SecureWorks - Q2 2023

Transcript

Operator (participant)

Hello and welcome to today's SecureWorks second quarter fiscal 2023 earnings conference call. My name is Bailey, and I'll be your moderator for today's call. All lines will be muted during the presentation portion of the call with an opportunity for questions and answers at the end. If you would like to ask a question, please press star followed by one on your telephone keypad. I would now like to pass the conference over to today's host, Paul Parrish, CFO. Please go ahead when you're ready.

Paul Parrish (CFO)

Thanks everyone for joining us. With me this morning is Wendy Thomas, our CEO. During this call, unless otherwise indicated, we will reference non-GAAP financial measures. You will find the reconciliations between these GAAP and non-GAAP measures in the press release and presentation posted on our website earlier today. Please also note that all growth percentages refer to year-over-year changes unless otherwise specified. Finally, I'd like to remind you that all statements made during this call that relate to future results and events are forward-looking statements based on current expectations. Actual results and events could differ materially from those projected due to a number of risks and uncertainties, which are discussed in our press release, web deck, and SEC filings. We assume no obligation to update our forward-looking statements. Now, I'll turn it over to Wendy.

Wendy Thomas (CEO)

Thank you, Paul, and welcome everyone. Our transformation into a leading XDR solution provider with a strong recurring revenue model is accelerating. I'm pleased to report that we crossed the $200 million mark in Taegis ARR in the second quarter. Taegis ARR reached the $100 million milestone 10 quarters after launch, and now just four quarters later, we've doubled to $200 million. Taegis ARR and customer count numbers continue to put us among the fastest growth rates in the industry, with triple-digit growth in both areas, reflecting the addition of 800 customers since 2Q of last year to a total of 1,500 Taegis customers. In terms of our business model transition, Taegis now represents 56% of our overall subscription ARR, and we remain on track for Taegis to be approximately 75% of ARR by the end of this fiscal year.

Why is SecureWorks' approach to XDR resonating in the market? Our Taegis platform is unique in four ways. One, superior detection, which means accuracy and speed with complete attack surface visibility and applicability. We ingest more than 486 billion events daily, including events across more than 100 integrations, which we enrich with industry-leading threat intelligence and tens of thousands of expert-curated signatures. Across our current customer implementations, 60% of the data we ingest through Taegis comes from sources other than endpoints. This speaks loudly to the value and economy of Taegis XDR that combines data from endpoints with data from cloud environments, email, network, identity systems, business applications, and more. We leverage 27 TB of diverse data with our machine learning models, combined with industry-leading threat intelligence, to produce best-in-class detection speed and efficacy.

We have a growing suite of proprietary advanced detectors, like our hands-on keyboard detector, that was trained on more than 3 trillion events. Using the power of machine learning, this detector recently identified a malicious post-exploit activity with an initial access vector never seen before. It's a perfect example of where we focus our machine learning research on the new techniques, tactics, and procedures where we do not yet have deployable threat intelligence or signatures, but that can be deployed with a high signal-to-noise ratio. For customers, this means we only alert when it matters, leading to a significant savings of valuable SecOps resources when leveraging Taegis. In short, Taegis lowers our customers' risk across their enterprise at a lower total cost of ownership, delivering the highest return on investment. Two, unmatched response.

The second way our XDR platform is unique is the SOAR capabilities native to Taegis provide, one, rapid and automated high security value response actions, things like host isolation or automated re-authentication prompts, and two, orchestrated workflows that quickly kick off customer remediation work streams, made easier with out-of-the-box integrations with providers like ServiceNow, Zendesk, PagerDuty, Jira, and many others, maximizing efficiencies for our customers. It also means live access in under a minute to an expert SOC analyst via the live chat feature in our Taegis UI. We believe we lead the industry in speed and quality of response with the fastest time to detect, label, notify, and investigate among XDR providers. Three, we are open without compromise. Transparency and open interoperability have always been first-order principles for Taegis. Our platform was built from the ground up to integrate market-leading technologies and deliver incremental security value on day one.

