Rapid7, Inc. (RPD) Earnings Call Transcript & Summary

Okay. Hey, good morning, everyone, and welcome to the Barclays TMT Conference. My name is Saket Kalia. I cover software here at Barclays. Very happy to have with us the team from Rapid7. We've got Andrew Burton, President and Chief Operating Officer. We've got Jeff Kalowski, Chief Financial Officer. And of course, we've got Sunil Shah, Head of Investor Relations. We've got about 25 minutes together. Let's maybe take the first 15 or 20 minutes or so to do some fireside chat with the team. And then to the extent anyone's got any questions on the webcast, feel free to shoot me an e-mail at [email protected], and I'll do my best to sort of weave them in at the end in the last 5 or 10 minutes. So with that as a framework, Andrew, Jeff, Sunil, welcome to the conference. Thanks for being with us here today.

Thanks for having us.

Thanks.

Absolutely. Absolutely, absolutely. Andrew, I'd love to kind of start higher level with you. I'd love if you could talk a little bit about the core vulnerability management market a little bit, or VM. What are customers saying about VM as a focus area in a post-COVID world? And how do you feel Rapid7 is benefiting from that?

Yes. Yes, great question, Saket, and thanks again for having us. We're excited to be here. VM, as we said, remains a -- it's a core foundational part of customer security programs. And clearly, we came into -- 2020 hasn't been the year any of us would have expected as we came into it. But we came into the year viewing the market as healthy. And we still believe it's a healthy market, right? Obviously, during -- with COVID, March, April, beginning of -- late Q1, Q2, people began to reprioritize their not just security but their IT efforts to account for everything that was going on, right? And so long-term demand, we think, is pretty good, and we continue to believe that we're growing better than the market. But there was some urgency, right, when people moved around, around VM projects, taking a step back and that people really have looked at cloud transformation, cloud security, monitoring, their overall posture and position to help remote distributed workforces. And what we've really seen is an acceleration around some of the digital transformation side. So VM is, we believe, for our customers a core foundational component. It's strategic. It's something that we believe our platform gives us some durability around and we are seeing, though, some tailwinds with monitoring and cloud security. But VM is something that's still top of line for our customers.

Got it. Got it. That's a helpful start here. Jeff, maybe for you kind of staying on that topic. Can you just talk about high level, of course, Jeff, how big the VM business is? Whether that's an ARR or revenue terms, how you would like? And also maybe how that growth has trended here through 2020?

Yes. So I'll talk about terms of the ARR. So today, to frame it, it's about a little over half of our total ARR. As Andrew said, it's still growing at a healthy pace. For this year, we've said we would finish the year with double-digit ARR growth for the year. And just to frame it, we've also said that our security transformation solutions now make over 1/3 of our ARR and are growing at over 40%. So we see opportunities for VM to still remain healthy, and as Andrew said, growing faster than the market. And we will continue to see ourselves being a leader in that space. With the growth and contribution of VM, we're going to continue to invest. And it provides a good platform for us to continue to invest not only in VM, but also to grow our security transformation solution. So we've broadened our product portfolio over the last couple of years with the Divvy acquisition as well. So you'll hear us talk about a theme of really durable growth going forward throughout our meetings with investors and presentations.

Got it. Got it. That's helpful. That's helpful. Andrew, maybe that's a nice segue from what Jeff touched on, with the security transformation part of the business. The question is, Andrew, can you just maybe walk through what that includes from a product perspective? I think we've gotten some tidbits here. But can you just frame that for us in terms of what security transformation sort of means -- that security transformation business means to you? And in particular, what excites you, in particular, in that group of products, if you will?

Yes. No, absolutely, Saket. And I think if we look at the broader -- what's going on in the market by all measures, people, our customers are embracing the cloud, right? And they're doing it and this digital transformation is part of helping them not only adjust in the COVID era, but actually, the rate of innovation and competitiveness is only going up with this digital transformation. So our customers, as you would expect, are inherently looking for help and just to secure that, to secure that transition to the cloud adoption of cloud services. And it's not to shrink the opportunity, but to actually look at how do they continue to extend their position for their security programs. So when we look at digital transformation and we think about helping our customers secure that, our offering, Saket, to your point, are really around a couple of core areas. One, this includes our incident detection and response, right, which is a cloud-based solution, it was native day 1 in the cloud. Application security, so right apps running in the cloud, are they secure? How do I ensure that they continue to be secure? We have DivvyCloud, as you know, which is our cloud security offering, which is helping people really understand their posture and position of ensuring that their cloud environments are -- and a lot of our customers have multi-cloud environments, but those are secure and being well managed. And then obviously, our orchestration and automation, our SOAR offering. So if you roll all that up, it's really about helping our customers modernize and extend their security programs in this cloud era, right? So yes, they want to be able to leverage their investments today, but actually embrace this opportunity to extend their security programs into the cloud environment. So we believe -- I, personally, am, Saket, very excited about it because I think we see really a new wave of opportunity around digital transformation and helping customers secure that. And we believe that is a great tailwind for us. That is going to help us across those products and those services to help our customers navigate and secure that journey.

