SecureWorks - Q4 2022
March 17, 2022
Transcript
Operator (participant)
Good morning, and welcome to the SecureWorks fourth quarter and full year fiscal 2022 financial results conference call. Following prepared remarks, we will conduct a question-and-answer session. If you have a question, simply press star then one on your telephone keypad at any time during the presentation. At this time, all participants are in a listen-only mode. We are webcasting this call live on the SecureWorks investor relations website. After the completion of the call, a recording of the call will be made available on the same site. I will now turn the call over to Andrew Storm, Vice President of Investor Relations. You may begin.
Andrew Storm (VP of Investor Relations)
Thanks, everyone, for joining us. I'm Andrew Storm, VP of Investor Relations at SecureWorks, and with me are Wendy Thomas, our CEO, and Paul Parrish, our CFO. During this call, unless otherwise indicated, we will reference non-GAAP financial measures. You will find the reconciliations between these GAAP and non-GAAP measures in the press release and presentation posted on our website earlier today. Please also note that all growth percentages refer to year-over-year changes unless otherwise specified. Finally, I'd like to remind you that all statements made during this call that relate to future results and events are forward-looking statements based on current expectations. Actual results and events could differ materially from those projected due to a number of risks and uncertainties, which are discussed in our press release, web deck, and SEC filings. We assume no obligation to update our forward-looking statements. Now, I'll turn it over to Wendy.
Wendy Thomas (CEO)
Thank you, Andrew, and welcome everyone. Just 2.5 Years since initial launch, Taegis reached $165 million in ARR, up $42 million sequentially, accelerating our business model transition. We added a record 400 customers in Q4 to finish the year with 1,200 total Taegis customers, of which over a third are now software only. Our focus remains on transforming the company to higher-value security solutions and driving scale and operational efficiencies in the business. As we actively exited non-strategic lower margin services in fiscal 2022, total revenues declined by $26 million, while non-GAAP gross profits increased by $500,000. We invested in engineering and marketing talent with headcount in those areas increasing in the high teens, while our shift away from non-strategic services enabled us to reduce total headcount by 13% versus year-end last year.
As a result, revenue per employee increased 10% and gross profit per employee was up nearly 15%. Our transformation will accelerate in fiscal 2023 as we increase investments in Taegis to capitalize on the market transition to XDR and manage down our non-strategic services. The shift to XDR is happening because it has to. The existing sprawl of point solutions operating independently and noise generated through legacy SIEMs, it's too much for overworked security analysts to address, leaving the adversary free to weave between existing controls. Until now, no prior security solution has brought everything together properly. Without that, you end up with billions in ransomware payouts. It's been clear to us that the way to defeat the adversary is a security-first approach with a single big data platform architected for holistic prevention, detection, and response.
While others are catching on, building a true XDR platform is not easy. We've spent over five years building this vision into Taegis. Creating effective analytics beyond a single control, like the endpoint or firewall, requires a data lake with substantial volume, diversity, and span of data. Our data lake ingests endpoint, network, email, cloud, and other forms of telemetry from thousands of customers every single day. That's the foundation we've built on. Endpoint-only providers, however, don't have the comprehensive visibility into a customer's network, cloud, or email. Architecture is not designed to ingest and correlate all the disparate data across vendors. Without comprehensive data, the detection capabilities are incomplete or unnecessarily noisy. In short, you don't have a scalable XDR solution.
Even with the data, it takes a fully operational, dedicated threat intelligence team working with data scientists to research behavioral threat patterns and develop the detection analytics and rules that make XDR so powerful. Taegis is further supplemented with the intelligence gleaned from our incident response and security operations teams, not just by buying intelligence from third parties. As an example, we recently filed a patent for our new hands-on keyboard detector, which uses machine learning to detect threat actors, not using malware, but local tools in malicious ways that would be too noisy for signatures to detect. We started with a single true positive incident and went back through 3.3 trillion process events in our data lake to find more examples. We built a machine learning model, trained it with this data, and developed a detector with a true positive rate of over 99%.