It's not about raw data aggregation. It's value delivered through actionable security-relevant insights. SecureWorks is committed to rapidly expanding integrations for Taegis with market-leading technologies, so our customers get better, more comprehensive detection with less time and effort to get to security value. For example, with the recent additions of Netskope and SCADAfence to our technology alliance partnership, we've expanded the reach of Taegis OpenXDR to include additional solution areas being used by our customers, including SASE, CASB, and OT. We don't approach these partnerships as simple data exchange projects. Instead, we do so from our rich heritage and long experience running security operation centers, where data from each source must work in concert to provide incremental security value. One last important point on our approach to being open without compromise.

Taegis customers use the same UI as our security experts, which enables seamless collaboration and rich context for security events, allowing us to work with customers of any scale and security depth. Finally, Taegis is priced for predictability and clear value for customers. Taegis is priced on a per-endpoint basis with no hidden data overage charges, providing customers with predictability of spend. For an easily comparable per-endpoint price, we provide more, covering a customer's entire security estate, including endpoint, with an industry-leading one year of data retention as our standard offering. That's far beyond the typical 30 days that other XDR and EDR solutions include natively, largely because their data architecture was not designed to scale to big data in addition to fast data. How can we do this at scalable margins? Our data architecture.

The security operations use cases we've experienced over decades have informed a unique data architecture that gives Taegis a powerful competitive advantage in terms of speed, scale, and security value. Evidence of this unique approach to data includes superior data labeling and normalization to feed higher fidelity detections and filter out noisy alerts. We optimize our approach to streaming or real-time versus batch processing in support of detection analytics and machine learning use cases. This allows us to develop new detectors quickly to prove out their security value while providing industry-leading time to detection for our most sophisticated analytics. We also optimize our use of search, designed for speed when warranted and for cost efficiency for longer-term storage and retrieval.

Innovations like these, drawn directly from our security expertise, enable us to price our solution on a predictable per-endpoint basis while still supporting a full spectrum of other cloud, network, and business system telemetry with more favorable data retention options and scalable margins, a distinct market advantage. In addition to more customers seeking XDR, we are seeing customers displace their SIEMs for XDR. W`hile the SIEM market is worth close to $5 billion, we increasingly hear from prospective customers that their SIEMs are essentially noise engines. They're ineffective and expensive. A recent new customer win selected Secureworks over their SIEM for the following key reasons. First, predictable endpoint pricing versus their SIEM's data volume-driven pricing, which disincentivized them from securing their entire environment.

Taegis' standard twelve-month data retention was key to this customer's threat hunting objectives, and they gained value from the incident response built into the Taegis offering rather than requiring incremental investments and talent. While the endpoint detection and response market is $9 billion and growing, we've heard from prospective customers, and we know from our XDR visibility, that EDR alone misses much of the threat. We recently alerted one customer to an exploited Confluence server monitored by a third-party EDR product where the threat actor ended up downloading scripts and running crypto miners, yet there were no native EDR alerts, but we detected the activity with Taegis XDR from the native EDR source telemetry. We also saw the same exploit on a different server from that customer's DNS logs where there was no agent installed, demonstrating the real power of XDR.

When customers have XDR deployed across the enterprise, it's common for our threat intelligence to flag network traffic to command and control addresses and then be able to tie that back to the endpoint being exploited. While maintaining 100% visibility of the entire enterprise is always a challenge, with XDR, our customers are more likely to gain early visibility into a part of the kill chain to enable them to quickly take action. With the Taegis platform, Secureworks is delivering the most transparent, interoperable, and open XDR solution with EDR natively included. The adversary will not get complacent, and neither will we. This past quarter, we've been joined by Mike Aiello as Chief Technology Officer of Secureworks. With more than 20 years in security, Mike is shaping the next horizon for Taegis and bringing his customer and industry experience to our leadership team.

