearly are focused... While it's too early to comment specifically next year, I will comment on the levers, 'cause that's a very reasonable question there. Look, the levers we have is, one, we have latent demand in detection response, that we just have to actually—our team's doing some work to expand the offerings and the coverage. So customers are asking us for stuff, and we just have to expand our offerings. It's not rocket science there, but our team is working through that, and we think that allows us to address more of the overall detection response market as we actually go forward. The one that we've actually talked about is the Command Platform Exposure Command.

We actually think that allows us to actually really participate in the higher value stack, similar to the cloud, similar to the attack surface management, where customers are actually spending money versus traditional vulnerability management, which just isn't as big a budget priority. So now we're actually playing in the area where customers actually have priority, and they're looking to spend money, and we're providing a good overall value proposition. And then in addition to that, we actually have a couple of add-ons that we're introducing in the install base. Now, all of that has to tee up with the continued investments that we're actually making in the partner ecosystem, that actually drive scale, and the rationalization that we're actually doing around the alignment across the business.

But if you look at that right product strategy around detection response, which we're expanding that business, you're gonna hear more about that later. The Exposure Command, which allows us to be more strategic in the risk and visibility space, we're executing that. We have good momentum there. Partner, continuing to make investments, and frankly, we're gonna be accelerating those investments over time. We're seeing good traction there. And then we're really focused on equip and enable our team. We have a good tenure team there, and I think that they're set up well. Those are the things that can actually drive traction as we actually go into next year. It's early, but we're actually seeing this set up good.

But we have to actually, first and foremost, we have to start by continuing to actually leverage the healthy pipeline trends that we actually saw, where it stabilized and upticked in Q2, and we have to actually really accelerate that and build that. But those are the things that actually drive as we go forward.

Trevor Rambo (Software Equity Research Associate)

Great. Thank you.

Corey Thomas (CEO)

Thank you.

Operator (participant)

Thank you. Our last question comes from the line of Rudy Kessinger of D.A. Davidson. The line is open.

Rudy Kessinger (Senior Equity Research Analyst)

Hey, thanks for squeezing me in, guys. I want to come back to just some slides, net new ARR in the second half. I mean, it's four times as much net new ARR, basically, and five in the second half versus the first half, the midpoint of your ARR outlook. And I know you've given a few comments, marketplace pipeline up 15%. You know, they get 4x the net new ARR. So just, can you give some commentary on the overall pipeline for the second half relative to the first half? Is there any other assumptions in the outlook, such as maybe improved gross retention that might be helping drive some of the sequential improvements here, or just any other color you could provide would be very helpful.

Corey Thomas (CEO)

Yeah, two quick things. One, it's primarily a Q1 dynamic, not the linearity x and Q2. I would just point out that you talk about 4x in the second half, it was 7x in Q2. And so when you have the Q1 that we actually had, the numbers don't make any sense. You know, you couldn't have actually said 7x in Q2 was gonna make it, or 8x in Q2 was gonna make any sense either. And so really, it's the traction and the, it's the rate of improvement, and we're back on a healthy rate of improvement. So yes, Q1 was bad, but I think we actually normalized and stabilized things in Q2, and we're set up well.

And then to get to your core question, which is actually really good, is that we didn't leave the guidance range the same just to leave it the same. We actually took a very detailed look at our pipeline, and we believe that from the pipeline and the data and everything that we actually see today, that we're gonna be in the guidance range that we actually indicated. But those are the two considerations that I'll just share. Thanks for the question.

Rudy Kessinger (Senior Equity Research Analyst)

Yeah. Okay. and then just as a quick follow-up, if I could just-

Corey Thomas (CEO)

Go ahead, please.

Rudy Kessinger (Senior Equity Research Analyst)

Just on the new logo side, yeah, I saw, you know, it flipped back to positive quarter over quarter. I guess just any comments on, you know, new logo bookings in Q2 relative to expectations?

Corey Thomas (CEO)

So I would just say it was within expectation. Look, Q2 was a quarter that we expected to normalize. We saw normalization. I would not say it was a home run quarter. I would just say that Q1 was a bad quarter. Q2, we expected to actually get back to business and normalize it. It normalized. We saw very healthy traction and normalized traction on the platform side. We gave the number about mid-single digits. We saw the us getting back to positive net overall customer growth, and that's kind of where we expect it to be in a healthy, normalized environment and the setup. So we actually, it was what we expected, and what we needed to do to actually set up for us to be where we want to be as we actually exit the year.

The primary thing that I'm focused on right now is, of course, the introducing the product to our customers, the new products to our customers, and building pipeline, not just for the back half of the year, but as we go forward. All right. Thank you very much. And operator, were there any other questions?

Operator (participant)

There are no more questions.

Corey Thomas (CEO)

All right. With that, I wanna thank everyone. I know that there's lots of stuff going on, but I really appreciate the questions and the support. I think we're in an exciting time. We've been executing our product strategy, we're taking that out to our customers, and we've been intentionally focused on investments that are gonna set us up for the next several years, not the past three years. So I appreciate everyone's time and attention. Thank you all. Thank you.

Operator (participant)

Ladies and gentlemen, that concludes today's conference call. Thank you all for joining. You may now disconnect.