This patent-pending approach brings unrivaled capabilities and detection in the market. As soon as we released the detector, we found multiple intrusions where the existing security point solutions were not raising alerts. This is extended detection. The second key part of XDR is the response. A purpose-built XDR platform pulls together all relevant information and provides an embedded security orchestration layer with automated response capabilities. These capabilities were designed into Taegis from day one. It's not a third-party software bolt-on or an after-the-fact acquisition. We constantly enhance our embedded workflow and response playbooks, driving increasing levels of automation for customers with practices informed by our managed security services and incident response teams. Our customers know we are in the fight with them every day, available when needed most.
With one of the top incident response practices in the world that handles over 1,400 engagements annually, our customers know they have access to the right people whenever they need it. The final component of a true XDR platform is active prevention. Vulnerability management has long been akin to exercising to prevent health problems. The solution to most vulnerabilities is patching, yet organizations still don't do it. The reason is simple, like exercising, patching can be time-consuming and hard. We've taken the pain away and brought a step change in automation, enabling a more hands-off approach. With comprehensive vulnerability detection and response, Taegis delivers a complete security program at a lower total cost of ownership. Bringing this together, a true XDR platform provides the prevention, detection, and response that extends well beyond the endpoint.
It marries big data, intelligent security analytics, live threat context, and the best of human engineering and SecOps. Without unifying prevention, detection, and response for the entire ecosystem onto a purpose-built data and automation architecture, you're not doing XDR, no matter how much the marketing says otherwise. When we began building Taegis over five years ago, the XDR market didn't exist, and until more recently, wasn't viewed by industry analysts as a category. Now we're consistently recognized for our clear leadership and the unique solutions we've built. With a leading product in a growth market, excellent NPS scores, and a roster of customers advocating on our behalf, this is our time to capitalize on the market shift to XDR. We are investing further in marketing and product in the year ahead to capture that opportunity and maintain our leadership position.
It's a testament to our team and the value of Taegis that we've historically spent significantly less on sales and marketing than public peers, yet delivered one of the highest growth rates in XDR customers and ARR last year. Looking ahead, we see multiple drivers of long-term organic growth, including a continued shift toward XDR and away from standalone point product-based approaches to security, the upsell of additional solutions, increased demand from targeted marketing investments, the shift of sales talent from re-solutioning existing customers as that work winds down this year to hunting for new logos, and accelerating sales through our partner program. We are at the tipping point year of our transition. We've been building to this moment. We began the re-solutioning program just over a year ago, and we expect to exit fiscal 2023 with a substantial majority of our ARR on Taegis.
Underneath the noise of our transition, we're building a higher quality business with a strong position in one of the highest growing segments of the cybersecurity industry. I want to thank all of our customers and partners for their support and our teammates for their hard work and commitment to get us where we are and to fuel the year ahead. With that, I'll turn the call over to Paul Parrish, our CFO.
Paul Parrish (CFO)
Thanks, Wendy. 4Q Taegis ARR increased $42 million sequentially, our largest quarter ever and 34% sequential growth rate. This resulted in ARR of $165 million, $10 million higher than guidance at 200% growth from last year. We had a record 400 Taegis customer adds in Q4 to end our year at 1,200 total Taegis customers. Following our end of sales announcement, customer re-solution accelerated. As a result, Taegis ARR ended the year around the 60/40 mix of re-solution versus organic. Taegis subscription revenue was $85.6 million for the year, up 165% year-over-year, reflecting continued strong growth but was below our expectations for two reasons. First, the majority of re-solutioning deals closed toward the end of the quarter, pushing revenue out slightly.
Second, we continue to see a timing impact from customer delays in turning down their CTP security services. As noted last quarter, we recognize revenue proportionally as customers migrate, but we will continue to allocate a portion of other revenue to other MSS subscription revenues as long as customers have CTP services in place. Average revenue per Taegis customer was approximately $135,000, continuing to be at a premium to our non-Taegis customers, which averaged $93,000. Increased right-sizing of some smaller customers led to a modest decline in average revenue per Taegis customer as we ended the year. As we shed non-strategic businesses, full year total revenue declined $26 million, yet gross profits were higher by $500,000.
