Rapid7 - Q3 2024

Transcript

Joe Gallo (SVP)

As a reminder, this conference is being recorded. At this time, I would like to turn the conference over to Elizabeth Chwalk, Senior Director of Investor Relations. Please go ahead.

Elizabeth Chwalk (Senior Director of Investor Relations)

Thank you, Operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's third quarter 2024 financial and operating results, in addition to our financial outlook for the fourth quarter and full fiscal year 2024. With me on the call today are Corey Thomas, our CEO, and Tim Adams, our CFO. We've distributed our earnings press release over the wire, and it is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast, and following the call, an audio replay will be available at investors.rapid7.com. During this call, we may make statements related to our business that are considered forward-looking under federal securities laws.

These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to the company's positioning, strategy, business plans, investments, growth drivers, financial guidance for the fourth quarter and full year 2024, and the assumptions underlying such goals and guidance, and our expectations regarding 2025. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the future results expressed or implied in these statements due to a number of risks and uncertainties, including those contained in our most recent quarterly report on Form 10-Q filed on August 7, 2024, and our most recent annual report on Form 10-K on February 26, 2024, and in the subsequent reports that we file with the SEC.

The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by applicable law. Our commentary today will primarily be in non-GAAP terms, and reconciliations between our historical GAAP and non-GAAP results can be found in today's earnings press release and on our website at investors.rapid7.com.

At times, in our prepared comments or in responses to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be one-time in nature, and we may or may not update these metrics in the future. With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey.

Corey Thomas (CEO)

Thank you, Elizabeth, and welcome to everyone joining us on the call today. Rapid7 ended the third quarter of 2024 with $823 million in ARR while delivering revenue and operating income above our guided ranges. Our threat detection and response business, which remains an area of strength and durable double-digit growth, continues to drive the majority of our growth in the third quarter, as our robust capabilities, deep expertise, and investment innovation continue to support a proven world-class detection and response experience for our customers. There is positive momentum across our business, and this is a key pillar that underpins our compelling opportunity to re-accelerate growth. Our Q3 ARR results also reflect customer budgets that remain in flux, especially around the time of the spin. We saw deal cycles continue to elongate with additional levels of approval for the release of budget dollars, particularly for larger deals in North America.

These longer deal cycles remain broad-based across mid-market and large enterprise customers. This change put modest pressure on new ARR in the third quarter, driving the ARR results slightly below our expectations. We have extrapolated these dynamics into the fourth quarter, and coupled with the growing mix of large deals that we expect towards the end of the year, we're lowering our 2024 ARR outlook to a range of $835-$845 million. Now, I'd like to give a broader overview of where our business is and the great progress we've made this year on product and service experience for our customers. Vendor consolidation continues to be a strong secular theme across software, especially in security operations, where the market remains fragmented. Our consolidated offerings are addressing this market-wide customer pain point as security teams look for better outcomes and stronger value propositions.

We continue to see strong demand for our consolidated offerings across both threat detection and risk management, which together have scaled to make up over $175 million of ARR. Additionally, the average ARR per customer for customers who own one of our consolidated offerings is roughly $150,000, highlighting the meaningful revenue opportunity for both new and existing customers that expand across our broader SecOps platform. Exposure Command, our recently launched consolidated risk management solution, has also shown encouraging early progress. We introduced the Command Platform at Black Hat Conference in early August, and with less than two months in the market, we have generated over 70% more pipeline for the overall risk management business compared to the second quarter of this year.

When I refer to the risk management business, that includes our full suite of cloud security, vulnerability management, and attack surface management solutions, including Exposure Command, that help customers manage and prioritize risk across their attack surface. As expected, Exposure Command is gaining steady traction as customers seek to improve visibility across their attack surface while consolidating on an integrated platform at a compelling price point. Over time, we expect the average ARR from risk management customers to grow, driven by product expansion within the category, as well as expanding scope of coverage of their environment. As an example of the early success we're seeing in Exposure Command is a six-figure ARR deal that we closed during the quarter, with a technology company looking to track all of their cloud assets in a centralized, automated way.

Rapid7 won against three well-known cloud security players based on our proven use cases, added business context, for the customer's attack surface, and the ease of use of the Command Platform's user experience. Rapid7 was able to offer the customer multi-cloud data in one place, and the single source of truth is critical in removing constant manual workload for an under-resourced security team. We started 2024 with a clear set of priorities and three primary focus areas: innovating to deliver world-class detection and response experience to our customers, expanding our partner ecosystem for scale and efficient demand generation, and accelerating cloud security adoption. We knew this would be a product investment year for us and an opportunity to establish leadership in future growth markets for security operations.

We made the decision to prioritize our investments in customers' product and service experience while being more measured on investments in sales and marketing. As we near the end of the year, I am pleased with what we accomplished in these areas. The work we have done this year provides a critical foundation to our success, and we continue to believe these investments will position us for better long-term and durable growth. First, our detection and response business continues to drive healthy momentum, particularly for customers looking to extend their SecOps capabilities with our managed services. Our commitment to driving innovation within InsightIDR is creating a stronger value proposition for our customers who increasingly need a centralized, actionable view of their environment.

There are a number of specific reasons that security teams are choosing Rapid7: to better pinpoint threats driven by our embedded and expanded detection library, which provides relevant and timely insights from Rapid7 Security Operations Center, open-source community, and threat intelligence teams, for better ability to scale and reduce manual tasks with embedded automation and AI for SOC efficiency, particularly during the alert lifecycle, and for the ease of use of our integrated platform with growing coverage and ability to ingest and analyze third-party security data. Additionally, the breadth and depth of the Rapid7 platform continues to be a competitive differentiator in a market that is still quite fragmented.

