SecureWorks Corp.
Q1 2022 Earnings Call Transcript

Published: 3 Jun 2021

[Operator:]

Good morning and welcome to the SecureWorks First Quarter Fiscal 2022 Financial Results Conference Call. We are webcasting this call live on the SecureWorks Investor Relations website. After the completion of the call, a recording of the call will be made available on the same site. Now, I will turn the call over to Paul Parrish, Chief Financial Officer. You may begin.

[Paul Parrish:]

Thank you everyone for joining us. With me today is Mike Cote, our CEO and Wendy Thomas, our President of Customer Success. During this call, we will reference non-GAAP financial measures, including non-GAAP revenue, gross margin, operating expenses, operating income, net income, earnings per share, EBITDA, adjusted EBITDA and cash flow from operations. A reconciliation of these measures to their most directly comparable GAAP measures can be found in our web deck and press release, which are available on our IR website. Please also note that all growth percentages refer to year-over-year change, unless otherwise specified.

[Mike Coke:]

Thanks, Paul and thank you everyone for joining us on this call. I appreciate your interest in SecureWorks. Before I discuss the quarter, I am announcing my upcoming retirement as CEO and a member of the SecureWorks Board of Directors, effective September 3, 2021. It’s been an incredible pleasure and honor to have served as CEO of SecureWorks for almost 20 years. I thank our Board of Directors and all of my SecureWorks teammates over the years for this incredible opportunity. When I joined SecureWorks in 2002, we were a small team with a vision to protect organizations from the growing threat of cyber crime. Now, nearly 20 years later, SecureWorks is a global leader in cybersecurity, with the best threat intelligence and products to secure our customers and partners. We have grown from less than $1 million in revenue to over $0.5 billion. We had a great first quarter, which you will hear more about in a few minutes and we continue to execute on our strategy. Our future is even brighter as our momentum in Taegis customer acquisition, revenue and ARR continues to accelerate. I have put a lot of thought and preparation into this decision, working closely with the Board in recent years to prepare for this transition as we implement our succession plan. As a result, I am pleased to share that with my full support and recommendation, the SecureWorks Board of Directors has appointed Wendy Thomas to succeed me as the company’s next President and CEO, effective September 3, 2021. Wendy has been with SecureWorks for 9 years and has been instrumental in driving the company’s strategy, including our focus on software development and the launch of Taegis. Please join me in congratulating, Wendy.

[Wendy Thomas:]

Thank you, Mike. It’s a privilege to serve as our next President and CEO. We are at a pivotal point in our business and I am confident that the momentum of our transformation will drive value for all of our stakeholders. I will be working closely with Mike in the coming months to ensure a seamless transition. And I’d also like to thank Mike for his leadership and mentorship over the years. Mike has built the company into what it is today. And I know I speak for so many in wishing him the very best.

[Mike Coke:]

Thanks, Wendy. Wendy will also join me and Paul to answer questions during the Q&A at the end of this call. As I look across the threat landscape, organizations are facing an increasingly complex and hostile threat environment. Conventional point products operating and silos are not keeping up with the adversarial trade craft, resulting in an increasing number of breaches. Organizations need comprehensive visibility into our IT infrastructure and efficient detection and response to attacks, but the market is overloaded with more and more point products that increase complexity and we continue to have a shortage of security talent. In light of these challenges, our security products and expertise have never been in greater demand. Taegis, our cloud-native security analytics platform, defends against these evolving attacks. Enriched by our first-hand threat intelligence, Taegis provides threat detection and response across endpoint, network and cloud and offers a single solution for SIEM, XDR and SOAR use cases. We have made Taegis an open platform with hundreds of third-party endpoint, network, cloud and threat intelligence integrations. By correlating events from these tools, we provide the comprehensive visibility customers need while maximizing their existing investments. Let me give you an example. Recently, an employee at one of our customers clicked on a link in an e-mail, which downloaded and executed a malicious script. Almost immediately, the customer’s third-party endpoint product and Taegis XDR both triggered an alert. However, the endpoint product triggered hundreds of times for similar alerts across 30 different systems within the customer’s environment. Using the same data, Taegis focused on the behavioral aspect of the event. Embedded with our deep intelligence of how attackers operate, Taegis is able to separate the true malicious activity from the noise, only alerting the company one-time with the real threat. In addition, the attacker had successfully loaded a remote access tool on to the system, moving beyond the visibility of the endpoint product. Taegis identified this attack pattern and cutoff the intrusion with no harm to the customer. This is why Taegis is so powerful. It fills the gaps in visibility between point products that adversaries exploit providing a holistic defense. Moving to results. Our first quarter marked a strong beginning to the fiscal year, with clear progress. Taegis ARR has grown to $72.4 million and 17% of total ARR. Importantly, Taegis ARR growth on an absolute basis continues to accelerate with $17.5 million added to ARR this quarter, up 35% from $12.9 million in the fourth quarter of fiscal ‘21. Taegis revenue reached $14 million and the average revenue per Taegis customer was approximately $143,000. We ended the quarter with 500 customers on the Taegis platform, up 25% sequentially as we added 100 customers in the first quarter. Finally, even as we are scaling Taegis, we achieved total gross margins of 62%, the highest in our history.

