SecureWorks Corp.
Q3 2021 Earnings Call Transcript

Published: 3 Dec 2020

[Operator:]

Good morning and welcome to the SecureWorks Third Quarter Fiscal 2021 Financial Results Conference Call. We are webcasting this call live on the SecureWorks Investor Relations website. After the completion of the call, a recording of this call will be made available on the same site. Now, I will turn the call over to Paul Parrish, Chief Financial Officer. You may begin.

[Paul Parrish:]

Thanks everyone for joining us. With me today is Mike Cote, our CEO and Wendy Thomas, President of Customer Success, will join us for questions at the end of our prepared remarks. During this call, we will reference non-GAAP financial measures, including non-GAAP revenue, gross margin, operating expenses, operating income, net income, EPS, EBITDA, adjusted EBITDA, and cash flow from operations. A reconciliation of these measures to their most directly comparable GAAP measures can be found in our web deck and press release. Please also note that our growth percentages refer to year-over-year change unless otherwise specified. Finally, I’d like to remind you that all statements made during this call that relate to future results and events are forward-looking statements based on current expectations. Actual results and events could differ materially from those projected due to a number of risks and uncertainties, which are discussed in this morning’s press release and our SEC reports.

[Mike Cote:]

Thanks, Paul. The events of 2020 underscored how transformative technology can be to help adapt, innovate and increase productivity. Cybercrime continues to accelerate as the explosion of data and devices have expanded the attack surface, and the shift to work-from-home has required additional cyber security controls and operational changes. These same events have created an opportunity for cyber criminals to exploit and capitalize on the expanding number of vulnerabilities. Our recently published Incident Response Report highlighted increased risk areas in direct response to the pandemic. These included an increased risk with more people accessing SaaS applications, delays in vulnerability patching, circumvention of VPN connections and increased phishing attacks. This is the first time we’ve seen cyber criminals globally focused on one issue, with threat actors using COVID-19 theme tactics to exploit vulnerabilities. Against this backdrop, I continue to be incredibly proud of the resiliency, determination and adaptability of my teammates in serving our customers and partners everyday. For many years, the security industry has been overrun with thousands of point products that do not enable organizations to mount a holistic defense against adversaries, who is unrelenting attacks only have to succeed once. Through a variety of means, the adversary has consistently been able to navigate between security controls, going undetected and undeterred in organizations that lack integrated detection and response capabilities across their environment. We believe that the ability to outpace the adversary at scale requires an integrated security platform that closes the gaps between point products, put security detections in context of risk to an organization and automates the remediation process with agility. Our superior threat detection and remediation capabilities are accelerated with deep learning, machine learning and workflow automation to detect security risks to an organization quickly with high fidelity and to reduce both adversarial dwell time and meantime to remediate. Our cloud native platform takes a different approach, building on our expertise as a global leader in managed security over the last 20 years, because we fundamentally believe that the only way to win this fight is through the combined power of the community working together. Why, because the adversaries work together, albeit in a mercenary way, increasingly leveraging the same data science and technology capabilities that the security industry does.

[Paul Parrish:]

Thanks Mike. We are pleased with our Q3 financial results. Some highlights include, record gross margin, our 10th consecutive quarter of positive adjusted EBITDA, and $22 million of positive cash flow from operations resulting in cash balance of $188 million. Maneuvering within a dynamic global environment, we maintained our strong financial position. We continued the significant growth and investment in our new SaaS solutions. We exited the quarter with annual reoccurring revenue of $443 million and we made progress with our channel program, as you just heard from Mike. In the third quarter of FY ‘21, revenue of $141.6 million exceeded the top end of our guidance range and represents our 2.3% sequential increase over Q2. Gross margin totaled $85.9 million in the third quarter of FY ‘21 are 60.7% of revenue, both records. Our margin composition continues to reflect our shift to more software-driven threat detection and response services that provide differentiated value. Our gross margin progression over the past several quarters reflects our focus on expanding gross margins through scale, continuing automation of delivery capabilities for MDR and purposeful reductions in non-strategic low margin business. Of note, our cloud-based SaaS security analytics platform now represents approximately 8% of customers, approximately 10% of ARR, approximately 40% of ending Q3 pipeline. And although it’s still early, we’re encouraged by initial customer reception and feedback, particularly regarding differentiated value.