Our leadership in the space was validated by recent vendor assessments by IDC, which positioned Rapid7's InsightIDR solution as a market leader in SIEM solutions for both SMB and enterprise. Security teams of all sizes are leveraging our core SIEM capabilities as part of our broader detection and response platform to gain a comprehensive and contextualized view of threats across their environment. The second major area of focus for this year has been on expanding our partner ecosystem for scale and efficient demand generation. We've made substantial progress, and there is still a long runway of opportunity here.

In the third quarter, 90% of new ARR bookings were sold through our partner ecosystem. This achievement marks a significant milestone and underscores our dedication to collaborating with our partner community, aligning with purchasing channels many customers already use to source their security solutions. As we remain committed to advancing our partner programs and experience, this quarter, we introduced the Rapid7 Partner Academy, which equips our partners with technical expertise around the Command Platform.

This program is designed to educate our partners quickly as we innovate and is particularly beneficial as we've recently delivered a series of important launches. We're also enhancing the partner experience through the recent launch of our channel partner portal, which supports streamlined engagement and a smoother sales process. Overall, the progress in this area demonstrates our dedication to seamless interaction, collaboration, and business growth for our Rapid7 partners. Lastly, our push to accelerate cloud security adoption is well underway. Our strategy is resonating strongly with customers by bringing cloud security capabilities into a broader platform that provides customers a high-quality integrated view of their broader attack surface. The launch of our Command Platform, including Exposure Command, has been extremely well received. As I mentioned earlier, we increased our quarterly pipeline creation by over 70% on a sequential basis for risk visibility and exposure management.

The positive early feedback we're hearing from the market is concentrated around a few major themes. The Command workflows and user experience stand out from the current market offerings, particularly by our ability to aggregate a diverse range of third-party security data into a single source of truth. This integrated platform experience for cost-effective management of an organization's attack surface is a clear differentiator for Rapid7. Second, customers like our improved cloud risk prioritization and visualization tools, which allow them to assess risk in the context of prevention gaps, including allowing security teams to monitor toxic combinations, provide guardrails for secure AI development, and view executive-level risk reporting. And thirdly, many customers lack a firm grasp of the assets across their hybrid IT environments, with Gartner estimating that less than 20% of organizations can clearly identify and inventory a majority of their assets.

Our integrated asset discovery capabilities bring crucial visibility for attack surface management and speak to a common pain point for customers of all sizes. Additionally, our MSSP partners, which have historically been focused mainly on detection and response, have shown strong interest in our new exposure management offerings. Though we had a slow start to 2024, we've since taken the right steps to focus on our strategic priorities. I am proud of how our team has executed over the last six months to improve the foundational aspects of our business, and we see clear signs of progress and momentum, particularly around the Command Platform. As we look out to the next year, there are plenty of promising indicators on the horizon.

The investments and focus areas of this year have made a meaningful impact in our ability to go to customers with the best possible security operations platform, and we are already seeing tangible proof points of this traction. We expect to start 2025 with a stronger pipeline than last year based on how demand generation is currently trending, and we continue to believe that our risk visibility and exposure management offerings will be meaningful long-term drivers of growth for us. We also have more work to do to successfully convert positive customer feedback and early pipeline traction for the Command Platform into material contributor of new ARR. As we look ahead to the next year, we're taking a measured approach with respect to both the timing of when that contribution materializes and when we will see customer budget stability and consistent deal cycle timing.

While we expect to provide formal guidance on our February earnings call, our early expectation for 2025 is that our total ARR growth rate for the year should show flat to mild acceleration in growth from our 2024 exit growth rate of ARR. That view assumes continued longer deal cycles, particularly for large deals in managed detection and response and relatively stable demand environment. The strong fundamentals of our business are intact, and we are creating a broad-based platform of integrated security operations solutions that will have long-term product relevance in a dynamic market environment.

In the meantime, we plan to continue making shifts in our business model amidst slower near-term growth by evolving our products to be leaders in their specific categories, by evolving our pricing model to align to customers' priorities and budget capacity in these areas, and by remaining focused on scaling free cash flow across our business. Thank you for joining us on the call today. I'll now turn the call over to our CFO, Tim Adams, to share additional detail on our financial results and outlook. Tim.

Tim Adams (CFO)

Thank you, Corey, and good afternoon to everyone on today's call. Thank you for taking time to join us today. Before I turn to our results, a quick reminder that except for revenue, all financial results we will discuss today are Non-GAAP financial measures unless otherwise stated. Additionally, reconciliations between our GAAP and our Non-GAAP results can be found in our earnings press release. Rapid7 ended the third quarter of 2024 with $823 million in ARR, representing 6% growth over the prior year. This ARR result reflects the continued strength in our detection and response business, as well as elongated deal cycles, particularly for large deals in North America. ARR growth in the third quarter was weighted towards sales expansion as ARR per customer grew 4% over the prior year to $71,000, and our total customer base grew 2% year-over-year to end the quarter with over 11,600 customers.

Third quarter revenue of $215 million grew 8% over the prior year and exceeded our guided range. Recurring product subscription revenue grew 8% over the prior year to $206 million, which was better than expected on favorable linearity in the quarter. Our revenue mix continues to shift towards international, which grew 17% year-over-year and now represents nearly a quarter of total revenue. Turning to our operating and profitability measures for the third quarter, product gross margin was 76% in the quarter and total gross margin was 74%, both of which are in line with the prior year. Sales and marketing expense was 31% of revenue, down from 34% in the prior year. R&D and G&A expenses were in line with the prior year and made up 16% and 6% of revenue, respectively.