[Paul Parrish:]

Thanks Mike. As noted in Q1, our Taegis ARR grew to $72.4 million at quarter end, revenue grew to $14 million and we finished with 500 customers. We are most excited to see our ARR and customer momentum is accelerating sequentially, reinforcing our conviction that we can significantly scale the platform this year. Q1 revenue was down 1%, primarily driven by a reduction in non-strategic areas of the business as we pivot toward Taegis growth opportunities. Total subscription customers were 3,600, down from 3,800 at year-end. Taegis customers increased from 400 to 500, while managed security subscription customers decreased by 300. While our total subscription customer count is declining, we see a shift to better long-term economics. Whereas Taegis customers have an average ARR of $143,000, the medium ARR per customer loss in Q1 was $22,000. Gross profit margins were 61.9%, up 170 basis points sequentially and 380 basis points year-over-year. Sequentially, we benefited from strong demand and incident response resulting in high utilization of our teams, favorably impacting overall gross margins, while we are continuing to scale Taegis. Year-over-year, we have seen significant improvement in our subscription-based solutions margin and expect a longer term benefit from improving mix as our mix of software sales increases. Operating expenses were up 1%. R&D expenses increased to 19.4% of revenue, up from 16.1% in Q1 fiscal year ‘21. And we capitalized $1.6 million in incremental R&D spend as we accelerate investments in our security analytics platform. Sales and marketing expenses were 25.6% of revenue, down 40 basis points. And general and administrative expenses totaled 13% of revenue, down from 14.5% last year, with the difference primarily attributable to professional fees and consulting costs last year. Adjusted EBITDA margin was 5.8%.

[Operator:]

We will take our first question from Saket Kalia with Barclays. Your line is now open.

[Saket Kalia:]

Okay. Great. Hey, good morning guys. Thanks for taking my questions here and congrats to both Mike and Wendy on your next chapters.

[Mike Coke:]

Thank you.

[Wendy Thomas:]

Good morning. Thank you.

[Saket Kalia:]

Good morning. Wendy, maybe just to start with you and Mike, feel free to chime in here. But maybe you could talk a little bit about what you are seeing as core MSS customers have the option to convert to MDR, right or let’s just say, convert to Taegis. What sort of churn rate are you seeing as those customers make that decision? And conversely, what sort of run rate opportunity are you seeing as they – as some of them do make that conversion? Does that make sense?

[Wendy Thomas:]

It does. Yes, thanks for that. So, the great news is that our MSS base makes a great target for conversion to Taegis. And as we have talked about before, we started a more formal program around that in fourth quarter of last year, and we are actually seeing acceleration of that conversion rate to Taegis, just as we see an acceleration on new customer adds to Taegis. And what’s been great is that we see them, on average, actually increase spend with us in that process, and that primarily comes from them increasing the coverage to their full environment right across endpoint cloud network business systems. And so they both gain in terms of efficacy, efficiency because of the extension into investigations that are more automated and response capabilities, so there is an added benefit in ROI for them and an increased capture and spend for us. And you will see that in our increasing total average revenue per customer, and that’s driven by those higher average revenue per Taegis customers.