[Operator:]

Our first question comes from Saket Kalia with Barclays. Your line is open.

[Saket Kalia:]

Okay, great. Hey, guys. Good morning and thanks for taking my questions here. How are you?

[Mike Cote:]

Good morning, Saket.

[Saket Kalia:]

Hey, good morning. Mike, maybe first for you, can you just talk a little bit about the competitive dynamics with TDR, specifically? I guess the question is, are you finding yourselves more and more in competitive bake-offs for SIM and if so, who you find you’re ripping and replacing with some consistency?

[Mike Cote:]

Saket, thanks for the question this morning. I’m going to tee this up and let Wendy go in into a little more detail. I think that the first thing I’d sort of say to – the thing I’d say to sort of tee it up for Wendy is, we’ve got a much bigger vision, as you sort of heard in my prepared remarks, in just the SIM aspect of things. It’s really working with the other products, that exists in the marketplace and taking where the industry is going from an XDR, if you will, perspective. But I’ll let Wendy drill into a little more of the details on kind of how it fit or maybe some of the customer examples that I talked about.

[Wendy Thomas:]

Sure. So, we take it from really the customer use case perspective, which is that they need a holistic approach to managing their security program. And so, the approach we’ve taken with our platform and SaaS applications are really – they’re designed to address that, that holistic need. And in terms of traditional SIMs, they’ve been disappointing in terms of the difficulty in cost of ingesting and normalizing security relevant data. TDR does that for you and frankly uses our knowledge of the telemetry coming from those products to really make sure that what we’re looking at is what matters from a security perspective. But once you have all that data, clearly you have to know how to detect and hunt for advanced threats. And that’s, honestly, the second place where customers have been disappointed with those legacy SIMs, because TDR completes the swing on that, right? It’s delivering the high-fidelity prioritized detections, but then adds on with automated investigation and remediation capabilities. So what we lead with is following the customer need for true security management. What we announced earlier this week was the addition of basically features on TDR that cover, what I’ll call, basic SIM use cases from log retention, both the type, amount and lengths of retention of that data as well as some additional search and reporting capabilities. And from a customer perspective, that’s what they’ve been telling us would kind of let them be able to have a holistic security outcome and frankly with a better ROI with a standalone TDR option.

[Saket Kalia:]

Got it. That’s very helpful. Hey, Paul, maybe for my follow-up for you, just maybe on the MDR part of the business. I guess the question is, how does MDR sort of compare to the traditional MSS in sizing? And can you talk about the even qualitatively sort of the relative gross margins as that shift from MSS to MDR continues? Does that makes sense?

[Paul Parrish:]

It does. And I’ll reference to our average revenue per customer, you’ll see in our Q is $113,000 per customer. And we’re seeing that the average revenue per customer through selection goes in our new system is about 25% higher. So from a revenue sizing, we see this as a favorable sizing, increased revenue to us. And the gross margins are improved in the new platform. And as you’ll hear in the Analyst Day, we talked about long-term, our gross margins approaching something along 73%, 77% range over time. And so, think in terms of MDR tracking along that.

[Saket Kalia:]

Very helpful. Thanks, guys.

[Mike Cote:]

Thanks, Saket.

[Operator:]

Thank you. Our next question comes from Sterling Auty with JPMorgan. Your line is open.

[Sterling Auty:]

Hey, guys. Thanks. So, I apologize, I’m on the road, if you can believe that. So, I don’t have my model in front. But I’m just kind of curious, what would be the main drivers that could cause revenue to be down sequentially in this next fiscal quarter?