Third quarter operating income of $44 million was above our guided range and represented a roughly 21% operating margin. The outperformance was driven by higher-than-expected revenue and the timing benefit of a few million dollars in professional services and marketing spend, which we expect to incur in the fourth quarter. Adjusted EBITDA was $50 million in the quarter, and net income per diluted share was $0.66. Moving to our balance sheet and cash flow, we ended the third quarter with cash, cash equivalents, and investments of over $500 million, slightly above the $494 million at the end of the second quarter. We continue to ramp up our free cash flow generation with $39 million in the quarter, up from $29 million we reported last quarter. This brings us to our outlook for the rest of the year.

We now expect full-year ending ARR to be in the range of $835 million to $845 million, which represents growth of 4%-5% over the prior year. We have adjusted our outlook for the remainder of the year based on the elongated sales cycles we saw in the third quarter and have carried forth our assumption that these customer budget dynamics will continue through the rest of the year. For full-year revenue, we are raising and narrowing our range to $839 million to $841 million, representing growth of 8%. This increase from our prior guidance of $833 million to $837 million reflects revenue outperformance in the third quarter. On profitability, we are raising and narrowing our full-year operating income range to $157 million to $159 million from our prior guidance of $152 million to $156 million.

Our updated range represents an implied operating margin of 19%, growing over 550 basis points from the full year 2023. We expect full-year net income per share to be in the range of $2.28-$2.31 based on an estimated 74.7 million diluted weighted average shares outstanding. For free cash flow, we are updating our full-year expectation to a range of $145 to $155 million based on our updated ARR range. We remain strongly committed to expanding profitability. Moving to quarterly guidance, for the fourth quarter of 2024, we expect total revenue in the range of $211 to $213 million, representing growth of 3%-4% over the prior year.

Non-GAAP operating income for the fourth quarter is expected to be in the range of $33 to $35 million, reflecting an implied operating margin of 16%. We expect non-GAAP net income per share of $0.48 to $0.51, which is based on 75.7 million diluted weighted average shares outstanding. I would like to thank our team for the great work they have accomplished so far this year, especially on the foundational improvements across our detection and response business, our partner ecosystem, and our push to drive cloud security adoption.

The early traction for Exposure Command is encouraging, particularly as it relates to the pipeline growth we saw in our risk visibility business during the third quarter. As always, we remain focused on balancing these growth initiatives with profitability improvements in what continues to be a dynamic market environment. With that, we will now open the call for questions. Operator. Our leadership in the space was validated by recent vendor assessments by IDC, which positioned Rapid7's InsightIDR solution as a market leader in SIEM solutions for both SMB and enterprise.

Elizabeth Chwalk (Senior Director of Investor Relations)

Thank you.

Joe Gallo (SVP)

Sorry about that. And just as a reminder for Q&A, if you'd like to ask a question, simply press star, followed by the number one. Our first question comes from Fatima Boolani from Citi. Please go ahead.

Saket Kalia (Senior Equity Research Analyst)

Oh, good afternoon. Thank you for taking my questions. Corey, you talked at length about some of the external dynamics that are contributing to, you know, improved customer feedback and receptivity to the launch of the Command portfolio and then just general, you know, strong feedback. But I wanted to reconcile that with, you know, the results and some of what you're baking into the guidance, right? And specifically, I wanted to ask you on internal dynamics, you now have had a full quarter of that organizational streamlining that you undertook in terms of the organizational structure. So can you give us a sense of what some of the proof points of success are there and why maybe that's not moving the needle and overcompensating or at least counterbalancing some of these external dynamics on sales cycle elongation? Thank you.

Corey Thomas (CEO)

Yeah, thanks for the question, so look, there's two focus areas internally that we actually had. One of them was just to make sure we had rigorous processes so that we can actually forecast and deliver consistently and well. The second one was making sure we executed our launch of the Command Platform and Exposure Command. As you know, we've been relying on this year on this single sort of like focus around D&R, which has performed very, very well. But at the same time, we needed to actually launch our updated strategy for the risk management business with our integrated risk strategy, so the launch of that has been a primary focus area, and I would just say the execution's gone well there. If you zoom out and you say, like, all right, how does that translate into results?

It's that we built back up the pipeline, frankly, exceeded the targets that we actually wanted to see. But most of our pipeline for this year, we told you that the core thesis was going to be around the D&R business, of which we have substantial pipe, but there are larger deals. I think this is maybe the first time in our history where we've had over half of our pipeline deals with people that are over the $100,000 mark. And so with the elongation of the sales cycle, a higher mix of larger deals. And what we saw both in Q2 and Q3 is our primary focus was making sure that we were actually being thoughtful about what sales cycles were for the pipe and then, you know, sharing that information with you all. I think I got all of your questions and everything. Thank you.

Saket Kalia (Senior Equity Research Analyst)

Yeah, and just some of the.

Joe Gallo (SVP)

Our next question comes from Saket Kalia from Barclays. Please go ahead.

Saket Kalia (Senior Equity Research Analyst)

Awesome. Hey, guys, it's back, and thanks for taking my questions here, Corey and Tim.

Corey Thomas (CEO)

Thank you very much.

Saket Kalia (Senior Equity Research Analyst)

Hey, guys. Corey, maybe just to start with you. You know, when you prepared remarks, you talked about higher ARR per customer for those that buy bundled or rather consolidated offerings. Could you just dig into that a little bit? I think you mentioned the $150,000 number. I'd love to just dig into that a little bit. And maybe more broadly, can you just talk about what percentage of the base is sort of on that kind of consolidated type of offering?

Corey Thomas (CEO)

Yeah, it's roughly, you know, 150K, as I said in prepared remarks. It is frankly led by D&R. So if you think about so far, like lots of the consolidation strategy has been led by the detection and response business. It's an area where we actually have robust pipe now if you look at D&R and now with Exposure Command, which is frankly a much better consolidation story from risk than what we had previously.

