DivvyCloud Corporation (RPD) Earnings Call Transcript & Summary

Ladies and gentlemen, thank you for standing by, and welcome to the Rapid7, Inc. conference call. [Operator Instructions] Please be advised that today's conference is being recorded. [Operator Instructions] I would now like to turn the conference over to your speaker today, Sunil Shah, Vice President of Investor Relations. Please go ahead, sir.

Thank you, operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's proposed acquisition of DivvyCloud. With me on the call today are Corey Thomas, our CEO; and Jeff Kalowski, our CFO. We have distributed our acquisition and first quarter 2020 preliminary financial results press release over the wire, and it is now posted on our website at investors.rapid7.com. This call is being broadcast live via webcast. And following the call, an audio replay will be available at investors.rapid7.com until May 5, 2020. During this call, we may make statements related to our business that are forward-looking under federal securities laws. These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 including statements related to our preliminary results for the first quarter of 2020, our financial guidance for the second quarter and full year 2020, the assumptions underlying such guidance and the timing of global economic recovery, the anticipated closing of the DivvyCloud acquisition, the impact of the DivvyCloud acquisition on our products, strategy and future results of operations, the anticipated growth of DivvyCloud revenue post acquisition, the anticipated impact of COVID-19 on our guidance, business, financial condition and results of operations and our assumptions on the timing for economic recovery in the global economy. These statements reflect our views only as of today and should not be construed as representing our views as of any subsequent date. We do not have plans to update these statements, except as required by law. These statements are subject to a variety of risks and uncertainties that could cause actual results to differ materially from expectations. For a discussion of the material risks and other important factors that could affect our actual results, please refer to those contained in our annual report on Form 10-K filed with the SEC on February 28, 2020, and in subsequent reports that we file with the SEC from time to time, including our Form 8-K filed with the SEC today and our quarterly report on Form 10-Q for the quarter ended March 31, 2020, that we intend to file in the near term. Additionally, a non-GAAP financial measure will be discussed on this conference call. Please refer to today's press release on the Investor Relations portion of our website for a reconciliation of this measure to its most directly comparable GAAP financial measure. These documents are available in the Investor Relations section of our website. At times, in our prepared remarks or in response to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be onetime in nature and we may or may not provide an update in the future on these metrics. Nothing on this call is intended to constitute an offer to sell nor a solicitation of an offer to buy any securities. With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey?