Got it. Got it. Jeff, for you. I think you touched on this earlier, but just to -- maybe just to spell it out. Can you just reiterate how big is that security transformation bucket in terms of ARR? So almost like the last question that we asked on VM, just in terms of sizing and growth just to sort of compare and contrast?

Sure. So today, our security transformation products are over 1/3 of our business. It's growing over 40%. As Andrew said, the components of that are IDR, AppSec, SOAR and now Divvy. The other point I'll make out, so it's a healthy platform. And with -- in Q3 and as well as Q2 is over 50% of the new ARR, it was growing over 50% -- over 50% of the new ARR was the security transformation product. So those products tend to have higher ASPs. And we see a good growth opportunity for -- this is why it enforces the durable growth that we're talking about, not just with -- we can land with any of those products in the platform, and we can also sell into our base. We've got over 9,000 customers. So there's a lot of opportunity to both land and expand that platform.

Got it. Got it. Andrew, I'd love to dig into some components of that security transformation business portfolio. Maybe starting with the InsightIDR product. Like you, right, I mean, I remember when that first came out, and it was really positioned as sort of a "lighter weight" SIEM, right, for security -- in particular for security organizations that were maybe still maturing their security practices and team, if you will. And so the question is, is that still the right way to position it? Or has that changed sort of the product and frankly, the space have evolved?

Yes. Great question, Saket. So I think, first, I would say, our belief is that in all of our core offerings, right, in each offerings, our first and foremost priority is to be a best-in-class provider. And so when we look at IDR, [indiscernible] and when we introduced the offering, what does best-in-class look like? And for us, best-in-class, we were hearing from our customers is they needed a modern or more effective way to detect and respond to potential attacks. And so frankly, if you looked at legacy SIEMs or old school SIEMs, if you could get the data into them and you could search through it and you may have some alerting. But what we heard from our customers is we need a detection response platform. We need something that combines user data and user behavior with log data, attacker data, network, all this stuff. But we -- our customers -- we want all that integrated, and we want it to just work, right? And so our belief is, and the reason we have been able to establish a strong position with IDR, InsightIDR, is, one, we believe that the cloud-native orientation was going to deliver value very easily. Customers didn't worry about how to deploy infrastructure and deploy and get it set up, really wrap in time to value, first. Second, that we would have all these capabilities in one offering. And over time, I think you've seen and our customers have seen, we've been adding and augmenting and really looking at how do we help our customers do better with their detection response program. And now third, with the digital transformation that Jeff and I were just talking about, we see customers really saying, "Hey, you know what, we need to be proactive. We need to make sure that we're able to monitor and cover our remote workers. We need to make sure this cloudy era that we're all going increasingly in, we need to make sure it works there. And we need to help people upgrade their monitoring capabilities." So I don't know if I would agree, Saket, with kind of lighter weight. I would say our focus is on what does an effective solution look like and what would best-in-class. And as Jeff said, we now have established, and I think largely, the analysts agree that -- the industry analysts, that we are one of the market leaders in this category because of this focus in being -- helping our customers be more productive.

Got it. Got it. That's helpful. Jeff, maybe staying on that IDR offering for a second. Can you just broad-brush us, can you talk about IDR from a deal size? And I don't know if you look at the concept of sort of attach rates here, but maybe from an attach rate perspective. And I guess what I mean by that is, how big is the typical IDR deal maybe versus traditional VM? And maybe relatedly, how often do you cross-sell IDR into your VM base? I understand if you can't share specific numbers there, but any color that you can offer?