[Saket Kalia:]

That’s great. Very helpful. Maybe for my follow-up for you, Paul. I think you touched on this a little bit in your prepared remarks, but I was wondering if you can just talk a little bit about the differences in gross margin profile across sort of the, let’s just call it, the 3 main parts of the business, right, MSS, SaaS and SRC, even anecdotally. Just to sort of get a sense for kind of how that shift could kind of play out over time?

[Paul Parrish:]

Yes. We talked about this some in the Investor Day when we had that last December. We haven’t disclosed at that level of detail in our numbers. And as we continue to explore disclosures going forward, clearly, that’s something we will look at and evaluate over time as size and scale occurs with our Taegis deployment. So, look at – I think, as been discussed in the past, our SRC margins are ones that we are happy with. But of course, over time, we see the Taegis margins, as we sell more and more software only, those margins will grow resulting from that. So, size and scale is very important to continue that growth of the gross margin curve as Taegis is deployed.

[Saket Kalia:]

Got it and very helpful guys. Thanks again.

[Operator:]

Thank you. Our next question comes from the line of Mike Cikos with Needham & Company. Your line is now open.

[Mike Cikos:]

Congrats. Thanks for taking questions this morning. Congrats on the strong quarter. I was curious if we could dig into the gross margins. Paul, I think you had a comment that there was a partial benefit from higher utilization of your teams regarding the strong demand for instant response. And I am curious can you help us think about what that benefit was for the quarter as we are trying to look out for the remainder of the year if gross margins should normalize downward if that incident response may enlightens up?

[Paul Parrish:]

Well, we did benefit from that, and we are very proud of our teams, how they responded to everything that’s going on in the world, as we all know from reading a newspaper. The margins benefited. We didn’t disclose how much that benefited from. But keep in mind, as we go through this year, this is a transition year for us as we are ramping up the efforts around Taegis, gaining scale and size with customers on that. And there will be pressures on margin as you go through the movement between our customer base and could continue to improvement it from IR. That’s something that comes as the demand develops. And we all know that’s strong in the economy right now, but that’s not something we control. That’s what’s happening in the environment.

[Mike Cikos:]

Understood. Okay. And then I guess the other question that I have for you, I know that you guys have been investing in the MSSP track as well as sales and marketing in general. So, I am curious with this decline that we saw in Q1, at least on a year-on-year and sequential basis, how should we think about sales and marketing as we move throughout the remainder of the year?

[Paul Parrish:]

Yes. So, we are going to be continuing to invest in sales and marketing. As you are ramping a channel distribution up, there will be costs on the front end, and we will see that affect of FY ‘22 as part of the transition year.

[Mike Cikos:]

Great. Thank you, guys.

[Paul Parrish:]

Thank you.

[Operator:]

Thank you. Our next question comes from the line of Hamza Fodderwala with Morgan Stanley. Your line is now open.

[Hamza Fodderwala:]

Hey guys, good morning. Thank you for taking my question and congrats to Mike on the retirement and congrats to Wendy on the new CEO appointment.

[Mike Cote:]

Thank you.

[Wendy Thomas:]

Thank you.

[Hamza Fodderwala:]

Maybe for – my first question for Wendy and Mike, just around sort of the momentum you are seeing around the partnership ecosystem, so you announced some new distribution partnerships for Taegis. I think I have read one in Asia Pac. Can you talk a little bit more about how you are trying to bring on sort of net new distribution partners to the Taegis XDR platform? And then I have a quick follow-up for Paul.

