Rapid7, Inc.
Q1 2021 Earnings Call Transcript

Published: 7 May 2021

[Operator:]

Good day. And thank you for standing by and welcome to the Q1 2021 Rapid7 Earnings Conference Call. I would now like to introduce your host, Sunil Shah VP of Investor Relations. You may begin.

[Sunil Shah:]

Thank you, operator and good afternoon everyone. We appreciate you joining us today to discuss Rapid7’s first quarter 2021 financial and operating results, in addition to our financial outlook for the second quarter and full fiscal year 2021. With me on the call today are Corey Thomas, our CEO and Jeff Kalowski, our CFO.

[Corey Thomas:]

Thank you Sunil and good afternoon everyone. Thank you all for joining us for our first quarter 2021 earnings results call. I'm thrilled to report a strong start to the year for Rapid7. As we accelerated year-over-year ARR growth to 30%, while demonstrating strong free cash flow dynamics in our business. We continue to execute against our goal of delivering best-in-class security that meets customers where they are in their SecOps journey.

[Jeff Kalowski:]

Thanks, Corey and good afternoon everyone. Before I begin a brief reminder that except for revenue, all financial results we will discuss today are non-GAAP financial measures unless otherwise stated and reconciliations between our GAAP and non-GAAP results can be found in today's earnings press release. Rapid7 had an outstanding start to the year with ARR acceleration driven by strong execution across our business, while underlying leverage drove upside to Q1 profitability. Total ARR ended the quarter at $455.8 million, growth of 30% year-over-year driven by accelerating demand for security transformation solutions and sustained growth in our vulnerability management offering.

[Operator:]

Our first question comes from Rob Owens with Piper Sandler.

[Rob Owens:]

Great. Thanks for taking my guys. Want to drill in a little bit around the ARR acceleration that you saw and also new customer acquisition. First-off with Alcide, was there any contribution there even minimal that kind of aided that maybe you can drill down a little bit more than to what you're seeing from a new customer perspective, especially given since we're – we still have COVID kind of running rampant.

[Jeff Kalowski:]

Yeah. Rob, I'll start out. With respect to Alcide that was immaterial, there was no – there's no material contribution to ARR in the quarter for that matter for the year. It's not significant.

[Corey Thomas:]

Yeah. I’ll just follow up. I would say the ARR performance that we saw was really just based on both strong demand and strong execution by our teams across the overall portfolio. And so we saw both customers, new customers coming in, which was healthy. But we also saw good performance across customer segments. We had one of our strong quarters and large deals strengths over 50% there. So we feel very good about that. I think it just validates our investment strategy and the path that we've been on for the last few years.

[Rob Owens:]

Great. And then Corey secondarily wanted to ask about XDR versus next generation SIM and what are the value proposition that they're talking about is consistent with where you've been for years and especially one of the verge of RSA here in a couple of weeks, which is obviously the noisiest events around security. Are you starting to see the XDR proposition, especially from the guys converge relative to what you're offering in your space or do you see these as discrete in different opportunities?

[Corey Thomas:]

Yeah, I would say what we're talking about – what people are talking about XDR today is sort of a trend that we observed years ago, and one of our core thesis areas around our InsightIDR platform, which was the idea that you could not tackle security and especially security monitoring in silos. And so we were a pioneer in bringing UVA log analysis, attacker-based analytics, but also endpoints visibility into the fold. We accelerate that with our Velociraptor acquisition in this quarter. And so when we look at it holistically, we think, do you actually need a holistic very-advanced and sophisticated but easy to deploy strategy for monitoring and managing your environment, absolutely. Is our strategy overlapping, are they great areas of XDR? Sure, but there's still distinct needs. What you get with a platform like InsightIDR and SIM is you get a complete log in a forensic platform, you get a platform, especially with our extension that allows you to actually fully monitor and extend into the cloud and have full visibility about what's going on in cloud environments and monitor those environments and automate remediation. And so the strategy about how you manage your model you saw absolutely is aligned around the XDR theme. And that's why your guard and others talk about it. But there's still some rather unique needs that you still need logging platforms in a SIM to bring the bear.

[Sunil Shah:]

Operator we'll take the next question.

[Operator:]

Okay. Thank you. Your next question comes from Matt Hedberg with RBC Capital Markets.