[Paul Parrish:]

Yes, it’s us focusing on the type of customers we’re serving, as I’ve mentioned in my comments, they’re focusing on. We’re looking at customers who see the value of our product and will reward us and we help them in their – what they need to do in their business. And so, we’re going through our customer base and looking at where are those lower margin type customers are and working with them on different alternatives.

[Mike Cote:]

It sort of ties, Sterling, into the question Saket asked when he talked about the MSS versus MDR market, whereas some of the services from an MSS, traditional MSS perspective that are lower margin, less value add, are things that we will not look to expand. And if the margin is unprofitable for us, we’re not going to look to continue to do.

[Sterling Auty:]

And then my follow-up question kind of ties nicely into that. So, when you talk about going out and partnering with MSS, I would think traditionally they would look at you as a core competitor. Why would they want to do that? Is it because you’re exiting some of that lower margin business and perhaps creating opportunities for them and they see you less as a competitor, more willing to look at you on the product side?

[Mike Cote:]

Yes. Yes, and the other key aspect to that, Sterling, is really getting the scale, right? It’s being able to take what we have done is, as the leader in the MSS space and bring that capability to the market and allow others to do it as well as we do, we did and we do, and have us really focus on the expertise and the analytics where we can add real value at a much greater scale.

[Sterling Auty:]

Got it. Thank you so much.

[Operator:]

Thank you. Our next question comes from Walter Pritchard with Citi. Your line is open.

[Walter Pritchard:]

Hi, thanks. I’m wondering just as you’ve rolled out a lot this year, and if you look into next year, how are you thinking about the budget categories you’ve been able to access this year? And have some of these new products, sort of, fit into traditional RFPs and so forth the customers have had, and how are you thinking about that as you look toward fiscal ‘22?

[Wendy Thomas:]

Hi, Walter. It’s Wendy. I’ll take that one. Just to make sure I’m clear on your question, are you talking about sort of what product categories customers…

[Walter Pritchard:]

Yes, for example, you have a vulnerability capability, now you have a greater analytics capability, and so there are traditional line items there that customers put out RFPs around, and I’m just curious you’ve been able to get into that mix or if it’s been a little bit more missionary selling as these products have ramped and you’re looking toward a budget RFP kind of selling as you look into next year?

[Wendy Thomas:]

Yes, I don’t have that RFP stats in front of me, clearly. We participate in those when they make sense for us. The – I definitely think that the shift toward the new platform and those capabilities has tended to address customer use cases in a more focused way and so sometimes those kind of bespoke outsourcing of labor type RFPs aren’t necessarily where we want to go. But what we do is we’re able to position that the outcomes we can drive at a higher ROI to customers are really the best alternative there. I think our sales team has been successful positioning that with customers and frankly trying to get in front of some of those RFIs or RFPs.

[Walter Pritchard:]

And then for Paul, just generally on the profitability front, I mean, obviously you’re investing here a bit. Can you help us understand sort of duration of investment, sort of what your goals are, what you’re looking for there in terms of kind of the return on what you’re doing right now? And so, sort of how long it lasts?

[Paul Parrish:]

Yes, we see great potential in what we’re doing. That’s why we’re investing in that. We see the rate that we’re spending on R&D, which is elevated rate, will continue out into the near-term. Long-term-wise, that should return back down to something, and long-term is beyond the next 12 months. But long-term return back down somewhere in that 14% to 16% level, but we see continuing this spend right now to reach the market and gain in the market that we see we can get.

[Walter Pritchard:]

Great, thank you.

[Operator:]

Thank you. Our next question comes from Brian Essex with Goldman Sachs. Your line is open.

[Brian Essex:]

Great. Thank you for taking the question. I was wondering maybe if you could dig in a little bit to some of the puts and takes around sales and marketing spend, particularly as you pursue these kind of new go-to-market initiatives and try to penetrate the channel, but you are also seeing a mix shift in terms of revenue. You are down a little bit sequentially. So maybe just want to understand some of the puts and takes there for sales and marketing how to think about that going forward into next year?