Thank you, Sunil, and good afternoon, everyone, and thank you for joining us on short notice. We're excited to announce the proposed acquisition of DivvyCloud today and to share with you how this furthers our mission to help customers advance securely. Hopefully, by now, you've seen our press release sharing preliminary results for the first quarter of 2020, along with our revised guidance. It is clear the economic picture remains fluid, and we believe it is important to be even more transparent during these times. So I will begin with some brief commentary on our preliminary results and guidance before covering DivvyCloud. So that we can focus today's time on DivvyCloud, we intend to hold all Q&A related to Q1 results, Q2 and full year 2020 guidance and the evolving COVID-19 situation for our earnings call scheduled for next Thursday, May 7. I look forward to taking those questions then. Starting with the first quarter. We delivered solid preliminary Q1 results with ARR growth of approximately 31% year-over-year and revenue and non-GAAP loss from operations both exceeding the high end of our guidance provided on February 10, 2020. We ended the first quarter with more than 9,000 customers, up 14% year-over-year and approximately flat sequentially from December 31, 2019 to March 31, 2020. This sequential result was driven by continued healthy growth rates in our platform customer base, which grew by 33% year-over-year, offset by fewer nonplatform transactional deals for Metasploit and Nexpose legacy networks, end-of-life related churn and slower pace of net adds late in the quarter due to shifting economic conditions precipitated by the COVID-19 pandemic. Average ARR per customer increased 15% year-over-year to approximately $38,900. Renewal rates ended the first quarter in line with our expectations at 106% and continued to benefit from solid expansion trends, offset by slowing nonplatform expansion. Our revenue retention rates remain strong and were at the high end of our historical range. Moving to guidance. Given the current economic landscape, clearly, we should be anticipating a broader range of outcomes than we provided guidance earlier in February. We reflected this by lowering and widening our ARR guidance range to 14% to 20% year-over-year growth for full year 2020. We have spent considerable time over the recent weeks speaking with customers and working to understand potential industry and micro vertical COVID-19 related impacts to our business. In constructing our revised guidance, we have considered various economic recovery scenarios and their associated impact on both new business and churn. This includes a U-shaped recovery as well as L-shaped and V-shaped scenarios that account for our best estimates of the COVID-19 related impact by subindustry. The revised guidance range reflects our best assumptions across these scenarios with a baseline U-shaped recovery at the midpoint that assumes that, one, there are no new or recurrent shocks to the global economy; two, that Q2 will see the highest negative impact to economic growth; and three, it is a long and steady road to economic recovery over a 12- to 24-month period. These assumptions are based on what we are experiencing today, which we are approaching as a moderate but sustained recession through the balance of the year. We do not control the primary set of drivers, which will be how long the economy remains closed and at what pace it recovers when it reopens. Our guidance anticipates that our visibility in the fourth quarter is particularly low and the renewal rates maintain a lower trend line despite solid trends to date. Our revised guidance includes the impact of the DivvyCloud acquisition for the second quarter and full year 2020, resulting in a modest non-GAAP operating loss for the full year 2020 as a result of the acquisition. As a result of purchase accounting, we anticipate a fair value adjustment to DivvyCloud's deferred revenue, which will reduce revenue recognized in 2020 by approximately $2 million. This reduction is roughly equal to the midpoint of our non-GAAP operating loss for the full year 2020. Now shifting focus to DivvyCloud. As digital transformation initiatives accelerate cloud adoption across every industry, customers are grappling with new and emerging threat vectors. Security teams are challenged with managing an explosion of cloud workloads to enable agility and innovation while still managing risk and compliance. Forrester estimates that 57% of security decision-makers are concerned about the risk that public cloud technologies introduced their firm. As companies migrate to the cloud, they must also think about security differently. The influence of DevOps is critical in the process. DivvyCloud sits at the intersection of security and DevOps, solving the security stakeholders' need to manage risk and compliance while meeting the DevOps team where they are in the cloud, allowing them to innovate securely. DivvyCloud offers a Cloud Security Posture Management platform that enables visibility, automation and continuous security governance across multiple environments, including AWS, Azure, GCP and Alibaba. Their platform provides a unified view of a customer's cloud estate, enabling them to analyze and remediate and protect their state against misconfigurations, policy violations, internal and external threats and identity and access management challenges. The acquisition of DivvyCloud will extend the cloud security capabilities of Rapid7's Insight platform, helping security and DevOps teams understand and manage governance, risk and security in their growing cloud environments. A great example of the platform's customer value proposition comes from a large media and entertainment company that has an active presence across AWS, GCP and Azure. With a mandate to assure risk and compliance of the overall enterprise, this customer chose DivvyCloud because of its ability to automate governance, offer flexibility and enable better insight and control across all 3 clouds at the same time. Rapid7 is focused on providing our customers market-leading solutions that address foundational elements of their security program. The acquisition of DivvyCloud accelerates our ability to deliver these solutions in the fragmented cloud security space. Helping customers secure their cloud assets has been a critical goal and priority at Rapid7. And DivvyCloud brings both the right technology and the right team to help us deliver on this objective. With the addition of DivvyCloud, Rapid7 will be able to offer leading products across each of our 4 major pillars: vulnerability management, detection and response, cloud and application security and security orchestration and automation. We view DivvyCloud's technology as a natural extension of our existing value proposition for customers, enabling us to provide a more holistic picture of risk across infrastructure, applications and now cloud workloads. In fact, this combined ability to provide a deeper and more comprehensive view of risk to our customers is one of the key reasons the DivvyCloud team chose to align with Rapid7. Both of our management teams see a great mission-driven and cultural fit between the teams, which has always been critical to our success with the companies we've acquired. We believe the DivvyCloud team has built a truly innovative and customer-centric business, and we are thrilled to welcome them to -- and its customers to Rapid7 family. We will continue to sell DivvyCloud as a stand-alone offering while also integrating it with our Insight platform products over time. I'm sure some of you might be asking, why is now the right time to do this? Let me take a moment to address that. First and foremost, we are doing this from a position of strength, both financially and operationally. We entered this period with a robust balance sheet, a compelling long-term growth opportunity in security and a durable subscription business model, all of which empower us to make the right long-term decisions for our business. We have further demonstrated over time our ability to deliver sustained growth while managing our expense structure and remain focused on strong expense controls as we continue to invest in the business. Second, I believe it is critical, particularly during periods of challenge, that we not slow down or interrupt our pace of innovation. In the midst of all the recent changes, Rapid7 has taken action and moving forward on behalf of our customers because that is what they must do as well. As our customers increasingly pursue digital strategies that demand security, they have been asking us to deliver a best-of-breed solution in this area. DivvyCloud delivers on this customer need, addressing their growing preference for solutions that offer high levels of productivity, cloud relevant and deliver a high ROI. At no time has it been more abundantly clear that the business transformation to the cloud is happening. Attackers don't get furloughed. And the current pandemic crisis is accelerating the need for us to help secure our customers' expanding position in the cloud. We believe acquiring DivvyCloud will empower us to do this. Turning now to financials. I will cover a brief overview of the terms and impact of the transaction before opening it up for questions. Under the terms of the agreement, Rapid7 has agreed to acquire DivvyCloud for a total purchase price of approximately $145 million, subject to adjustments to be paid in cash and stock. The acquisition is expected to close in the second quarter, subject to customary closing conditions. We anticipate DivvyCloud to contribute approximately $10 million in incremental ARR to our business at the time of closing. DivvyCloud has been executing a hyper-growth rate, and we anticipate that it will continue to deliver strong growth looking forward. DivvyCloud has approximately 50 customers across industries, including finance, technology, media, health care and retail. Finally, we intend to finance the acquisition through cash on hand. We have entered into a new revolving credit facility that provides borrowing capacity up to $30 million with an accordion feature to expand potential borrowing capacity up to $70 million. In addition, we have announced our intent to offer $200 million in convertible notes in a private placement. In summary, I want to reiterate Rapid7's commitment to closing the Security Achievement Gap on behalf of our customers. The acquisition of DivvyCloud positions Rapid7 as a leader in cloud security, visibility and automation. Furthering, our ability to help organizations of all sizes deliver positive security outcomes as they accelerate to the cloud. With that, I will turn the call back over to Sunil for questions. Sunil?