[Matt Hedberg:]

Hi guys. Thanks for taking my questions, congrats on the acceleration. You're great to see. Corey, I think this idea of closing the security achievement gap is one of the most interesting aspects of Rapid7 kind of due to the automation of the platform. How much of this do you attribute to the accelerated customer as this quarter? But I think also secondarily, how does it help with your renewals of your existing base?

[Corey Thomas:]

Yeah, it's two very good questions. So one on the ads, look our value proposition is resonating with customers. We had the thesis early on that customers would need to do a significant upgrade of their security infrastructure to keep up with digital transformation and that is playing out quite well. And I remind you that our thesis was that, they would want best of breed and best of suite capabilities. So they didn't want to – they would not want to compromise on the quality, the efficacy and the raw capabilities but they wouldn't want to actually give that package that gave them economic scale leverage, and most importantly productivity. And so our focus on accessibility drives that. And so, yes, we're seeing very healthy demand overall. And we think that promise in that value proposition resonates quite well. I think the second part of your question is what are we seeing with existing customers? And we are seeing existing customers continue to actually be committed to Rapid7. You see what the growth in ARR per customer they're extending their relationships and they're continuing to actually renew at very favorable rates.

[Matt Hedberg:]

That's great. And then I think, the other compelling part of the story is international it seems like a huge opportunity as well. And I guess, how do you approach thoughtful investments overseas? And I'm going to have to assume all of the issues that we see domestically are going on internationally, but how do you sort of allocate your resources to go after that in a thoughtful manner?

[Corey Thomas:]

You are absolutely right about the international opportunity. I would say that one of the benefits is that as you recall, we started investing last year as we start to see the momentum and the response to demand. And that set us up well for this year. And what I’d say is we’re going to continue to drive for a model of growth and profitability. And with that, we'll continue to invest as we see fit. International is a different story in each region of the world. But overall, we see, very, very good demand from our international regions, especially we see growing demand for our security transformation solutions.

[Matt Hedberg:]

Thanks a lot, guys.

[Operator:]

Our next question comes from Saket Kalia with Barclays.

[Saket Kalia:]

Hey guys thanks for taking my questions here. Corey, maybe first for you. Could you just talk a little bit about the overall customer demand environment, mainly in the vulnerability management market? And whether you feel like some of the breach activity from last quarter even – you’ll see as recent as this quarter is maybe starting to drive some more pipeline, or more deal activity?

[Corey Thomas:]

Yes, so I would say to your specific question, we are seeing very healthy demand across the board. Vulnerability management is one of those areas that had seen consistent demand. And we saw improvement demand this quarter. We feel that we have good visibility that if we said it was sort of like roughly 10% before that our growth will be over 10%. Can we have confidence in that or this year, I think? But most importantly, what you see as the story of the total value proposition and especially the strength of the security transformation solutions. And also in the efficacy of our fields now that they can actually go out and talk to customers about the problems that are on their mind or at the top of their list and start wherever customers want to start on that journey. And so, when we look at the demand, we really think about our perspective about what's going on with customers. And customers are looking to enhance and upgrade their security. And we are incredibly well positioned to do that with the investments and the execution that we made over the last few years.

[Saket Kalia:]

Got it. Got it, that makes sense. Jeff, maybe for you. That 17% growth in ARR per customer it's been very consistent, but just really nice to see. I think we've touched on a few of the drivers here kind of through the call, but can you just maybe sort of summarize what's, some of the most meaningful drivers are in that ARR per customer? I imagine some of it is mix shift in the business, but anything else that you would sort of point to that's sort of driving that consistent growth in ARR per customer?

[Jeff Kalowski:]

Yes, sure. First off with respect to mix shift, clearly our security transformation solutions are a very big driver. Again, it's growing, it grew over 40% again, this quarter, and also represented over 50% of our new ARR. Those tend to have larger ASPs as well. You've heard Corey talk about, seven of our ten largest deals. We have multiple products on the platform. We had very strong cross sells and upsells this quarter. I'll also point out that we had modest improvement sequentially in our net retention rate. So, overall, all the four growth drivers that we laid out in Investor & Analyst Day, we've executed on all of them, customer growth, growth in platform customers, strategic customers. So, I would say overall very strong quarter.

[Saket Kalia:]

Got it. Thanks very much, guys.

[Jeff Kalowski:]

Thank you.

[Operator:]

Our next question comes from Brian Essex with Goldman Sachs.