And we've taken lots of the process and learnings that we actually have from last year. That said, we still think we have a significant amount to actually go in our base. I would say of our base, I would say a little over 10% or so of our base is on one of the consolidated offerings. We're having steady adoption, steady uptake in pipeline, but those deals are also larger in orientation and therefore have longer deal cycles.

Saket Kalia (Senior Equity Research Analyst)

Got it. Got it. That makes sense. Maybe for my follow-up for you, Tim, appreciate the early look at 2025. I think that's prudent. Maybe the question is, how do you think about the mix of sort of customer growth versus that ARR per customer dynamic, even qualitatively, as you think about that preliminary outlook?

Tim Adams (CFO)

Yeah, Saket, thanks for the question. Look, I think we have the opportunity on both fronts to continue to grow. We have over 11,000 customers today. We think that market opportunity is roughly 70,000. So there's always room to expand with new logos. And to Corey's earlier point, when you look at the strength that we're seeing in the consolidation offers, they do come in at a higher ARR per the average of around 71,000 that we see on customers.

So by selling into the packages, certainly the strength of MDR being larger deals gives us opportunity to do the expansion. And even to Corey's earlier point on Exposure Command, if you think of that as a great way to land with new customers, and then you have that upsell, cross-sell opportunity with MDR with those customers. So I think you can see it from both new customer acquisition and expansion of customers as well.

Saket Kalia (Senior Equity Research Analyst)

Super helpful. Thanks, guys.

Corey Thomas (CEO)

Thank you.

Joe Gallo (SVP)

Real quick, just to make sure we get to everyone in the queue, we do ask that you limit yourself to one question at this time. Our next question comes from Matt Hedberg from RBC. Please go ahead.

Saket Kalia (Senior Equity Research Analyst)

All right. Thanks, guys, for taking my question. Maybe I'll just double-click on the guidance portion as well. You know, it seems like you're taking a conservative initial approach to the framework of what seems like maybe kind of mid-singles to maybe slightly better growth next year. I'm curious, Corey, you know, are there things that you can do from a go-to-market perspective, you know, that could combat elongated deal cycles? Like one thing, it certainly seems like you're getting a lot of channel momentum. I'm kind of curious as you think about company-specific things that could combat some of these macro pressures. I'd be curious on kind of how you think about that.

Corey Thomas (CEO)

Yeah, I mean, look, the primary thing that we're actually focused on is we like the dynamics that we have both on the consolidation offers and the D&R traction. They are larger deals. I would just say customers have their own specific budget dynamic, their budget dynamic. So we want to keep the good. What we want to add to that is I would just say more velocity business, as we actually term it, which is you can think about that more sort of like upgrades, upsell motions in the install base. I think that's the upside. We do have that. I mean, that's the thing that Exposure Command has.

We start to see that in the pipeline, but it's definitely premature to actually sort of like take pipeline and actually predict conversion rates and how much of that flows through. So I just think it's just too early, but that is our strategy for actually keeping the good stuff where we have the larger deals, increasing share of wallet, healthy dynamics higher in the stack, but adding in a mix of velocity deals that are at lower ASPs and frankly balance out some of the large deal momentum that we actually have.

Saket Kalia (Senior Equity Research Analyst)

Thanks, Corey.

Joe Gallo (SVP)

Our next question comes from Joe Gallo from Jefferies. Please go ahead.

Hey, guys. Appreciate the question and appreciate the deal cycle elongation commentary. Is that broad-based or are there some areas of the platform that are most impacted? I know you don't give updated mixes, but just any sense of the growth rates for the different segments? And then maybe on the reverse, like the gross retention side, was there any impact on the core Vulnerability Management or have gross retention rates stayed stable? Thank you.

Corey Thomas (CEO)

Okay. That was a lot, so I'm trying to make sure I got all of it, so on the deal cycle elongation, I think it's primarily large deals. I would say it's less product-based, but deal-size-based. Look, when you become a material part of someone's budget in this budget environment, we're just seeing customers sort of like there's a gap now between sort of like you're recommended and then a customer says they're going to go with you and how long it takes them to actually figure out like when the budget dollars are going to land. So that's kind of how I would describe it, and we are, like I would just say, being cautious and thoughtful about like our expectations for the year and just keeping consistent with what we've seen overall.

As you can imagine, it's still primarily that. That's just because, you know, the Exposure Command pipe is actually new. You know, we would expect the same six-month deal cycle. It starts early in that cycle. That is more D&R-weighted. You ask sort of like what's happening. The growth rates in D&R continue to be strong. We expect them to stay strong as we actually go forward. Then the last one is the gross retention rates. I think we had. I think that's probably in relationship. Earlier in the year, we had highlighted that we were seeing some gross retention pressures. Those feel like those are actually in the process of bottoming out. I would just say the early indicators that we're seeing around those are actually quite positive.

Now, part of that is that customers are seeing what we're doing around the Exposure Command, that are the VM customers, and they do like the strategy. And so we're starting to see early confirmations around that. But I would just say that we think on net, the gross retention trends are positive to up. We feel good about those as we go forward. I think I got all the questions.

Joe Gallo (SVP)

You did. That was really helpful. Thank you.

Corey Thomas (CEO)

Thank you.

Joe Gallo (SVP)

Our next question comes from the line of Hamza Fodderwala from Morgan Stanley. Please go ahead.