Thank you, Corey. As a reminder, we ask that you hold all questions related to Q1 results, Q2 and full year 2020 guidance and the evolving COVID-19 situation for our quarterly earnings results call next week. We'd appreciate it if we focus today's discussion on the DivvyCloud acquisition. Operator, can we open the call for questions?

[Operator Instructions] Our first question comes from Matt Hedberg of RBC.

Maybe I'll start with -- for Corey, I guess. I think Gartner talks about 20% growth for this market, CSPM. I wonder if you could talk a little bit about how you think about the size of this market, and then maybe a little bit more on the competitive landscape, I think, would help us all.

It's a great question. So yes, it's -- I think about this is Gartner's -- what they -- I think, one of their fastest-growing markets in security and overall. And we think about this as broader than just security posture management. If you think about what the DivvyCloud team has been able to do, it's really having a great anchor position in that market. But they've also been able to tackle things like identity, which is extraordinarily complex in the cloud and is a core area of risk as we move forward. Our bonds, we view this as primarily thinking about this as we got confidence if you think about the top-down numbers of this having the potential to grow to a multibillion-dollar market over time. And then you actually look at the bottom-up analysis, is more and more people are adopting cloud, more and more people are moving to the cloud. Cloud is where the game will be in infrastructure. And the ability to actually manage cloud security from configurations policy perspective, identity configuration perspective and the infrastructure as a service will be the future battleground. And so we like the acquisition here because it places us not just where existing large opportunity is, but this is the core security battleground for enterprise security as we move to the future. And so we think about this as a multibillion-dollar opportunity that both expands our TAM and allows us to be where the customer action is today. Thank you, Matt.

That's great. And then maybe just one more. I think it looks like they have about 50 customers today, many of which are very large. I'm wondering if you could talk about maybe what an average deal size looks like for DivvyCloud and how it's priced today. And I don't know if there's any comps you can give us on how you -- which -- maybe plan to price it in the future.

Yes. They have a range. I would say it's roughly a couple of 100,000 today. One of the things that attracted us to it is that this is a demand area that we got from some of our larger and more complex customers. If you think about it, if you're a large customer, you don't have as much control over the security environment as you did on the traditional IT side. You have teams of developers, you got partners, and you're responsible for security and the governance and the attestation around compliance. And so you need an integrated platform that gives you visibility but also the ability to automate remediation if issues would come up. And so we do see this being biased towards the large end of the market from the start. But what I would say is that our expectation is that any company that adopts cloud in any meaningful way and DevOps in any meaningful way will need this type of solution. And so while it's going to start at the enterprise level, we expect it to move constantly as people adopt and migrate more complexity into the cloud. I would say we have no current plans to make material changes to how they price it and approach it. They're an extraordinarily smart and talented team. And if anything, we're just looking at how we accelerate the ongoing demand that they built.

And our next question comes from Gur Talpaz of Stifel.

This is actually Chris Speros on for Gur. For Corey, put simply, why DivvyCloud? And why now?