[Brian Essex:]

Hi, good afternoon. Thanks for taking the question. Maybe Corey or Jeff, whichever wants to kill this one, you took your guidance up by greater magnitude than the level it would be relative to the midpoint of the 1Q guide. So maybe if you could talk to what's driving that confidence, is it pipeline, is it maybe the economy opening up better than expected, or is it just old-fashioned execution? How would you kind of grade the increased confidence in higher level of growth this year?

[Jeff Kalowski:]

Well, I mean, clearly when we look at guidance, our pipeline is a major factor. And so I'll say like pipeline was the real significant factor, overall fall because we've been in periods of uncertainty with what we're expecting. But most importantly, what we're hearing from our customers in terms of their certainty, and their competence and their budgeting process. Keep in mind in the last year, we haven't lacked pipeline, what we've lacked is clear confidence of lots of our customers about what their own budgetary processes are. And we're not outward there at all by any means, but we are seeing customers having more clarity into their processes, and that's going through to our ability to better forecast timing when it comes to our pipeline, which then goes through the guidance.

[Brian Essex:]

Got it. And maybe just to follow-up on that, where do you anticipate to re-invest the upside? You are leaving operating performance relatively flat in spite of the revenue raise. So, what are your key priorities and how do you kind prioritize where that spending will go?

[Corey Thomas:]

Yes. So a couple of things, one is, if you think about our strategic framework on driving leverage and scale, the first thing is sort of like relevant. So we can keen to invest in our innovation platform and our technology and R&D because that gives a long-term return to our customers. And that’s all for to our investors over time. The second thing is that we’ll continue to actually make investments that are near-term investments that give us long-term scale. You would call it our investment analysts. They would talk a lots of the work that we’re doing on both packaging and pricing and how we actually position and scale the platform and do land and expand as we actually go forward. And we still have near-term investment opportunities that we believe that we can invest and achieve our balanced view of growth and profitability this year. They give us a more scale and more efficiency over time.

[Brian Essex:]

Got it. Very helpful. Congrats for me as well on the results nice quarter.

[Corey Thomas:]

Thank you.

[Operator:]

Our next question comes from Jonathan Ho with William Blair.

[Jonathan Ho:]

Hi, good afternoon. So I just wanted to maybe start with one of your comments on what you said that you were making it easier for your consumers or your customers to consume your products. Can you talk a little bit about how you’re making it easier? And is this a bundling approach? Or is this – in terms of the technical integrations, I’m just trying to understand a little bit better what you mean by making it easier to consume?

[Corey Thomas:]

Yes, it’s a great question, Jon. So there’s a couple of different dynamics. The first one is to your point about the technology is, we’re doing lots of things as customers start to actually look at us more for their platform level security and how they think about the security overall to actually make it seamlessly move from one problem to another problem without having to think about the context of what package did I purchase. And so I have a cloud security offering that I decide that I want to actually monitor what’s happening. And this was part of my environment. That should be a seamless thing that I can do with efficiency without having to think about, do I need to go get another SIM? I may have a SIM in place, but I may want to just really monitor this area and focus on this area. Likewise is that I’m doing application security and I want to say like, what’s happening with the cloud stack under the specific application. Again maybe I want to go do a whole different cloud deployment, but maybe I just want to get more depth and visibility there. So there’s lots of work that our teams are in the process of doing on just continuing to improve the ability for customers to dynamically expand their security and response to what’s happened in their environment. Keep in mind. Their environments are changing fast and the attackers are changing fast. And so we want to minimize errors. Now, the second aspect that we’ve talked about a lot is we’re doing both lots of research and lots of pilots on packaging and pricing to say what eases the consumption bar that makes it easy for customers to consume. We talked about one of those Insight one this quarter. That’s been extraordinarily well received by customers. We talked I think last quarter about our modern stock that allow people to not just get InsightIDR, but to get Enhanced Endpoint Telemetry networks stock analysis and store together, extraordinarily popular. But these are things that allow customers to really either upgrade or actually buy together things that are logical and efficient and that’s resonated quite well with customers.

[Jonathan Ho:]

Got it. Got it. And then can you also talk a little bit about sort of the demand that you’re seeing on the cloud side and potentially how that impacts your upsell or ARR potential? Thank you.

[Corey Thomas:]

Yes. The cloud is a hot area right now. It’s early stages and the market overall but we’re seeing extraordinarily strong demand for customers from near-term demand, but also longer-term demand we’ll get lots of validation customers that these are strategic focus areas that they’re going to be focused in over time. And so, yes, from an execution perspective and from an outlook perspective, we’re extraordinarily competent and bullish about what’s happening across security market.