We continue to manage our cost structure and solution mix, leading to improving gross margins of 62.6%, up 300 basis points from FY 2021. Sales and marketing costs were flat compared to FY 2021 on an absolute dollar basis, although we shifted the mix of investment toward the channel. We continue investing to drive innovation on Taegis and maintain our lead in threat intelligence and research, reflected in a 15% increase in R&D last year. G&A expenses were down modestly from last year. Adjusted EBITDA was $19 million, down from $33 million last year, reflecting better gross margins offset by investments in R&D. Cash flow provided by operations in FY 2022 was $17 million with CapEx of $8 million. We finished the year with a record $221 million of cash, no debt, and an untapped credit facility.
Turning to our guidance for FY 2023. First, keep in mind, we have a 53-week year in FY 2023 compared to 52 weeks in FY 2022. We expect Taegis ARR to end FY 2023 over $265 million compared to $165 million this year. We expect organic growth to contribute approximately $50 million of the incremental ARR, and sales should accelerate through the year as we get the full benefit of our investments carrying through to FY 2024. For Taegis in FY 2023, we're accelerating investments in brand awareness and global distribution, with returns expected to be more meaningful in the back half of the year and into FY 2024. We expect other MSS ARR to end FY 2023 below $80 million compared to $224 million this year. Per our end of sale announcement, we have stopped selling these services with a few exceptions.
As a result, we expect $90 million-$100 million of ARR in FY 2023 to be either transitioned to partners, move in-house with customers or churn. For the $80 million of ARR remaining at year-end, we expect a significant portion to be eligible for re-solutioning, with most done in FY 2024, enabling us to aggressively manage out the excess cost. We expect full-year total revenue to be $475 million-$490 million, with first quarter revenue of $120 million-$122 million. For modeling, you can assume approximately $9 million of revenue for the 53rd week. Full-year Adjusted EBITDA is expected to be between -$58 million and -$68 million as we invest for growth. This guidance reflects the following expectations.
Increase investments in sales and marketing by approximately $30 million. Our investment in R&D is expected to increase approximately $20 million this year to maintain our market lead. G&A is expected to grow slightly to $2 million. We estimate there is approximately $30 million of duplicate fixed and transition-related costs that we are incurring, with $15 million of cost of revenues and $15 million in OpEx. As we turn down our other MSS services, we will manage the related cost out, positively impacting FY 2024 and FY 2025. Taegis subscription gross margins are expected to increase in FY 2023 and beyond. Though total margins will be impacted by the duplicative fixed and transition cost, resulting in overall FY 2023 gross margins being approximately flat.
Operating expenses in FY 2024 should increase on an absolute basis, but we'll expect them to grow at a lower rate than FY 2023, delivering operating leverage that brings us toward our long-term model. Finally, EPS loss is expected to be in the $0.61-$0.70 range. In summary, we're making consistent progress against our transformation with continued improvement in our business mix and growth potential. The end of our business model transition is now in sight, and we believe that it's increasingly clear we have the right product at the right time to lay the foundations for growth and profitability for the company. Wendy will now join us again as we begin our Q&A. Operator, can you please introduce the first question?
Operator (participant)
I will now open the call for questions. If you have a question, press star then one on your telephone keypad. As a courtesy to others, please ask no more than two questions. We'll take our first question from Mike Cikos with Needham & Company. Your line is open.
Mike Cikos (Senior Analyst)
Hey, guys. Thanks for taking the question here. I wanted to circle up. I think in the prepared comments you had mentioned that the Taegis revenue may have been slightly below what you guys were anticipating. The two reasons being the re-solution deals may be closing more of those at the end of the quarter, as well as the timing impact from customers turning down their CTP services. Can you delve further into both those dynamics? Just wanted to unpack that a bit.
Paul Parrish (CFO)
As we built our expectations, we forecasted some improvement in the speed at which those customers would come off their old services. That additional improvement didn't occur, as well as we had a larger amount occur later in the quarter, which is impacting the timing of the revenue we recognize as Taegis. We still have the revenue in our business.
Wendy Thomas (CEO)
Yes, I'll just add a little color to that.
Paul Parrish (CFO)
Yeah.
Wendy Thomas (CEO)
The contracts are there. The customers.
Paul Parrish (CFO)
Sorry
Wendy Thomas (CEO)
Are committed to Taegis. It's just a matter of the revenue being recognized by the company and other MSS versus Taegis. If you think about this is more of a transition challenge, not a value creation one.