[Wendy Thomas:]

Sure. I can talk a little bit about that. So, glad you read the recent announcement. And as you know, we have been focused on building out our channel program, and there is sort of a two-part focus to that. The first was really starting with expanding our distribution and resale relationships. And the second, which was launched more recently in May is the managed security service provider partner program. And no small part of that MSSP program is continuing to work with distributors and resellers on the first part of the strategy with respect to channel to really create this force multiplier for us to address, frankly, a growing market opportunity and extend the reach of the platform. So, we are really pleased with the momentum of the number and the quality of partners and distribution partners that we’ve signed up to date. I think you’ll see us continue to grow and announce those partnerships, and see traction from that over time over the course of the rest of the year.

[Hamza Fodderwala:]

Got it. Helpful. And then just a follow-up for Paul. Paul, you mentioned some of the transition impact. But at what point do you think we can get to a point where we sort of reach an inflection point in overall ARR, where it starts to grow again? Is that going to be beyond FY ‘22? Could we see that potentially later this year? Any color you can give us there?

[Paul Parrish:]

Yes. So we haven’t given guidance beyond this year. And we want to give a guidance on the ARR related to Taegis, which we’re very excited about. And you can see in the growth percentages as we grow up to greater than $150 million in ARR. So we discussed some of this when we had the Investor Day, and you can go back to look at the growth that we talked about during the Investor Day, but look out beyond FY ‘22 for that occurrence. And ‘23 wouldn’t be outside the norm or some expectation.

[Hamza Fodderwala:]

Thank you.

[Operator:]

Thank you. Our next question comes from the line of Brian Essex with Goldman Sachs. Your line is now open.

[Brian Essex:]

Hey, good morning. Thank you for taking the question. Wendy and Mike, congrats from me as well. Wendy, looking forward to working with you and my best of luck on your next desk.

[Wendy Thomas:]

Thank you.

[Brian Essex:]

Maybe if I could dig in a little bit to the customer growth. If we look at the Taegis customer growth, just want to get a better understanding of where those customers are sourced from, how many are conversions from the existing installed base? And what is the primary motion of customer acquisition on the Taegis platform at this point?

[Paul Parrish:]

Yes. So the growth coming roughly from half from existing customers have from new logos. And the excitement around Taegis is causing many people to look at our product with excitement and purchasing it. And so we’re excited about that. I think over time, the growth in new logos will continue to go up that curve and the existing customers will come down as a percentage, but roughly 50-50 right now.

[Wendy Thomas:]

And I’ll just add in, as we mentioned, we are seeing accelerating momentum in both new customer additions and the number of customers that are resolutioning onto the platform. So you’ll see that combined kind of fuel to the growth. And in terms of total logo count, the pressure you see is really around the churn of much smaller customers, so the median customer that that we lost had an average revenue of about $25,000. So it’s just a reflection, frankly, of our – the shift in our business model kind of further up market and powered by that – by the momentum that we see on both sides of the house on Taegis.

[Brian Essex:]

Right. Right. That makes a lot of sense. So thank you for that. And I guess, what is that process like? Have you – if – within the installed bases you’ve identified or I imagine you identify customers that are kind of ripe for conversion. How far are we through that process? And does that become a competitive process? Is this a catalyst for customers to evaluate other options outside of SecureWorks? Or do you have a natural benefit as an incumbent in that relationship and you’re familiar with that form and you’ve already started that education process so that you kind of grease the rail, so to speak, to onboard existing customers for conversion on the Taegis? Just want to get a better understanding of how that process manifests itself in your customer growth.

[Wendy Thomas:]

Great question. And as I mentioned, as we’ve gone on this journey with our customers starting late last year, we’ve certainly improved a few things that you touched on. First and foremost, we’ve always approached this as making sure that for our customers, it feels like an upgrade experience. We do have the advantage of knowing them very, very well, right? We know everything about their environment and their security use cases. And so we make that process as painless and seamless as possible. The second thing to your point about potentially exposing this to become a competitive bidding situation, what we have done is approach customers who are the right it now and that makes sense for them, regardless of when their contract end date is. And in fact, it’s been better to have that conversation well in advance of their renewal date because we are perfectly fine to exchange contractually committed spend from one platform or set of solutions to the other. And that tends to not open up a competitive situation as a competitor is unlikely to do that.