[Jonathan Ho:]

Thank you.

[Corey Thomas:]

Thanks.

[Operator:]

Our next question comes from Adam Tindle with Raymond James.

[Alex Frankiewicz:]

Hi, thanks. This is Alex on for Adam. I’m just kind of curious how the adoption of the good, better, best strategy is going and just how the channels reacting to that. And also is it formulaic, that is to say once you identify customer and the good bracket, do you have a kind of a roadmap and how long it’ll take them to get to the better and the best bucket?

[Corey Thomas:]

Alex, it’s way too early. I mean it’s a great question. That’s just way too early to have inclusive. I would say the feedback that we’ve gotten from customers so far is actually positive. It’s just way too early in the evolution. For us to have any deterministic feedback, I would not expect that just to set expectations to late this year at the earliest because it’s really it’s about sort of like getting enough quantitative feedback, if you optimize it. And by the way, the good, better, best notions are like popular they're out there. You just have to make sure that you actually got the exact piping levels, right? And the exact balance of what's in each bucket, right?? And those are the things you actually get with a lot more volume of engagement.

[Alex Frankiewicz:]

Okay, perfect. Thanks. And then secondly, when you go into a bake-off, what is the driving – is there a driving product? Do you lead with VM or SIM? Or are customers meeting to kind of evaluate Rapid7 as a platform in adopting a broad portfolio? And can also just speak to the number of new logo wins that are taking multiple products at once versus just kind of a point solution?

[Corey Thomas:]

Yes. And so on your question is that part of our strategy is we believe that customers will not compromise on quality. And so this best of suite concept means that we can lead and we do today successfully lead with any of our products. And our sales team now the competence, and they can go hit the head and do a bake off in cloud in VM, in the SIM category, even XDR category and win and be successful. And so, and that was a key criteria. Once you start to see a merchant, this is where we actually got to some of the pricing is that we now have more and more customers that are coming in, talking to us from a platform perspective about how to think about managing their complete security operations. And that's still a new motion for us, but it's one that's actually quite promising and we're seeing more deals occur in that vein, but it's still very, very early days.

[Alex Frankiewicz:]

Thanks, man. I may have missed it. Did you give the renewal rate this quarter?

[Jeff Kalowski:]

No, we did not. As we talked about an analyst day, it’s not a key metric that we're managing to what we did say is in terms of some contexts, is that it didn't improve sequentially, but we're not disclosing that metric going forward.

[Alex Frankiewicz:]

Okay. Thank you.

[Operator:]

Our next question comes from Hamza Fodderwala with Morgan Stanley.

[Hamza Fodderwala:]

Hey guys, thank you so much for taking my questions. Corey, I had a question for you on the Velociraptor acquisition, cool name by the way. Just as far as, how do you see it? One, is this a data late play and that this is a open source tool that's bringing in, obviously a lot of third-party data. Is it more of a – things were getting better automation on the incident response side? Can you maybe dig into that a little bit? And then also, how do you kind of integrate that acquisition? Just given the fact that there's probably partner at Velociraptor might have that may also be competitors yours?

[Corey Thomas:]

Yeah. So we think about this Velociraptor it's built a brand in the open source community. When cycling companies all over the world as the leading endpoint into the cloud platform. And if you think about what we're doing in the IDR space, or if you think about the context of XDR, is having to lead an open source sort of technology embedded into our InsightIDR platform gives our customers that much more capability and response, especially combined with our automation platform. So that's the focus, I would say, it's incident response and automation is center of the endpoint, which is still one of the primary attack vectors and the response capabilities that you actually need are different than what you actually get in a lot of other platforms that are on the market. So again, this is a simplified solution for us. How do you allow customers to do advanced – have advanced capabilities, but they're easy to use. And this falls into that bucket, as far as the overall Velociraptor ecosystem, it's an ecosystem that's primarily companies and enterprises all around the world and those companies and enterprises can continue to use Velociraptor for their internal use. We don't have a big focus on like OEM and our core technology, as you know. With that said, we've talked before about, we have huge demand that we are filling in the managed service space. And so there's an opportunity for managed services partners. They actually leverage to use the technology.

[Hamza Fodderwala:]

Got it. Thank you.

[Operator:]

Our next question comes from Alex Henderson with Needham & Company.