Mike Cikos (Senior Analyst)
Right. I guess the question on the other service is turning down, right? Can you remind us again, like what would cause a customer to hold on to those other services longer than expected? I guess a follow-up would be when you've provided us guidance and as we look to think about fiscal 2023, is there some element of assumption as far as customers maybe turning those off slower than expected?
Wendy Thomas (CEO)
Sure. I can speak to some of the examples of the customers. In most cases, these are some of the larger customers who are transitioning. The pace at which they are essentially turning off their counter threat platform monitoring was slower than expected. There's a couple of things behind that. One, they're often just sort of checking twice to make sure there's absolutely no gaps in transition on their end. The second piece that we've seen is really some of them are struggling with staffing, particularly IT staffing, which is often required in supporting the security team in making this type of transition, particularly for larger customers. That's definitely been something that we saw in fourth quarter with overall sort of staffing challenges in the economy.
For some, in a few cases, as you know, we've been working with them to transition certain services to partners or in-house. There's been some examples where that transition, again, just dotting the I's and crossing the T's, that transition has just taken a little bit longer.
Mike Cikos (Senior Analyst)
Got it. One more, if I could. I know that you guys did provide a good amount of color when we're thinking about OpEx in the upcoming year. The investments that you guys are calling out, whether it's accelerating those investments in brand awareness, I think the other comment might have been around sales and marketing initiatives or partners. Can you get more granular on either one of those items? Just wanna see how those dollars are expected to be deployed. Is it the thought that it'll be relatively evenly spread through the year, or should we expect it to be more heavily front year-focused, back half-focused? Anything there, again, would be incremental. Thank you.
Wendy Thomas (CEO)
Sure. Well, I'll speak to the business side, and then I'll have Paul speak to the spread piece. For us, this is really about doing the right thing at the right time. We are in an ideal position to capitalize on the market recognition of the secular shift to XDR beginning. With us having clear product market fit, customer advocates, the third-party recognition of both the XDR space and our leadership in it, now is really the time to lean in. What we've seen is, as we get into conversations and do a proof of value, we win the clear majority of those deals.
Frankly, you know, given our lower sales and marketing investments to date, this is a proof point of the value of the product when it's in the customer's hands or the prospect's hands. This marketing spend is about investing to get ourselves into every single deal conversation that we possibly can, 'cause when that door is open, we're gonna win. For us, this is also hand in hand with doing this with our partners, right, the XDR market education, supporting them in their go-to market. As you think about the spend pieces, this is primarily around demand generation and what I'll call brand response as opposed to sort of broad brand awareness. The partner support pieces of that are absolutely integrated into that.
Then to a lesser extent, what I would call that continued XDR education of why it's the right security solution, and to some extent, some of the third-party recognition and customer advocacy support work. So really very targeted. The majority of the spend, very targeted, to the areas where we've seen increasing win, rather than what I would call sort of broad generic brand awareness. Then I'll turn it to you, Paul.
Paul Parrish (CFO)
We step into the spend in Q1, and so we believe in this, and we believe it's the right thing to do at this time. We step into that, and there's a slight increase in Q2, but it's considered equally split during the rest of the quarters beyond that.
Mike Cikos (Senior Analyst)
Thank you. I'll cede the floor, guys. Thank you very much.
Wendy Thomas (CEO)
Thank you.
Operator (participant)
Our next question comes from Sterling Auty with JPMorgan Your line is open.
Sterling Auty (Managing Director of Equity Research)
Yeah, thanks. Hey, guys. I'm wondering.
Wendy Thomas (CEO)
Good morning.
Sterling Auty (Managing Director of Equity Research)
The 60/40 split that you talked about now, what should we think about that split being as you exit this new fiscal year?
Wendy Thomas (CEO)
As we exit fiscal 2023.
Sterling Auty (Managing Director of Equity Research)
Yes.
Wendy Thomas (CEO)
Definitely safe to use that 60/40 split for the organic growth in fiscal 2022, right? Still a pretty healthy balance between the two. As we accelerated the transformation with the end of life and frankly just the ability to have had more customer conversations, that's how we ended the year. In Paul's remarks, in terms of FY 2023, we've guided the organic growth piece should continue to expand. That $50 million or more organic guide implies basically a 30% growth rate on the current total base for organic, and we're confident in that guidance. All of that is still, you know, buoyed by tailwinds from partner program traction, obviously the marketing things we just spoke about, and this continuing shift of the puck moving to XDR, in the broader market.