Prior to Secureworks, Mike was the Chief Product Officer for HUMAN Security, and prior to that, served as the CEO of Appgate, the Product Management Director for Google Cloud Security, and as the Chief Information Security Officer for Goldman Sachs Consumer and Commercial Bank. We're bringing the best of everything to the table. Decades of security operations experience, an open and interoperable XDR platform with a unique data architecture, and the best security talent the industry has to offer. Today's markets are turbulent, driven, shaped, and reshaped by many forces, but we remain focused on keeping our customers secure. On defining the future of threat detection and analysis, and on driving superior long-term and sustainable growth and value creation for investors as we execute on our strategy and complete our transformation as an industry-leading XDR provider.

I want to thank our customers and partners for joining forces with us, and thank our teammates for their hard work and commitment to realizing SecureWorks' mission to secure human progress. With that, I'll turn the call over to Paul Parrish, our CFO.

Paul Parrish (CFO)

Thanks, Wendy. Taegis continues to gain traction in the market. ARR increased $100 million year-over-year to end Q2 at $201 million, another triple-digit growth rate over prior year Q2. We've added 800 customers since Q2 of last year, up 114% over the prior year to end the quarter at 1,500 total Taegis customers. Taegis subscription revenue was $42.8 million for the quarter, up 131% year-over-year. Average revenue per Taegis customer was approximately $136,000, up sequentially from $130,000 in Q1 and remaining a premium to our non-Taegis customer revenue, which averages $85,000 per customer.

As we continue to acquire customers and grow new business on the platform, we ended the second quarter with 56% of total ARR on Taegis. We continue to see Taegis expanding to about three-quarters of total ARR by the time we exit this fiscal year as we continue transitioning from non-strategic services to our Taegis-led business model. On an overall basis, total revenue was $116 million in Q2, which was consistent with our expectations despite an approximately $3 million FX headwind. We continue to scale our cost structure and benefit from our Taegis-led solution mix shift. Overall, Q2 gross margins expanded from prior year Q2 to 61.3%.

As we continue raising our voice and profile in the market with targeted investments in sales and marketing, sales and marketing costs have increased to 33.8% of revenue, up from 25.1% in Q2 of FY 2022 and 31.1% in Q1. We also continue working closely with our customers to innovate and deliver new features that align with their strategic priorities and our development roadmap, further differentiating Taegis in a fast-growing market. Accordingly, R&D has increased to 26.7% of revenue, up from 21.5% of revenue in the second quarter of last year and 25.3% of revenue in Q1. G&A expenses were slightly down in dollars compared to Q2 of the prior year on lower employee-related expenses, professional service, and consulting-related costs.

Adjusted EBITDA loss was $14.3 million compared to a $3.6 million gain in prior year Q2. The overall swing of $18 million was driven by a combination of reduced revenue and gross profit as we actively exited non-strategic, lower-margin services and continued investments focused on our long-term growth strategy. Cash flow used by operations in 2Q fiscal 2023 was $17 million, compared with $17 million provided by operations in prior year Q2. CapEx was $2 million for the quarter, relatively flat with the prior year. We finished the quarter with a strong balance sheet, $167 million of cash, no debt, and an untapped credit facility.

Turning to our guidance for FY 2023, as both Wendy and I detailed earlier, we saw healthy growth in our Taegis solutions, which are helping drive better outcomes for customers on their most urgent security challenges, and our business model transformation continues to accelerate. In the midst of this progress, the strength of the dollar has resulted in FX headwinds, and we expect to see a lower level of professional services revenue than reflected in our previous guidance. Given these dynamics, we now expect full year revenue to be in the $458 million-$465 million range, with FX impacting around 50% of the change in guidance and the remaining reduction primarily driven by lower professional services. Taegis ARR guidance remains unchanged. We continue to expect Taegis ARR to end FY 2023 at $265 million or higher.