Yes. So it's a great question, especially why now. You can imagine that we thought about that heavily as we go through. So first and foremost, it's aligned with our strategy. If you think about the core 4 pillars of security operations: vulnerability management, detection and response, cloud and application security as well as SOAR. And we've said for a long time that we thought the fragmented cloud and application security market was a strategic market that both our customers were asking for and was relevant to our strategy about ensuring that clouds -- ensuring the overall security of the operations continue to be scalable and deliver the security outcomes that people were looking for. And so it was highly, highly aligned with our strategy. The second thing is that it's an area that we've been contemplating for a while. We've been patient. We'd like to take our time. When we think about strategic acquisitions, we like them to be strategically aligned, an area where we already have existing customer demand and an area that we believe can be accretive over time and so affect that category. Then the question is why do you actually really act now in the midst of the COVID thing. I would say that otherwise, we definitely would have done it, but why do you do it now in the midst of what's happening in the world. And one of the interesting things that we saw from our customer base is that the initiatives that we're getting green light -- green lit right now were all about digital initiatives that help people engage with customers in a world where they cannot be person-to-person engagement. And most of those initiatives are actually being driven out of the cloud. And so our -- one of our beliefs as we were actually going through this is that cloud adoption is one of the things that accelerates over the next 18 months as people -- sorry, think about not just how they work from home, about how do they engage their customers and consumers around the world in a digital way. And so while that's not a reason to do the deal, it actually provided additional confidence that if you've got to actually be in a market, you want to be in the market at the point of acceleration. And they have the right team, the right technology at a time when the market, we believe, is going to accelerate, and that made all the logic in the world to us.

That makes a ton of sense. One more, if I may. So to what degree does your customer base overlap with that of DivvyCloud? We're just trying to understand the potential to sell the core suite of Insight's products into the DivvyCloud Enterprise installed base.

Yes. So one of the things we're excited about, sort of like 2 different factors. One, in our enterprise customer base, I'll remind you that 60% of our revenue comes with companies over $1 billion. And then we have good penetration to both the Fortune 500 as well as the Fortune 100. This has been an area that they've asked us for. So I've sat in discussions where our customers were struggling with how they actually manage their cloud exposure and their cloud visibility and their actual cloud governance. The other thing is when we look in the DivvyCloud base, while we haven't released a specific number, we have a number of overlapping customers. And that all gave us confidence that between what we're seeing and the interest we have from our sales team, the existing customer overlap, this is something that we think fits quite naturally into our portfolio overall.

[Operator Instructions] And our next question comes from Gregg Moskowitz at Mizuho.

Okay. Corey, you mentioned that DivvyCloud is in hyper-growth mode. How fast are they growing? And roughly how many employees do they have?

Yes. So I would say that we have not released the growth numbers. I would just say, yes, we consider hyper-growth anything over 50%, and they've been clearly growing in excess of that. I think we did share the amount of revenue that they actually had coming in. And so I think that if you look at the prior year, they actually had quite strong growth coming in. We expect good demand this year, but we are all living through something that we don't control, which is the pandemic, which we'll talk about on our call next week. And then, Gregg, do you have a second question associated with that?

Number of employees.

Number of employees. It's roughly, I think, in the mid-70s.

70 to 80, right around there, Gregg.

Yes. Mid-70s.

Okay. Perfect, Jeff. And then how should we think about the time line to integrate DivvyCloud? I know, Corey, you said it will be integrated with Insight over time. So if you could maybe expand on that as well as just go-to-market going forward.

Yes. No, that's a good question. So one, I would say that we looked at it -- so we think it's a smart team. We like the road map. So we're continuing to actually drive the road map that they have. We think they have the right strategy for customer adoption. We're starting with the integrations with our core InsightVM and InsightIDR products. And then over time, it will move to our Insight cloud platform. That's not the first priority off the gate primarily because we think this can add instant value to our customers. But we would expect that in a reasonable time frame that they would actually have an offering in our Insight cloud platform. But our first priority is to continue the momentum that we actually have in the market and focus on integration.

And ladies and gentlemen, this does conclude our question-and-answer session. I would now like to turn the call back over to Corey Thomas for any closing remarks.

So I just want to thank all of you again for taking the time at the last minute. This is something that we're extraordinarily excited about. The pandemic has lots of things to worry about in the world. But we feel very good about our ability to meet our customers' needs, and that's the core focus of Rapid7 and our team and our organization. And we wish all of you health as we go through this global pandemic together. Thank you again for your time.

Ladies and gentlemen, this concludes today's conference call. Thank you for participating. You may now disconnect.