Sterling Auty (Managing Director of Equity Research)
The one follow-up would be, all right, with that under $80 million of MSS ARR that's left exiting fiscal 2023, what's gonna be the thought process in terms of what type of carrots versus what kind of sticks that you can use to kinda motivate that tail to finally, you know, convert over?
Wendy Thomas (CEO)
For a piece of that, it's based in Asia where we are deploying some market-specific platform capabilities. A big chunk of that is really our timing choice not to engage a section of customers, if you will. For the remainder, we're having all of those conversations now. It's really about planning with them in terms of their overall business priorities to make that transition as opposed to needing to provide particular carrots. Where we are now in the conversations, it's more about timing of transition than whether to transition or that need for a special incentive.
Sterling Auty (Managing Director of Equity Research)
Understood. Thank you.
Wendy Thomas (CEO)
Thank you.
Operator (participant)
Our next question comes from Hamza Fodderwala with Morgan Stanley. Your line is open.
Hamza Fodderwala (Executive Director)
Hey, guys. Good morning. Thank you for taking my question. Wendy.
Wendy Thomas (CEO)
Good morning.
Hamza Fodderwala (Executive Director)
I have a question for you on the XDR strategy. One of the things you mentioned was the data ingestion and the data lake component. It seems to me with XDR, one of the issues is not only how do you ingest the data from multiple vectors within your organization from a network, endpoint, cloud, et cetera, but also how do you standardize that so that you can analyze it properly and action upon it from a security standpoint? I'm just curious how you're going about doing that, because it seems like in security, we're just really far away from having open telemetry models. You know, when you think about the analysis portion, is that where your threat analysts and your threat intel experts come in and provide that human-level assistance, or is there some other secret sauce that you guys have that we're not aware of?
Wendy Thomas (CEO)
It's a great question, and thanks for it because you're right. Part of the importance here is, one, having that broad data set in the data lake. For us, that means cutting across the entire ecosystem. I mean, if you look at our telemetry that we're processing, you know, the market really talks a lot about endpoint, but that's probably only about 40% of the events that we're processing day to day because there is a way that the adversary weaves through the environment that is important to have a holistic perspective.
It is absolutely the case that we leverage our experience, our teams, incident response, adversarial testing, our security operations teams to basically understand penetration techniques and then how to reverse engineer them for defense and basically make those, learnings machine readable, if you will, across this big data platform. The foundational piece, as you mentioned at the start, is it's not just ingesting that data and then generating a bunch of alerts. It is very easy to detect anomalies, but it is hard to not bury those anomalies in a massive haystack of noise.
The way that we do that, because of our experience working across every point product in the industry as a service provider, historically, our understanding of that telemetry and normalization of that telemetry to then apply these techniques to the detection across that telemetry is the secret sauce that lets us have not just detections, but high-fidelity detections that have high probabilities of potential damage that lets us really get to remediation quickly, leveraging the automation on top of that, of course, to speed time to remediation. That is the answer that a true XDR platform should be providing using relevant big data that is leveraged in a way with detection understanding that is based on a knowledge of the threat actor's techniques.
Hamza Fodderwala (Executive Director)
Got it. I'll keep it at one. Thank you.
Wendy Thomas (CEO)
Sure.
Operator (participant)
Thank you. Our next question comes from Saket Kalia with Barclays. Your line is open.
Wendy Thomas (CEO)
Morning, Saket.
Saket Kalia (Managing Director and Equity Research Analyst)
Okay, great. Hey, guys. Hey, good morning, Wendy. Thanks for taking my questions here. Maybe just to start with you, Wendy, and apologies if this was asked. I joined a little late, but you know, with all the focus on XDR, can you just talk a little bit about how much you are displacing traditional SIEM instances, right? Or installations, let's say, versus perhaps coexisting with a traditional SIEM at you know, inside your customer base?
