Rapid7, Inc. (RPD) Earnings Call Transcript & Summary

Yes. Well, I think on the technological side, one of the first things that I would point to is we did an acquisition of a company called Kenzo. It was very small. We did it earlier this year. But it was extremely focused on the technology and the technologists that came with that. But it speaks to bringing in that technology onto our platform that allows us to much more rapidly ingest a broader array of alerts from different infrastructure sets out there. So being able to much more quickly be able to bring more data into our platform and adjust into that platform, super important. But then that's setting us up for the next leg of the journey to being able to rationalize that and make sense of that data. So this is one of those problems that all SOCs are facing, but the better you can -- the more data you can see coming into your system, the more alerts you can get, the better it can be, but it's also that much more data and alerts to have to work through. So that is the technology unlock that. It really is underway, but it's going to be a journey for, I think, everyone in our industry about how do we very quickly bring all that data in, quickly get our arms around it and help separate out what are alerts for a myriad of reasons that are fairly innocuous versus those that are real threats to your organization. So that's a tremendous amount of work that has to go on. Kenzo was a first big move in that direction, but it's part of this much longer journey and then that will -- ultimately manifest itself into a lot of platform work as we bring all of this together, that's really key. Along with that, I think is that the external elements you talked about is helping customers understand the threats and understanding what they're facing, whether they like it or not, right? Make sure we're super clear on that. And for us, one of the benefits is because of the AI impacts on cyber have been so well pronounced. These conversations are now much higher. There's not a board out there who -- there are probably just 1 or 2. But generally speaking, there's not a board out there, where they're not asking about what's your cyber strategy. And I'm hearing about all these exploits or I'm hearing about all these vulnerabilities that are being found what are you doing about it? That shines a bright light on just how important the work we're doing is and the opportunity for us to get out in front of that.

So you've historically had pretty sizable market share in, again, the classically defined vulnerability management market. So as the definitional expanse of vulnerability management has changed, i.e., the definition is expanded, it's exposure management, it's more encompassing to capture more attack surfaces and search attack surface area. How do you feel that the exposure management addressable market opportunity compares to the classic vulnerability management opportunity. And is the opportunity for you to capture more estate, so more volume of share in a customer's organization? Or do you believe that the lever is higher pricing, more pricing leverage or more premium pricing?

So within exposure management, the first -- the most obvious glaring thing for us to do is to -- is to capture more of that share, right? Our exposure management business is an opportunity for us to not need to do extraordinary things, but we need to get that business, coming along get it back up to where the market is growing, right? We've fallen behind that. We have a lot of work to do on that place. People are familiar with the story, we'll know that the exposure management business is offsetting some of the growth of the D&R in recent quarters. We're very frustrated by that, extremely focused on it. But the path is very clear on the work we need to do that we think closes that gap gets that business growing and is a big contributor. And I think that's where we really have to focus on. We're just making getting more customers, bringing them on to the platform. That allows the engagement, they're earning their respect, their trust and showing them the rest of the work we can do for them.

So Rafe, a little bit of an elephant in the room question as it relates to what some of the frontier labs are talking about by way of their advancements and their core technologies and their large language models. So very deliberate focus on shoring up the health of the exposure management SKU and franchise for you. But at the same time, the realities of the ground have changed as it relates to some of these large language models are very, very capable at very high speeds finding some of this, right? So how do you jostle with that dynamic, which is clearly different and has evolved in the last 6 months and maybe wasn't necessarily an issue last year.

Yes, absolutely. So I think, first of all, we have to really like all security -- or all security companies have security teams to go out and find vulnerabilities. And when we find a zero-day bug, like it's a great source of pride, it comes from great professionals, digging in it and -- but that's not what's driving our business on a day-to-day basis. And these advancements you're speaking of makes that very, very clear that by and large, finding new vulnerabilities is a business that's commoditized in part of the past. The trouble is that they're very good at this and so there is a tremendous volume of vulnerabilities that become known and teams are drowning our customers or potential customers drowning in just the sheer number of vulnerabilities that are out there. And the pressure is super high. Like these are known vulnerabilities. What are you doing about it? And they have to report to it quarterly to their boards and their audit committee meeting. And so all of the sudden, you have to acknowledge that from a moneymaking perspective, the finding vulnerabilities is commoditized, but the dealing with them to be able to rationalize and prioritize it, manage the upgrades of them has never ever been more important. And I think that's where -- that's where we really make a big difference with our exposure management solution. And then frankly, the other part of it, and I'm sure there's plenty of examples where this has happened, but we feel like it can get worse is that the bad actors are also being able to get these more vulnerabilities and use them against companies. And that's where it's going to be just the pressure to deal with the exposures, but also to monitor and detect attacks just is off the charts, and it caused a lot of stress in the industry. So on the one hand, parts of the way we thought of the business 5, 10 years ago are completely different and even gone, if you will, the remainder of the business, the battle that has to be fought has never been more important, and I think that's going to drive a lot of value to the industry.