[Unidentified Analyst:]

Hey team, you have here on for Alex. Thanks for taking the questions. One of the touch on the ARR acceleration and the strong demand environment that you guys are talking to. I'm interested, if you could touch on how much of this you would attribute maybe the budget coming to the market now that there've been a couple of months between us and the SolarWinds or the Microsoft Exchange Server hack. And is it fair to assume, when I think about the SolarWinds hack maybe demonstrating to the mid-market and SMB that that no company is too small to worry about being hacked, right? So are these segments of the market may be moving towards you in a way that they hadn’t before?

[Corey Thomas:]

It’s a good question. We had good performance and I would say the mid enterprise where we focused versus sufficient small, but I would say, our best performance, I think, we saw very, very strong performance and the large deal strength. We got over 50% growth and the deals that over a 100,000. And so I would say it was probably balanced. And one of the characterizations, I give for this quarter is that we had a good performance across product categories. That, of course through the transformation solutions was higher. We had good performance across segments. So I don’t – I think the mid market was actually strong. But we saw great performance in the large deal side of the equation. And to your first part of your question about what’s the impact of the breaches? Look, when you actually have an environment where people are more aware of security, and they focus more on security, that makes it easy. I think what’s especially critical right now is two combinations, is – three together. One digital transformation is a big priority that people are aware of this. But the second one is that because of some of the incidents that you actually talked about is security is a higher profile within a company, the leadership teams. But the third one is just as important, I think organizations are getting a better handle and visibility on their own finances, which then allows them to actually finance the things that they actually think are important. I think all of those things are coming together and again, it’s not perfect as we’re still not seeing companies that have their full 12-month budgets like the pre-pandemic. But we are seeing people with lots, have lots and lots more visibility into their budgets overall.

[Unidentified Analyst:]

That’s very helpful. Thank you for that. And one more, if I could on the competitive front, just interested, if you guys are seeing any changes in the market, I know obviously you’re making these investments in the platform, making it easier to consume for customers. And to the extent that you can comment, if – when I think about someone like a Qualys and Tenable, how often are you guys actually seeing them in the market when it comes to competitive offers? Thank you

[Corey Thomas:]

For VM specifically, we’re in the market, keep in mind, we actually have it at the point that we are now a range of deals that some of them are competitive. Some of them are uncompetitive because people talk to us about our platform, but while I would say that the competitive dynamics in the VM market have not changed substantially for pretty long while now you still have the same trends that you’ve actually always had.

[Operator:]

Our next question comes from Joshua Tilton with Berenberg Capital Markets.

[Joshua Tilton:]

Hey guys, thanks for taking my question. For my first one I was – when you guys talk about the security transformation solutions growing north of 40%, can you just give us some color on the growth? Is this growth accelerating is the demand for these solutions pick up and how should we think about the pace of growth throughout the remainder of the year?

[Corey Thomas:]

Yes, well, we’ve only talked about sort of like the – what the growth rate was being about 40%. What I would say is that we have very, very healthy demand overall, I would say we have increasing confidence and visibility into this, which is part of the reason that we were able to actually get the guy and raise that we did, but we’re not actually giving detailed breakdown of the numbers about the specific sort of numbers for each part of the portfolio. We emphasized that it was over – we do expect it to grow over 40% this year, and we expect the VM to go over 10%. We’ll give you that high level of characterization seen you have some visibility.

[Joshua Tilton:]

That was helpful. And when you guys mentioned that deal for Insight one you had a customer that basically bought the entire Insight platform. Can you give us any insight into kind of which vendors you replaced with that deal?

[Corey Thomas:]

The question, I don’t have the specific vendors that we replaced of the tip of my tongue, but I would say if the proposition is simple, and we believe this all along, if you can actually upgrade your security and you’re not having to actually make trade off, that you’re actually getting best-in-class technology, and at the same time you actually get economics and you actually get sort of like a great support experience, then that’s compelling overall. And so while we did replace some competitors there I can’t remember what specific one right now.

[Joshua Tilton:]

All right. Okay.

[Corey Thomas:]

Thanks.

[Operator:]

And I’m not showing any further questions at this time. I’d like to turn the call back over to our host for any closing remarks.

[Corey Thomas:]

Well, thank you all so much for joining us today on the call. And we wish you all a good weekend coming up.

[Operator:]

Ladies and gentlemen, this concludes today’s presentation. You may now disconnect and have a wonderful day.