Wendy Thomas (CEO)
It's a good question, and it is an evolving answer to that over time, right? As both the understanding of XDR grows and frankly, customers come up for, you know, renewal or replacement of that SIEM based on their contract length with that knowledge of XDR now getting more clear. There was, in the beginning, much more sort of a coexistence, let's see how this goes, let's use the data from where we are. Very much now the understanding that you can essentially address all of the use cases of SIEM plus do it better at a more reasonable cost of ownership with an XDR platform like Taegis. We increasingly see that as an opportunity to shift share of wallet while giving customers better ROI and frankly, better security outcomes from it.
Because if you think about what you're looking at here, it's about the ability to ingest relevant data, but again, to make it information, not just data, to enrich that with user and asset context. For our customers, the fact that we are really helping to build and maintain those detectors or work with them to build those makes that XDR platform much more relevant on an ongoing real-time basis than a SIEM that can be very difficult to maintain and frankly, could be expensive from a data perspective.
Saket Kalia (Managing Director and Equity Research Analyst)
Got it. Paul, maybe for my follow-up for you, and again, apologies if this was mentioned earlier, but you know, either quantitatively or qualitatively, can as you look at sort of your maybe looking backwards, you know, as you look at your traditional MSS base, what percentage of them chose to re-solution with Taegis versus maybe explore other options? I think you know, I heard you talk about sort of average revenue per customer earlier. I wasn't sure if that was on a total basis. The second part of that question is, when an MSS customer does choose to re-solution, what's the typical uplift you see you know, after that event takes place?
Paul Parrish (CFO)
Yeah. I think all of our customers are excited about the Taegis products. When you ask about that, all of them are listening, all interested, all trying to determine where they are in their walk, is this the right time for them? We see interest across the board. If you're asking the interest level, very high across all customers. The actual plays into effect when customer either renews or not, where are they in their walk on their technology? On your average revenue per customer, we're seeing roughly that a renewal customer is coming in at roughly where we're selling new logos at, and we're very happy with the average revenue per customer.
Wendy Thomas (CEO)
Yeah. For comparison, the 135,000 on Taegis compares to low 90s. I think it's 93,000 on the CTP platform. We continue to see higher average spend with the, again, the same situation. They're upshifting their entire posture for full coverage of their estate and are able, in some cases, to displace other standalone spend, which is now a feature of the platform. That trend continues.
Saket Kalia (Managing Director and Equity Research Analyst)
Got it. Very helpful. Thank you.
Wendy Thomas (CEO)
Thank you.
Operator (participant)
Thank you. We'll now take our final question from Brian Essex with Goldman Sachs. Your line is open.
Speaker 8
Hi, this is Charlotte on for Brian. Quick question. It's nice to see the record number of Taegis customers in Q4, 400. Can you talk about how many of these logos were net new logos versus conversion of your existing base? Thank you.
Wendy Thomas (CEO)
Yeah. We talked about on the call that in terms of our growth for the year, the base of Taegis ARR is about a 60/40 split. We haven't seen a material shift in the average revenue per customer, and so those have generally been following the same mix shift.
Speaker 8
Gotcha. Another question on Taegis. With your endpoint partnership that you announced last year, have you seen a shift in the competitive landscape or have you seen any changes?
Wendy Thomas (CEO)
In terms of the endpoint next-gen AV, is what you're referring to?
Speaker 8
Yes, exactly.
Wendy Thomas (CEO)
We have quite a few endpoint partnerships. Yes, absolutely. We've seen a nice traction from that. Again, the whole strategy behind that is giving customers the option for one-stop shop. We do find that customers in the lower end of the mid-market tend to want simplicity in pricing, vendor engagement, and capabilities, where customers on the larger end of the market sometimes want to select individual security controls and then bring them together with Taegis XDR. For us, that again is just about capturing share of wallet, making things simple and easy for customers to partner with us, and just makes a ton of sense for the capabilities of a holistic XDR platform.
Speaker 8
Great. Thank you for the insight.
Wendy Thomas (CEO)
Thank you.
Operator (participant)
There are no other questions in the queue. I'd like to turn the call back to Andrew for closing remarks.
Andrew Storm (VP of Investor Relations)
Great. Well, that wraps up the Q&A in today's call. A replay of this webcast will be available on our investor relations page at secureworks.com, along with our Q4 web deck and additional financial tables. Thank you again for joining us today.
Wendy Thomas (CEO)
Thank you.
Operator (participant)
Ladies and gentlemen, this concludes today's call. You may now disconnect at this time.