Hamza Fodderwala (Executive Director)

Good evening. Thank you for taking my question, Corey or Tim. Just, you know, there's been a lot of improvement in the profitability side in the last few years. You're close to 20% free cash flow margin. Obviously, you want to accelerate your growth for 2025. I know we're not providing the full formal guidance, but as you think about that balance between growth and profitability, should we expect to see additional leverage going forward, or is the focus going to be more around investing more for growth? Thank you.

Corey Thomas (CEO)

Yeah, look, the clear focus we actually have right now, if you think about it, we started, you know, last year, we shifted to driving consolidation. I would just say we did good in one part of the business, the threat detection part of the business. We felt like we did not, we felt we had room to improve on the overall risk side of the business. This year, we invested in the products and the offering around risk while continuing to expand profitability. We've actually built pipeline. We're seeing the early indicators. We feel like the setup next year is focused on the growth rate acceleration. So that's the core focus of the business as we actually go forward next year.

We think that it's a good time to do it because we actually have the products, you know, the product setup well, the feedback from customers and the sales team. We're not out over our skis in terms of the expectations, just because, you know, right now, early indicators are good, but they're still early indicators. So, you know, my expectation is that, like, you know, we're happy with the profit dollar range that we're in. We certainly expect to see more Free Cash Flow dollars as we actually go forward. But the real focus that we actually have is re-accelerating growth off the product base that we actually have today.

Saket Kalia (Senior Equity Research Analyst)

Thank you.

Joe Gallo (SVP)

Our next question comes from the line of Rob Owens from Piper Sandler. Please go ahead.

Rob Owens (Managing Director)

Great. Thanks for taking my question. Corey, in prepared remarks, you did talk about shifts in the business model and particularly on pricing, and in the Q&A, you did talk about increasing velocity business. Does it speak to that, or is there something else afoot if you can maybe elaborate? Thanks.

Tim Adams (CFO)

Yeah, I think they're interrelated. You know, when we look out at our customer base, we've done a really good job, again, tied to the threat detection business of actually sort of like just actually, I would just say executing, I would say, on larger deals, larger business, becoming more strategic to our customers. That's evidenced by the business that we have there. The thing that we actually have not done a good job of is how do we actually get the 20%-30% upgrades and uplifts in the install base? You know, in the old days, we used to get a little bit of that from the people adding more VM assets overall. But we didn't get, we did not get enough of that share originally as people moved to the cloud.

Now, part of what we actually found there was that, you know, the cloud pricing was high. We went and looked at our installed base. Lots of our customers just don't have any solution at all. And so what we flipped around there is said, how do we actually monetize, I would just say, share of wallet and risk management in the installed base with a more integrated value proposition that's centered around the attack surface source of truth from the endpoint to the on-prem to the cloud environment, and how do we monetize and upgrade the installed base? And so that's the strategy there, Rob, is sort of like making sure that we actually don't become just a business that does large D&R deals from a sales focus and from an offering focus. Again, that's not our sales team. That's more of our offering strategy.

I feel like we really nailed it. I mean, so far the feedback very early, but we've nailed that with Exposure Command, where it's the first time we've had an upgrade to our VM installed base customers. It also makes the customer stickier because they like the strategy that we're actually doing. It also allows us to actually add more assets for a customer from a cloud perspective. and it's a stickier solution than vulnerability management.

You know, VM was about scan and report or collect data and report. and this is about sort of like collect data, but integrate data and become the attack surface source of truth in the environment. and when you are a system of record in the environment, it's just a much better, much stickier value proposition. So, Rob, that's more what we're talking about is how do we actually sort of like have more offerings that are not just the bigger ASP will be executed well. Again, this is the first time I think half of our pipeline is over 100K deals. And that's okay, but we really do want to keep a lot of that velocity business.

Saket Kalia (Senior Equity Research Analyst)

Great. Thank you, Tim Adams.

Tim Adams (CFO)

Thanks.

Joe Gallo (SVP)

Our next question comes from the line of Gray Powell from BTIG. Please go ahead.

Gray Powell (Managing Director)

Great. Thanks for taking the question. I just want to make sure I understood some of the commentary correctly. So when you say the pipeline for risk visibility and exposure is up 70% from Q2, can you help us think through like what the base of comparison is there? For example, like is it 70% growth off of a small number, or is risk visibility and exposure a more meaningful part of the pipeline at the end of the quarter? Yeah, just any additional detail there would be really helpful.

Corey Thomas (CEO)

Yeah, thanks for the question because it does help clarify. So, too, as you recall this year, as we were retooling and upgrading our strategy around risk management to move from the CRC approach, so really, I would say an integrated product platform approach, we stopped selling and building pipe on that. So like, you know, you could think about sort of like that really going down precipitously, sort of exiting last year and coming into this year, which put, I would just say, more pressure on growth than we probably anticipated overall. And so what that signifies is, one, is now we're actually raring back up that risk business overall. So while it's up quarter over quarter, most significantly, it's actually back sort of at the levels that it was sort of like in the middle of last year for the risk business.

Most importantly, the total pipeline has actually sort of like bottomed out its deceleration in Q2 and actually has steadily risen up, and that accelerated in Q3 as we actually move forward. What we've also seen is just overall pipeline generation improving. That's what we're really focused on. It's a contributor. By the way, it is the best contributor because D&R stayed within its ranges of expectations. We really had to recover that risk management pipeline generation, and we've actually seen that. Again, the early sort of like data and conversions are pretty good. I think I captured it.

Saket Kalia (Senior Equity Research Analyst)

Okay, that's really helpful, Corey.

Corey Thomas (CEO)

Thank you.

Joe Gallo (SVP)

Thank you. Our next question comes from the line of Gregg Moskowitz from Mizuho. Please go ahead.