So it sounds like the volume -- the voluminous amounts of CVEs that are kind of coming out as aided or facilitated by these labs. Actually, in theory, can provide a very lucrative bridge for you -- for your D&R business, right? It's a getting at -- so when we think about the broader opportunity in the security operations center, there's a lot of movement and interesting sort of renaissance from a spending standpoint there. As enterprises generally speaking, rethink their security operations center stack, their architecture, their vendor strategy. Where does Rapid7 fit into that equation? And why do you feel that you will have a right to win in taking more than your fair share of some of those very juicy budgets?

Yes, absolutely. Well, I think if you think about our ideal customer profile out there, right, Rapid7 has always had a strong presence in the commercial market, kind of that midsized business, where they're big enough to have serious security needs, but they probably don't have the budgets. And you also see where our data analysis makes it very clear that even in much larger organizations, for the right kind of organizations, those that are really, frankly, quite lean on the security side, we are a perfect fit. And so you look at that and say, that problem exists today, and it's only getting profoundly worse. They have to rely on other vendors. And we're in this unique position with a ton of knowledge built into our organization and teams built in it. And we, right now, bring great product combined with human services and we're investing like crazy on the product side of that. I think that's going to be this big differentiator that a lot of companies, if you will, that outsourced SOCs, do it just person for person. They just throw bodies at that we're already well past that, but the work we're doing right now only further enables us to ingest more, to see more, to make sense of more data. But plus part of our proposition on the D&R side is when you are under attack, you're going to want to talk to a human who's going to have the experience and the maturity to help you manage through that. So it's -- as the CFO, we hardcore trained to not want humans involved in things. But this is an area when things are really going south on that side of it. You need some element. The key for us, though is to be able to meet the scale and the demands without having to throw bodies at it over time, throw technology at the scale, sort that down, identify the real attacks and then have that differentiated service. And that is something that our customers are extremely thankful for to get through very difficult times, but also to know that day in, day out, we're helping monitor their systems better than anyone else can.

Rafe, you've pre-answered a little bit of my next question. But when we think about the managed detection and response sub-header to the D&R business. What is the interplay and overlap with the overall SOC opportunity? And generally, how has your view evolved there? I think you were talking about, hey, there's maybe some labor efficiency that you can add to kind of your value proposition. So how does AI enhance your revenue and operating leverage opportunities in this area and then bubbling that back up to the D&R at large?

Yes, absolutely. And within our D&R, our D&R, the vast majority of that is managed detection response as a business and how we really differentiate our value. I mean I think, first of all, as we continue to enhance our platforms and unite our platform and our data sets, it's going to provide a better service to our customers, right, being able to see so many more alerts and find those correlations, 1 attack might trigger a number of alerts, but they're on different pieces of equipment, different systems, very hard to rationalize for a human to do it other than going screen to screen to screen and being, frankly, just unlucky. We can bring more of that together and our goal is to keep adding to our capabilities there. So you have to start with, we think working with us, you can get a service that you can't get by yourself, certainly running your own stock by using other tools. And that's tremendously difficult. I think the thing that we're looking at for ourselves, and even in the Kenzo acquisition, this was part of the formulation when we looked at it, because we are -- we are our biggest customer in terms of running SOCs is that we can bring tremendous value, while enhancing the overall offering, right, making sure that we can scale the number of alerts that come in to us, they scale the company without having to continue to do that person by person on the cost side of it. So it's, I would say, first and foremost, you have to differentiate and do something that just can't be done with other companies. But then I think we can continue to do that. We talk about wanting to make sure we're providing this managed detection response with software-like margins. And I think that's a real key calling for us as we look forward to the coming years, being able to deliver that extra value to our customers, but also to our shareholders in an efficient way that's driven by automation, but still has that differentiated service.

Rafe, I wanted to talk about the path to growth reacceleration and acceleration for ARR. I know we have a lot of different conversations in different pockets, right? So maybe just to distillate in terms of the order of operations of things that need to fall into place and go right so that ARR trends start to rehabilitate, right? So how would you kind of stack rank the things that need to again fall into line for ARR to start coming up the curve?