Yes. Yes, we're not getting into specifics. IDR definitely has a much larger initial deal size. And one of the reasons is that we require customers to license their whole environment upfront. So we can't report on what we can't see. So those tend to be larger sizes upfront. With VM, the customers start with a portion of their environment and then that grows over time as they might start with their data center and their remote offices and they grow over time with more up-sells, whereas IDR is more upfront. We've seen very good cross-sell with IDR into the base. I believe right now, it's still -- about over half our IDR customers are also VM customers. And we still have a large opportunity within the base as we -- with IDR, we both do land and expand with those customers, and we still have many more customers in VM. So there's lots of opportunity in the base. So we're seeing good cross-sell opportunities. But with that, we've been really pleased with what we've seen so far. Strong contribution of new lands with IDR, and that drives a lot of the business. So part of the value of having leading products in the platform is that, I'll say it again, we can land with any one of our products and cross-sell over time, and we do see that in our customer engagements, and I'll harp on -- this is all fertile ground for durable growth going forward.

Got it. Got it. Andrew, I want to actually skip ahead on a topic that I want to make sure we touch on. And it actually has to do something -- has to do with what Corey talked -- touched on a little bit earlier this year, which is this concept of bundling, right? I think he's kind of talked more about that ARR per customer metric, which we're going to touch on a little bit more with Jeff as well. But on bundling, I guess, the question for you, Andrew, is what sort of bundling opportunities do you see here? And what has any of your preliminary research on bundling sort of showed you about the benefits? Does that make sense?

Yes. It does, Saket. I think -- and I was referencing or alluding to this earlier. I think first of all, probably we were talking a few years ago, right, we were still building a lot of these platform capabilities and we were investing in building out the core offerings. And I think -- if I think about what's changed over the last 3 years, first and foremost, if you think about bundling is, do you have a position to offer your customers a best-in-class solution, right? As Jeff just said, right, we believe we can land in any one of our offerings, and we have a very strong position, and we're seeing and regard it as a provider of a best-in-class solution. So I think there's that first question, which is can you meet the needs of your customers, if you can provide them with something that truly is best-in-class, right? And we share -- there's a few examples here. We were talking about IDR, et cetera, right? Now as we look at that, I think now we have this really unique opportunity because we have this common cloud platform. We have this land and expand motion. And so we've been piloting and experimenting with some of this. And it's not -- it's how do you deliver value for the customer but also consolidate and say, "Hey, if I can deliver more value, help you get more done at a better overall value proposition, we believe that's very compelling, right?" And so for example, I mean, we see not only within IDR, where people are able to get that endpoint telemetry, get that network data and consolidate that in, but now we see examples where with IDR, "Hey, I'm detecting and responding to potential attacks. But you know what, I may need some orchestration and automation to help scale my operations, right?" So as you said, Saket, ARR per customer, we believe is our core -- is a core driver and a core metric. But we are looking at it as an opportunity to drive the expanded value proposition across our offerings. And so it's early days. We're still exploring and still working through some of them, but we're very excited about the opportunity. And we do see that benefit as we exit '21, look at '22. But I think that's going to be the next really exciting chapter for Rapid7 is how do we provide more value to our customers and expand that share of our customer engagement and look at ARR per customer.

Got it. Got it. Maybe on that topic, for you, Jeff. I think ARR per customer is at roughly, let's call it, $40,000 per customer. And I think Corey has kind of talked about that potentially getting to about $60,000, and let's call it the medium term. And of course, you can do that in a couple of different ways, right? Whether it's driving more spending from your existing customers, kind of what you had talked about there, Andrew, or maybe it's winning more larger customers where the upfront lands are just bigger. And so the question for you, Jeff, is as you think about that path to $60,000, how do you think about that path in terms of those different ways of getting there?

Yes. Yes, it's a good question. We often say that we like our position is that we have a very healthy balance of our new ARR from the base and, of course, landing. If you look at the history of the company, it's -- it can vary quarter-to-quarter, sort of like 50-50. So 1 quarter could be 45 to 50 on new and then 45 -- and then 50 to 55 on land. In 2019, the focus and we talked about this is that we wanted to increase our new customer growth, and we had very good growth that year in 2019. And then the pandemic hit and obviously, we felt that there was going to be more from the base, which there has been year-to-date. But last quarter, we actually had a little bit over 50% from new, which was great. We had good customer growth last quarter. So I think we're well positioned. I like -- we all like the healthy balance. So over time, it's going to be a combination of both. It's going to be new customers and expansion within the base. And I'll say that really gives us the durability. In any one period, it could skew one way or the other. But over time, it sort of averages out. So there's multiple paths to get to that $60,000 number. The other point I'll make is that our ARR, what we've reported on is, if an average size customer bought all our products, that would be about $200,000. That is exclusive of Divvy. So now you add Divvy. At the time of the acquisition, there were $10 million and about 50 customers. So on average, that was about $200,000 a customer. So that also increases our ASPs with our security transformation products. So all that fuels into seeing how that number can get up to $60,000. And as I said, whether it comes from larger deals upfront or customers expanding over time, it will be a little bit of both. We're focused on more strategic, higher lifetime value customers. And all this supports the durable growth going forward.