Gregg Moskowitz (Managing Director)

Okay, thank you for taking the question. Hi, guys. This is maybe a bit of a high-level question, and you may have touched on this a little bit in response to Rob's, but you know, all of us on this call are, you know, as we're all aware, there are many security platforms out there, Corey, and to be fair, several of them are a lot bigger than Rapid7. You know, what gives you the confidence that Rapid7 can be one of the real longer-term winners as a security consolidator? Thank you.

Corey Thomas (CEO)

No, thanks. Look, I think that there's two approaches to if you're going to be a, one, I think you're right. Like if you're a niche player, it's going to be hard. And there's two approaches that you can actually have for consolidation. You can be a general consolidator, of which I think lots of the companies you talk to are general consolidators. They have lots of stuff across a wide breadth of overall security, and they're using the, you know, customer relationship to try to deliver. Or you can be a focus consolidator. And if you're a focus consolidator, what you're really saying is, we will be best in the world at this, and we will do it at better economics than anyone else. We're focused on being a focus consolidator. What we're best in the world at is security operations consolidator.

We collect more data from more systems than anyone else in the world. No one's actually processing data across the on-prem with the traditional vulnerability management technologies, the cloud technologies, the endpoint data collection, and oh, by the way, we process data from every other sort of like security delivery provider. No one processes more data, integrates more data to actually paint a picture of the attack surface, and then takes that data and then uses it to monitor the overall environment for attacks. Security operations is about, do you have the data to paint a picture of your attack surface, and then can you monitor that attack surface for attacks? We actually have been investing in this for longer than anyone.

We're still like the most comprehensive, even if you compare every single player on the market today, and we do it with better scale, better customer economics, and a better value proposition. That is still resonating with customers. And again, if you dig into it, what you see is in many ways, we've actually executed and continued to do better and go faster than the market in the hardest part of it, which is the going up market with the D&R stuff. We're just adding back on the risk piece, but we're adding it back on from a rebuilt risk engineering that's more about integration and the integrated attack surface than it is about the traditional vulnerability management approach. But, you know, that's the approach that we actually have that we think wins. It's a focus consolidation effort.

Gregg Moskowitz (Managing Director)

That's helpful. Thanks, Corey.

Joe Gallo (SVP)

Our next question comes from the line of Jonathan Ho from William Blair. Please go ahead.

Jonathan Ho (Research Analyst)

Hi, good afternoon. Just wanted to see if you could give us a little bit of additional color on what you're seeing in the MDR space and, you know, with your own managed offerings as an add-on, and, you know, just how meaningful could this be as you start to think about, you know, trying to expand wallet share, you know, within your own customer base? And just similar to that, if you could talk a little bit about, you know, what's happening on the InsightIDR side, you know, whether any of the consolidation that's been happening in this space is, you know, starting to show benefit there as well. Thank you.

Corey Thomas (CEO)

Yeah, it's, we are showing. Look, part of the D&R backdrop is driven by the detection response product and the MDR service. Look, from our benchmarks, we have one of the highest quality MDR services in the market. It's backstopped by incredibly strong retention rates compared to the overall market. We are one of the few product companies that actually built and continues to build an MDR as a product stack. So we're using our detection response product solution to actually build it out. We think that there's lots of opportunity there going forward. Our engineering team has been focused on how do we actually allow customers to not just monitor part of the environment. Like lots of the consolidators are still very narrowly focused on just their data. Our goal is for customers to monitor 100% of their environment and do that cost-effectively.

You have to be a product-driven company versus a services company that adds technology or a product company that actually has MDR as an ancillary feature of how you manage your own offerings. So our goal is to monitor and manage 100% of the attack surface. Our team's focus there. The benefit on your question for our SIEM or security analytics offering is that that gives our SIEM customers the most productive solution for actually managing detection response in the environment because our MDR analysts have to be productive, and we have to do it at scale and at quality.

And that's part of why that solution is so attractive to so many of those customers. Again, that strategy of designing it to actually be a scaled margin solution that monitors 100% of the environment, built as a product company, allows us to actually have a great MDR offering, but most importantly, that technology to be delivered to customers and partners, importantly, deliver great managed service business.

Joe Gallo (SVP)

Our next question comes from the line of Josh Tilton from Wolfe Research. Please go ahead.

Josh Tilton (EVP)

Hey, this is Patrick on for Josh. Thanks for taking my question. Can you talk about the competitive environment and sort of what you're seeing there right now and maybe any changes observed over the last year? And then within that, has there been any changes to your win rates over the first 11 months this year? And if so, what gives you confidence that you can at least stabilize those win rates or maybe improve them with a better pipeline in front of you? Thanks.

Tim Adams (CFO)

Yeah, it's good. So Josh, the win rates haven't changed materially. It's just the pipeline composition has changed, and it's become, again, for this year, we had more of a D&R-focused business. We're building back up the risk business with Exposure Command. So it's just too early. I mean, this is why we're not out over our skis and what the embedded model and conversion rate assumptions are. I think the win rates will be somewhat high because, like, you know, a significant, you know, half of that is just upgrades of the VM, sort of like customer base. And so that's a, you know, those tend to have different competitive deals. And by the way, those are also faster cycle deals to the question that was asked earlier.

So while it's early, we would expect that to overall be positive, and then we'll see how that fares in the head-to-head space. We did not pursue a lot of risk management and cloud opportunities leading into this year like we did at the start of last year when we were launching CRC. We really wanted to retool it for a better approach. So in the D&R, so we'll know more on the Exposure Command side, but it's actually early. But I'll just say, you know, it looks really good, but I don't want to overweight a small set of deals that actually happen to move along fast.

On detection response, we think we have a very, very competitive solution. We have high win rates. If we lose by far, it's because we are like walking away based on price or based on sort of like the extent of the customizations that we'll do because we're taking a product-based approach there. The good news there is that we actually have been aggressively extending what we monitor naturally, and we can actually do that at very, very good gross margins.