Yes. Well, I think the vast majority of these are going to be on the product side. So on the MDR, the investments we're making those, the acceleration of our agentic work that we're doing on that. I think is going to make that solution much more competitive, more advantageous, driving growth in MDR that would be the very first step. The exposure management, really drilling in on this, on the current customer base, the enhancements we need to make sure everybody gets upgraded to the latest versions of the technology and then continuing that platform expansion that brings that. And if we stopped right there, focus on MDR, focus on exposure management on the product side, I think that gets us there in the overall story, but that is the biggest driver. We do have these non-core offerings. And it's a little more nuance there because there are several different solutions. But the biggest thing is making sure that platform is so strong, has enough of those features that we can migrate those customers over to it and make sure they're happy. And I think that's going to help the story. Some of the non-core offerings, getting through the decline quicker is probably the best thing that possibly can happen to us. We just want to do it in the way that's best for our customers.

And just as a related matter because it's a good segue into the next question I wanted to ask you about managing a very disciplined cost envelope as you kind of navigate some of these dynamics. You've still been able to produce operating efficiency in the business, right, driven a lot of rigor in terms of managing the cost. So I don't think 20% operating margins have been out of the realm of possibility, right? So can you help us appreciate how much more scope is there to essentially run the non-core portfolio at a much more efficient level from here? And is that going to be the preponderance of the input to ongoing operating leverage because the core business is going to get all the love in terms of investment, right? So just in terms of the factors of influence on your ability to continue to drive operating leverage at or above 20%?

Sure. And with the restructuring we just did, we did talk about -- we've been talking all year long about improving margins as we exit 2026. So with this restructuring behind us, we were able to call it on the last call that we think we can exit the year with margins in that range. And I think that's a big first step. A good deal of the cost rationalization was able to come out of the non-core. And I think that's very, very clear that to the extent we have some of these non-core offerings, we have to make sure they're contributing to the investment that's going on in the core. So I think there's big opportunity that's already underway. I think there's ongoing opportunity as we move forward. What will help us as an organization is having that crystal focus of where should each new dollar be invested. And frankly, to go through the budget cycles, where should every dollar be invested in terms of making the strongest solution for our customers and then taking that to market. When we started the year, it was before we'd really broke out this core versus non-core, but already intuitively, the company was gravitated towards that direction, putting better sales incentives around selling core. Well, that's only going to get sharper and sharper as we move forward. And so I think that is what's going to ultimately help us get the most bang for our buck when we're putting in dollars, whether it's on the product side, whether it's on the go-to-market side and getting results and returning them to the business.

Rafe, my last question for you is managing the business and setting expectations as Rapid7 moves through a period of tremendous change. You talked about data management, data quality, stronger signals being filtered into your guidance. How should investors sort of think about the quality of the inputs kind of going into the pie that you're making for all of us as it relates to guidance setting expectations. And then related to that, what are 3 things that give you a lot of confidence that you are going to see over the next 12 months, this real rehabilitation in kind of the trajectory of the business.

Yes. Well, I think in terms of the inputs, a lot of it is -- I mean, at the end of the day, it comes down to good teams working very hard together. I think One of the things that we've done is between Allan's organization and my team working together, we review forecast every Friday, we go over that. And we work very hard to dig into those elements of it and really understand the nuances of the deals that we're looking at of the customer renewals that are coming up, it's -- to some great extent, it's spending a lot of time together. And frankly, creating competitive modeling within the team. So you're talking about why there are differences and really wrestling. So if nothing else out of the debate, you understand where your risk items are. And doing that across the organization on financial data, I think, is tremendously important. We also have brought in some new leadership. We've moved people around within the finance organization to crispen up how we forecast the business, how we bring it together to our teams. And then I very much try very hard to lean in with my business partners to bring them into the discussions, even when the discussions are tough quite early. We've met repeatedly with Dan and Allan about what next year's plan is shaping up. It's extremely preliminary. But to do next year's plan, we have to have a very clear view of where the products are, when the releases are happening, with how Allan and his team are looking at it. All of that feeds into being able to give much better data. And then ultimately, my confidence for the future very much rests in the individuals we work with. We're blessed by strong leaders, who have very strong opinions and so we get to exercise those freely. But you get guys like Dan and Allan in the room, you get the teams together. That's what makes you feel like we can do this. We -- the path is so clear how to make things better. And as we make them better, we'll continue to help make them great.

I appreciate that, Rafe. Thank you so much.

My pleasure. Thank you.

Nice conversation.