Organic growth to contribute approximately $50 million of the incremental Taegis ARR. Sales should accelerate through the second half as we get the full benefit of our first half investments carrying through to FY 2024 and beyond. We're accelerating investments in global awareness and global distribution, with the returns expected to be more meaningful in the back half of the year and into FY 2024. We have updated the other MSS ARR component to now end FY 2023 below $70 million. Of the approximately $70 million of ARR remaining at year-end, we continue to expect resolution to be largely complete in FY 2024, enable us to eliminate duplicative costs to support CTP platform and services. Additionally, we have narrowed the following guidance ranges from our previous guidance.

Full year non-GAAP net loss to be in the $55 million-$59 million range, with full year EPS loss in the $0.64-$0.70 range. Full year adjusted EBITDA in the negative $63 million-$68 million range, which includes our investments in sales and marketing and R&D, reflecting our continued management of spend to revenue and cash flow used in operations in the $60 million-$65 million range. Regarding Q3, we expect revenue of $111 million-$113 million and an EPS loss in the $0.20-$0.22 range. In closing, FY 2023 continues to be an inflection point in the company's transition as we shed non-strategic services and complete the repositioning of our base to Taegis with a significant majority of customers completing that transition by FY 2023 year-end.

We are optimistic about our unique opportunity to capture XDR spend with our Taegis solutions while helping customers consolidate their security budgets to drive better efficiency of their spend. We're making consistent progress against our transformation with continued improvement in our business mix and growth potential. Wendy will now join us again as we begin Q&A. Operator, can you please introduce the first question?

Operator (participant)

Thank you. The first question for today's call comes from the line of Mike Cikos from Needham. Please go ahead. Your line is now open.

Mike Cikos (Vice President and Senior Equity Research Analyst)

Hi, guys. Thanks for getting me on, and thanks for all the color. I do appreciate it. I wanted to ask about the fiscal 2023 revenue guide introduction that we're seeing today. Just for clarity here, so you guys in Q2 came in line with your revenue guide despite the $3 million FX headwind. Can you remind us, I guess, what was management anticipating in Q2 from an FX perspective, just to see whether or not how much of a headwind it was versus what you guys previously assumed?

Paul Parrish (CFO)

Yeah. Currencies moved primarily Japan and British Pound a large part in Q2. As we entered into that quarter, we were looking at similar FX rates to what we saw at year-end in the first quarter. We didn't have a lot of FX impact in Q2 as we gave guidance.

Mike Cikos (Vice President and Senior Equity Research Analyst)

As I think about, I'm looking at the full-year revenue guide today. I think at the midpoint we're taking down full-year revenues by about $21 million. I just wanna make sure I'm clear here.

Paul Parrish (CFO)

Sure.

Mike Cikos (Vice President and Senior Equity Research Analyst)

We're saying that 50% of that cut is tied. Sorry, go ahead. I don't wanna keep going on top of you.

Paul Parrish (CFO)

No, that's correct. $21 million cut and roughly 50% is the FX.

Mike Cikos (Vice President and Senior Equity Research Analyst)

Right. 50% from FX. Can you explain to me the remainder coming from lower professional services? I just wanted to make sure I understood what was the driver behind that lower demand for that PS.

Paul Parrish (CFO)

Yeah. As we took a look at the growth in our strategic professional services for this year, we saw a trend up as we put together our guidance. We, of course, in our professional services have what we refer to as non-strategic that's coming down, and the growth pattern there is not developing at the rate that we saw in the guidance. That's why we're bringing down the professional services side of that.

Mike Cikos (Vice President and Senior Equity Research Analyst)

Okay. Just one more, if I could. Wanted to see, can we get any color on what the total customer base was for MSS or the company's total subscription customer base? I know that we cited the 1,500 customers for Taegis today. I just wanted to

Paul Parrish (CFO)

Yeah

Mike Cikos (Vice President and Senior Equity Research Analyst)

See how quickly, customers are migrating or what that MSS base is like as we stand at the end of this quarter.