And so I would just say on that MDR space, we actually have a premium solution there that's actually well regarded, and we feel great about the competitive position overall there. I think I've actually hit it. So I don't think, look, I think the biggest issue this year is we had to re-accelerate pipeline on the risk side. It's not about, it's not that we were actually like generating pipe and losing. Our sales team was just waiting for us to actually redo our offering going forward. Thank you.

Joe Gallo (SVP)

Our next question comes from the line of Brian Essex from JPMorgan. Please go ahead.

Brian Essex (Executive Director)

Hi, good afternoon. Thank you for taking the question. Corey, I think you mentioned during your prepared remarks that about 90% of new ARRs is sold to the partner ecosystem. And I know previously you've talked about investing in channel relationships, MSSP partnerships, marketplaces. Could you maybe talk a little bit about the mix of what you're seeing through the partner ecosystem? Is it leading to more consultative sales? Is there anything about that partner mix that might also be contributing to these elongated sales cycles?

Tim Adams (CFO)

It's a good question. The answer is I don't think that's the primary contributor. Look, I think having looked at it and spent some time on some of these myself, it's mostly, it is, we are now one of the more, again, for the deals, look, our pipeline mix has actually just changed. We just have a lot of larger deals in pipe than probably we have at any point in our history. And customers actually have more scrutiny, you know, for $150,000, $200,000, $300,000 plus line item than they actually do for a $20,000, $30,000 line item. I mean, that's just the bottom line. So I think it's the deal size plus environment. I would not attribute that to our partners. I think our partners are doing a great job.

We've seen good momentum. They've been one of the contributors to our pipeline overall. And so, no, I think it's more environmental and, frankly, us not having enough offerings that are in that velocity space and actually really focusing our partners on our D&R business. I think that should change a little bit as, again, as we actually continue to grow the Exposure Command, which, again, should be a little bit more of a velocity business at a lower ASP.

Brian Essex (Executive Director)

Got it. Thank you.

Corey Thomas (CEO)

Thank you.

Our next question comes from the line of Joel Fishbein from Truist Securities. Please go ahead.

Joel Fishbein (Managing Director)

Thanks for taking the question. Corey, for you, just love to hear anything that's going on in the Fed business and how that tracked this quarter and what the pipeline looks like there? Thanks.

Corey Thomas (CEO)

Yeah, it's a good question. As you recall, we have a strategic Fed business. It's actually good, but we do much more in state and local. We have some really exciting. I would just say, Fed pipeline and launches coming, not launches, but like Fed true engagement coming up next year. And so I'll just say next year really starts our aggressive cycle in the U.S. federal government space where we have the certifications, we have the momentum. We've been working on lots of precursor work, but it's not a material factor right now for this quarter on a new growth basis. We have some very strategic brands and companies in the federal government space, but it's not a strategic, it's not a material factor for new business this quarter for this year.

Joel Fishbein (Managing Director)

Great. Thank you.

Corey Thomas (CEO)

Thank you.

Joe Gallo (SVP)

Our next question comes from the line of Shrenik Kothari from Robert W. Baird. Please go ahead.

Shrenik Kothari (Senior Research Analyst)

Hey, thanks for taking my question. So Corey, on the elongated deal cycle, some caution on customer budgets being more broad-based. You and Tim, you guys touched upon, of course, pricing and bundling and so on. Can you specify in terms of adjustments?

Corey Thomas (CEO)

Hey, Shrenik,

Shrenik Kothari (Senior Research Analyst)

you're breaking.

Corey Thomas (CEO)

Yeah, you're breaking up there. Could you repeat the question, please?

Shrenik Kothari (Senior Research Analyst)

Yeah, yeah. So I'm just trying to ask, just taking a leaf out of some other vendors, making any specific adjustments to go to market in terms of perhaps exploring flexible financing, some trial periods, other value-based selling techniques just to kind of employ them to alleviate customer hesitations in adopting the platform, just trying to understand how others might be doing as well?

Corey Thomas (CEO)

Yeah, it's a great point. So I would just say we are active in discussions around that right now. We're learning from others. It's not in the base plan that we actually gave you. We're trying to see the durability of how it impacts. But I would just say we are looking at sort of like how we actually think about just securing the business as we go forward. We're doing it, I would just say, strategically and targeted, but we don't actually have a broad-based program in place around some of those things. But I would just say our finance team and our sales teams are actively looking at that right now. Great question.

Joe Gallo (SVP)

Our next question comes from the line of Eric Heath from KeyBanc Capital Markets. Please go ahead.

Eric Heath (Equity Research Analyst)

Hey, Corey, Tim. Thanks for taking the question. I just wanted to come back to the SIEM market. Obviously, there's been a lot of M&A activity across both enterprise-focused and mid-market-focused vendors. And there's a lot of vendors out there circling the SIEM displacement opportunity. So just curious if you think you're getting shots on goal there. And I don't know if that's one of the other sources of why you're seeing longer deal cycles. So just any commentary there would be helpful.

Corey Thomas (CEO)

I mean, I think that, yeah, I think we're doing great at the shots on goal. I mean, like, and we're scoring lots of points too. I mean, the D&R business is actually proven stable and healthy. And so we feel very good about that overall. It's a competitive market, but I would say our competitive position is actually quite strong. And we're investing a lot in R&D there to actually continue to extend that strength and that leadership.

Eric Heath (Equity Research Analyst)

Yeah, Corey, the D&R business is very healthy. It's half of the ARR that we have, and the growth rate has been very exciting for us. So that remains very strong.