[Brian Essex:]

Got it. That’s super helpful. Thank you very much.

[Operator:]

Thank you. We will now take our final question from Sterling Auty with JPMorgan. Your line is now open.

[Sterling Auty:]

Hey, guys. Hopefully, last but not least. Mike, it just seems like yesterday that we were standing at RSA having our first conversation. So congratulations on a wonderful tenure growing the company from as small as you started to where you are now, is no small feat. Wendy, congratulations and well-deserved on the appointment.

[Mike Coke:]

Thanks very much, Sterling. Was that RSA event 20 years ago or 10 years ago?

[Sterling Auty:]

Yes, exactly. I’m just going to say, yes, and leave it there.

[Wendy Thomas:]

Good answer.

[Sterling Auty:]

So I just wanted to dive into Taegis in terms of the customer profile. Given the average size, it would seem that it looks like it’s trending towards a larger customer. I’m kind of curious if you can give a sense of where you’re seeing the sweet spot of the land? And then I have one follow-up.

[Wendy Thomas:]

Sure. I’m happy to take that. So you’re right, and you can obviously see that reflected in the growing revenue per. And as we’ve talked about before, we really target what we would term sort of mid-market in terms of security program as opposed to necessarily the size of the customer because, clearly, in the financial services sector, for example, highly mature customers who have been dealing with regulatory compliance around security and just frankly, being the target of attacks early, early on that they have advanced much farther than necessarily some other industries. And so what we talk about is really customers who are willing to invest in security, but they might have a very small security team with kind of a road map and a desire to increase their maturity with a partner like us or folks who put together sort of best-in-breed solutions, and they are looking for a platform to basically help them scale across all of their point products in place and drive kind of efficacy and efficiency across their security stack, whether they are assembling those solutions or they are looking for a partner to run security with them, that tends to be our sweet spot of both new customers and customers that are transitioning over. And they are willing and able to invest in the security program that’s really driving an amount of spend with us, that’s probably the right business model for us.

[Sterling Auty:]

That makes sense. And then on the new logos that you brought in, I’m curious, who are you seeing as that final short list of vendors that are buying for those opportunities and are you actually, in all these cases, going through some sort of official RFP? Or are they just looking to you as a vendor and they are not really going through a full-blown bake-off process, they are just coming to you because of your expertise in the industry?

[Wendy Thomas:]

We really see a mix of both. Well, I’ll say this. We definitely see customers that commensurate to us simply because of our reputation in the marketplace. We also have customers who do it easier term a bake-off, but not necessarily kind of a formal RFP process. And I think that’s related to the target segments that we primarily operate in. When they are doing that sort of comparison shopping, I’d probably, call it, the ability to, frankly, deploy our demo in their environment and immediately start to see detections that they hadn’t seen before, tends to help us. And to do that not just on their endpoint or in a container environment, but to be able to see that holistically across their network, that tends to help us of a pretty high win rate as soon as they sort of see what they are dealing with. So they may have other players in there doing a similar demo who want to put in their own proprietary tech stack. So we tend to win with this open platform approach.

[Sterling Auty:]

Right. And competitively, when you see – who are you competing – what products you’re competing against most frequently?

[Wendy Thomas:]

Well, there is certainly some emerging XDR players who may be in the mix or it may simply be a sort of a bake-off of security spend or share of wallet as we introduced capabilities recently around sort of covering many of the SIEM use cases and can help customers reduce their sort of total cost of ownerships with features in our XDR platform that cover use cases for other point products. That also tends to help us win in those types of share of wallet bake-off.

[Sterling Auty:]

Makes sense. Thank you.

[Wendy Thomas:]

Sure.

[Paul Parrish:]

Well, thank you. That wraps the Q&A in today’s call. A replay of this webcast will be available on our Investor Relations page at secureworks.com, along with our Q1 and full year fiscal ‘22 web deck with additional financial tables. Thanks again for joining us today, and have a good day.

[Operator:]

Ladies and gentlemen that concludes today’s call. You may now disconnect at this time.