Paul Parrish (CFO)

It's as you'll find when you get our Q, it'll be 1,900 other MSS customers, and combined we've got a total of 3,100 customers.

Mike Cikos (Vice President and Senior Equity Research Analyst)

Terrific. Thank you very much. I'll turn it over to my colleagues. Appreciate it.

Operator (participant)

Thank you. The final question for today's call comes from the line of Hamza Fodderwala from Morgan Stanley. Please go ahead. Your line is now open.

Hamza Fodderwala (Executive Director, Equity Research)

Great. Thank you for taking my question, and good morning, everyone. Wendy, maybe a couple of questions for you. A lot of really great detail on the XDR offering. It seems like you're really ingesting a lot of threat telemetry from a variety of different vectors. I'm just curious around just general market awareness around XDR. It does seem like there's a lot of marketing out there, yet a lot of the logs are still coming through these traditional SIEMs. So what would you attribute that to? Do you think there's just a lot of FUD in the marketplace, if you will, and customers will start to understand this technology better as the education of this starts to increase?

Is this something that will take time for customers to fully migrate their security analytics approaches towards XDR?

Wendy Thomas (CEO)

Yeah. It's a great question because if you look at, really MDR and XDR, they're still fairly early in the proverbial hype cycle, if you will. There's a combination of, stage of length of time in market, and therefore awareness is growing, but nowhere close to what it is for more mature, established markets like SIEM or such. There's a couple of things that we look to see the movement in customer awareness or prospect awareness of what XDR and MDR really mean.

One of those is that the content of RFPs actually naming XDR or MDR instead of SIEM or MSSP or those types of things. That's a good indicator for us that the awareness is growing. The second is that we see the customers or prospects joining things like our webinars about how to actually make an easy transition from a SIEM to XDR being one of our most subscribed sets of content. There's definitely now awareness that it is an opportunity in security. I think people are very much in the investigation mode, and when you show them what it means in terms of effectiveness of security, lower cost to implement, maintain, and manage, the case is getting pretty compelling.

We are seeing now more customer shifts customer acquisition shift from SIEM, in fact, displacing multiple SIEMs in a lot of cases to Taegis. It's on its journey.

Hamza Fodderwala (Executive Director, Equity Research)

Got it. And I was wondering if you could just speak around the demand environment. Obviously Taegis is doing quite well. I think Paul did mention maybe a little bit lower demand for some of the non-strategic services. We've heard from a number of security companies that there were instances of longer sales cycles, particularly midway through Q2. Just curious what you're seeing and maybe what contributed to that lower demand for the non-strategic portion of the business.

Wendy Thomas (CEO)

Sure. I'll actually separate those two a bit. I mean, it is our goal to accelerate the transition of the business to shorten that tail, if you will, and to move some of those service non-strategic services to partners more quickly while resourcing the core business to Taegis. That is not necessarily a bad thing from our seat. In terms of sales cycles for Taegis generally, I think we've seen a similar impact from the market, which is you sort of look at the beginning of pipeline healthy good quality. The time cycle to what we call the technical win, we don't see really being impacted. What we see is the timeline from technical win to commercial close.

That's where we do see a lengthening in the cycle. There's really two factors typically we see contributing to that. One is additional layers, if you will, of either procurement or even C-suite review of deals or needing to sign off on things. I think there's some tighter controls around budgets generally. The second one is sometimes there's turnover in the prospect as a deal is coming to a close, and that can pause the process for a bit of a re-education and a restart. Those are really the two things, turnover and extra scrutiny on the procurement side.

Hamza Fodderwala (Executive Director, Equity Research)

Got it. Very clear. Thank you.

Wendy Thomas (CEO)

Thank you.

Operator (participant)

Thank you. We now have a follow-up question from Mike Cikos from Needham. Please go ahead.