Corey Thomas (CEO)

Thank you.

Joe Gallo (SVP)

Our next question comes from the line of Patrick Colville from Scotiabank. Please go ahead.

Patrick Colville (Lead Equity Research Analyst)

Thank you so much for taking my questions, Patrick Colville from Scotiabank. Corey and Tim, I guess I just want to ask about the preliminary 2025 outlook. Did you say that we should use the 4Q exit ARR rate? If so, I calculate that to be 4% in 4Q. So we should use that to forecast 2025 ARR. And if I'm right in my math, I guess that guidance would suggest a kind of nice amelioration of demand trends. And so I guess, can you just talk us through the puts and takes as to how things are going to stabilize as we look into 2025? Thank you.

Corey Thomas (CEO)

Yeah, yeah. I'll give you the assumptions sort of like based here. So one, what we say is look at the exit rate and expect sort of like flat to mild acceleration. The core assumption around it, just to be clear, is, look, we don't love it, but we actually had to reset expectations a couple of times this year. And while we have extreme excitement, we expect the D&R business to stay stable because it is stable. It's actually very healthy. Exposure Command, we actually are saying it sort of continues to show the momentum and the retention rates that we actually see. But we are going to, we're taking a wait-and-see approach to see what the conversion rates are on that. And we're not baking that into any base assumptions.

We'd update you on that as we actually see it. But Insight launch later in Q3, we've been thrilled and exceeded expectations so far, but we want to get through its full deal cycles versus just taking a random estimate and actually plugging it to the model. So that's just the logic behind sort of like where we are. But of course, we'll actually update sort of as soon as we actually have clarity of like, does that momentum that we actually see carry through in the same deal cycles with the ASPs that we're expecting?

Tim Adams (CFO)

Yeah. Corey, and we just, you know, we talked about Q3 and Q4 and elongated deal cycles, larger deals. We assume that going into next year.

Patrick Colville (Lead Equity Research Analyst)

Very clear.

Corey Thomas (CEO)

Thank you very much.

Joe Gallo (SVP)

Our next question comes from the line of Mark Hunter from Raymond James. Please go ahead.

Thomas Hunter (Managing Partner)

Hi. Yeah, thank you. This is Mark Hunter. So we're just kind of circling back to the really strong new ARR bookings from partners this quarter. You know, it's coming after the pipeline from strategic partners being at 15% last quarter. So it's kind of a guarantee of what's driving that buy-in and pipeline from partners. And then could you also comment and tie in how much of that has come from AWS or the impact of that relationship so far? Thank you.

Corey Thomas (CEO)

Yeah. I would say we have a set of strategic partners that I believe I've talked to you all about before that are like our top, you know, our top strategic partners, sort of. I think 15 partners around the world. That's the lion's share of that sort of like increase, and we do see that, you know, part of how you get momentum is partners create pipeline and they close pipeline, and we're seeing those healthy trends. Keep in mind that we did shift lots of our investment away from purely internal sources to be more partner-based last year, so this is expected. Some of this is expected. I would say, again, similar to our overall business, more of that's D&R-weighted, and frankly, it's early on the risk side, but we actually think there's lots of growth opportunity on the Exposure Command side.

But think about that as a part of the natural evolution of starting to see yields from the investments that we made exiting last year when we shifted from our own internal sources to more partner-based, primarily D&R-focused. And we're expecting both the pipeline and the conversion to actually line up as we go forward on the Exposure Command and the risk management business.

Joe Gallo (SVP)

Our next question comes from the line of Matt Stavris from Needham & Company. Please go ahead.

Matt Stavris (Managing Director)

Corey, thanks for taking the question, guys. I wanted to ask about the shift to a regional sales model that you implemented recently. Can you update us on how that's progressing? And given the early glimpse to 2025, any learnings or thoughts around changing go-to-market incentives for sales reps given the pipeline composition is shifting, as you alluded to? Thanks.

Corey Thomas (CEO)

Yeah, it's a great question. So I would say it's gone very well so far. I mean, the pipeline acceleration you're seeing is focused execution around the world from our sales leaders and the partnership with our partner teams. Frankly, now based off having the full product set in market for the first time in a while, that we feel is competitive in the right product set. So, you know, what do you want to see? You want to see the pipeline build. You want to continue to see healthy conversion rates and win rates of D&R, which you actually have. You want to see the pipeline Exposure Command convert and actually go forward. And that should drive sales productivity next year as we move forward. That's certainly sort of like the leading indicators that we actually see. But those are the steps we go through.

So like if you look today, our sales teams have been really focused on both building the pipeline, converting the existing pipeline. And so they've hit all the execution goals that we've actually laid out. They've also sort of like done a good job of going back and now upgrading our install base and building pipeline around that. So I would say they've hit all the milestones that we've actually laid out and that we want to hit.

You know, what's next up is what allows us to actually go in and tell you more than mild acceleration is that we actually have to see what the deal cycles are for Exposure Command. We have to actually see what the conversion velocity is around that. And we have to actually execute on that. That's the next up thing that we're really focused on. All right. Thank you all so much. Go ahead. Hang on. Do we have one more?

Matt Stavris (Managing Director)

Oh, no, sorry. I was about to turn it back over to you, but please go ahead.

Corey Thomas (CEO)

So one, I really appreciate everyone taking the time on the call today. I was just going to say, I feel I know we've had some changes throughout the year, but we've continued the momentum with D&R. We've now landed on a good integrated risk strategy that we actually feel good about. And really our focus now is about how do we actually reaccelerate and drive growth as we actually go forward. Thank you all for your time.

Matt Stavris (Managing Director)

Thank you.

Joe Gallo (SVP)

That does conclude today's presentation. Have a pleasant day.