Got it. Got it. About 5 minutes left here. So for anyone on the webcast, if you've got any questions, feel free to e-mail me at [email protected]. I certainly have plenty more questions to ask, but maybe I'll keep it to 2 last ones. So maybe the first one for you, Andrew. Maybe just to pivot back to VM for a second as we wrap up here. I'd love to just get a quick comment sort of on the competitive backdrop, right? What are you seeing from other VM specialists like the Qualys or Tenables of the world? And maybe relatedly, how much more share is there to be had as you think about sort of that long tail of other VM players, if you will?

Yes. Yes. So Saket, I would say, first and foremost, I mean, we haven't really seen any notable change per se in this kind of landscape, right, if you look at VM. I think we've talked consistently about we view ourselves and Tenable share gainers, right? You can see that in the respective company's growth rates, right? I think also, as your point about the market share, I think you can see that there's healthy concentration across the 3, right? But we believe, and we said that, as you just mentioned, right, there's opportunity to continue in the long tail, and we believe that VM remains a growth area, right? And we -- I think overall growth in IT and security spend will go up. We believe the environment is fragmenting. And customers are looking for, as you said, to consolidate and get better VM program. So we believe -- we feel good about the opportunity. We think there's healthy growth in the road ahead. And as we said, I think that will be a share gainer in that environment.

Got it. Got it. Jeff, maybe last question for you. I want to wrap up with profitability and cash flow. And I really want to zoom in on a comment that you've made a couple of times over the last couple of quarters about returning to the sort of profitability framework in fiscal '21, potentially returning to that profitability framework in '21, right, depending on the pandemic. And so the question is, Jeff, what does that mean to you, sort of broad-brushes in terms of the right framework when considering revenue growth and margin expansion. Does it make sense?

Absolutely. It's a good question, and a lot of investors have asked that. Look, there's a balance between growth and profitability. And we made the commitment back in the '17 that we would turn the corner and be profitable in '19, which we did. And I think the management has done a good job this year. We absorbed the Divvy acquisition with extra expenses. And of course, the pandemic, and we're still -- we guided to a small loss, and now we're guiding now again to a profit. So we think we've managed the company effectively during this year. So first and foremost, we're -- I'll say it again, we're driving durable growth responsibly. But as we scale, we should see efficiencies over time. And we will ultimately generate meaningful cash flow -- free cash flow. Next year, we'll turn the corner. We don't have a lot of facilities expansion. So that's pretty much behind us. So we've stated that we will be free cash flow positive next year. And with respect to the framework, this is the balance. And I'm going to reiterate it. And we said once we get back to some normalcy, is that if we grow 20% to 25%, we'll show margin expansion of 2% to 3%. If it's 25% to 30%, 1% to 2% and if it's 30% above, it will be less. But regardless, we will continue to, as we scale to show additional leverage each year.

Got it. Got it. A quick lightning round question here for Andrew. I know Andrew spends a ton of time with customers. So would love his opinion here, something we're trying to ask all our management teams. Andrew, as you spend time with customers, broad-brush, what are they saying about the willingness to spend in 2021, given the unique time that we've had here?

Yes. I think -- I love lighting round questions. I think in the short term, we are seeing customers making -- continue to make their decisions in their prioritized investments. I think long term, clearly, we feel very positive. I think in the mid term, there's a little volatility, obviously, COVID budgets, and there is some volatility there. Security is something that's critical that especially people are embracing this digital transformation. So I think we feel positive and feel good overall. But there's some volatility as we think about Q1, Q2, where -- and that's largely our customers think about their budgets in the new year and how they're managing that.

Got it. Guys, with that, thank you so much for the time. Really enjoyed it. I always have more questions for you, but also want to be respectful of your time. Look forward to we can do this in person next year, hopefully, so knock on wood.

Yes. Let's hope so. Thanks, Saket.

Thanks, Saket.

Thank you, Jeff. Thank you, Andrew. Thanks, Sunil. Have a good one.

Take care.

Bye now.