Mike Cikos (Vice President and Senior Equity Research Analyst)

Hey, guys. Thanks for getting me back on. I appreciate the fact that me and Hans are just playing pretty punk here. On the customer count, I just did wanna come back to it, and I just wanna hear your sense on the philosophy or the strategy. If I'm thinking about the total customer count for MSS today, we're still seeing those declines. We're down to about 1,900 customers. Taegis customers are ramping, but on an aggregate basis, your subtotal subscription customers are still leaking lower.

I just wanted to see, can you provide us any color you have that offers conviction or confidence in the strategy as far as being able to attack a larger market opportunity or attract more customers to the SecureWorks platform longer term?

Wendy Thomas (CEO)

Sure. It's a good question. Let me talk a little bit about the average revenue per, because the demographic of the customer base is part of the answer on the customer count. If you look at the Taegis platform, we are specifically targeting customers who are a minimum of 500 endpoints or more. That was not necessarily our approach with the MSSP business. If you look at the number of customers that were turned from MSSP as opposed to transitioning to Taegis, they've been averaging, and this is not just this quarter, but through the process, on less than $30,000 per. They really aren't ready to, or have the capacity or willingness to spend the minimum amount for MDR or XDR coverage.

There is some shift in the customers that make sense for the Taegis platform. You see that in the average across all of the MSSP customers in the mid-$80,000s, as Paul talked about, and on Taegis being in the $130,000 range. We're definitely targeting upmarket, higher-margin, and customers who have the ability to expand with us in the future as well. There is a mix shift in terms of the size that you're seeing in the count and the average revenue.

Mike Cikos (Vice President and Senior Equity Research Analyst)

Got it. Thank you for that. Last one on my side, but just coming back to the gross margins for this quarter, I know that we had a slight uptick when looking at it from a year-on-year basis, but it did leak lower from call it that 63%-64% range we've been in over the last 2-3 quarters. I just wanted to see, at least on a sequential basis, what caused that degradation and how should we be thinking about gross margins for the rest of the year? Thank you.

Paul Parrish (CFO)

Yeah, as we talked about the year, this is the transformation year, and we'll have certain costs come in as we're managing the cost in proportion to that revenue mix as we bring down the older CTP to Taegis going forward. There'll be certain quarters impacted for some of those costs. This quarter, gross margins were impacted some of those costs.

Mike Cikos (Vice President and Senior Equity Research Analyst)

I see. Really just a function of the revenue mix shift that's taking place, as well as some of the.

Paul Parrish (CFO)

Yes

Mike Cikos (Vice President and Senior Equity Research Analyst)

...the pressures with the cost versus the shrinking revenue base in aggregate.

Paul Parrish (CFO)

Yes.

Wendy Thomas (CEO)

Right. As you see TEJAS continuing to expand, you start to get squeezed a bit as you come to the tail end of the CTP platform, and then that overhang. Clearly, we've talked before about the $30 million, $15 million in COGS, $15 million in OpEx of sort of fixed costs on CTP that we're sort of duplicatively swallowing this year. As we head into next year and get through the ARR transition, we will see that improvement in cost structure both on the OpEx and the gross margin side as the CTP overhang comes out.

Mike Cikos (Vice President and Senior Equity Research Analyst)

Terrific. Thanks. Makes a lot of sense, and I appreciate all the extra detail there. Thank you, guys.

Wendy Thomas (CEO)

Yeah, thanks for the question, Mike.

Operator (participant)

Thank you. There are no further questions registered at this time, so I'd like to pass the conference back over to Paul Parish for closing remarks.

Paul Parrish (CFO)

Okay. That wraps up the Q&A in today's call. A replay of this webcast will be available on our investor relations page at secureworks.com, along with our Q2 web deck with additional financial tables. Thanks again for joining us today. Have a good day.

Wendy Thomas (CEO)

Thank you.

Mike Cikos (Vice President and Senior Equity Research Analyst)

Thank you.

Operator (participant)

This concludes today's conference call. Thank you all for your participation. You may now disconnect your lines.