[Paul Parrish:]

Yes. So, we have been primarily focused as a direct selling company using our salespeople to work with our customers. That’s a higher cost sales mix. But as we move to the channel, there are some startup costs higher cost initially as we move over to get that kick-started and running. And so we see some type of elevated spend for a period of time as we get channel going. But ultimately, as channel grows and becomes a larger part of our business, then the efficiencies that we get off of that wider network will reduce those sales and marketing.

[Mike Cote:]

We are also – this is Mike. I’d add, with the new sales model that has kind of evolved as a result of the pandemic, we’re also putting more focus in the marketing area and in electronic demand gen and kind of moving the sales process where what we think people really want it now, where much more of it is digitized and the actual sellers are getting engaged later in the sales cycle.

[Brian Essex:]

Got it. That’s helpful. And maybe just how to think about ARR kind of flat year-over-year, but you are getting progress with TDR and MDR, is it that shift toward more profitable customers that’s affecting that kind of rate or is there something else there we should kind of keep an eye on?

[Paul Parrish:]

Yes, over time, that’s clearly – the mix of that business over time, we will see that benefit. What we see right now, near-term what’s happened is we’ve been more efficient at managing the business and focusing on what do we do to effectively, efficiently serve our customers, but you are clearly on track with where we see the business going. As that continues to grow in our new business, we will get that mix and the benefit of that mix in our gross margin.

[Mike Cote:]

And I think the key – this is Mike just adding, I think is part of the key preview we gave was the sets that Paul talked about, 8% of customers now are on the new platform, about 10% of ARR. We had, I think, it was 35%, 36% growth in customers, new logo customers added in the quarter on the new platform. And I think we’ll begin to flesh that out more over time for you.

[Brian Essex:]

Got it. That’s helpful, incremental color. I appreciate it.

[Operator:]

Thank you. Our next question comes from Alex Henderson with Needham. Your line is open.

[Alex Henderson:]

Thanks. I wanted to ask a question relative to the logging functionality that you talked about. Clearly, logs are very expensive and Splunk is known as one of the highest priced people out on the planet. So how much are you saving the customer in terms of that logging expense on the one hand? And on the other hand, logs are used in a lot of things other than security; for instance, are used in network management, they’re used in network troubleshooting. Can you talk a little bit about how you tie into that aspect of what companies need the logs for in the case that they choose to stop using Splunk and start to use you for logging function?

[Wendy Thomas:]

Sure, I’ll step back to the first question around cost. And we do think that this is an advantage that we have as much around predictability of cost as it is around the cost, the lower cost itself. Everything that we do in terms of the way that we price both the TDR application and then the extension of various log retention and collection options is still correlated back to endpoints, because customers are able to predict how many users they’re going to have on the platform. And then we have tiers of data amount, and so those they can opt into sort of large tiers around that with 30 days of notice if they’re – since they’ve been tripping that next tier. And it’s much more flexible and simple than Splunk’s offerings, because for us the point of view we have around the logs team from a security efficacy perspective, it’s obviously a different point of view than one that just hold logs for, as you were mentioning, kind of IT or even broad compliance perspective, so we can give customers options there depending on – so that they don’t store data that they don’t need for security purposes. On the IT side, we certainly have capabilities around ensuring that both IT and other practitioners can keep a pulse on the health of those data sources. I will not say right now that we’ve extended into trying to enable some of the network management side, if you will, but certainly something we will always listen to our customers about. But right now, we really stay focused on the security side first and hopefully address most of the use cases for customers who don’t have an extreme end use case.

[Alex Henderson:]

I see. Could shift gears a little bit over to the OpEx side of things, 5 point improvement in – or 5 points of OpEx, it sounds like are related to a combination of things, but a big chunk of that sounds like it’s related to lack of travel and T&E, and I get the idea that this is a much more frictionless model, more direct digital. How sustainable is that 5 points, or is that going to come back in over the course of CY ‘21 as increased costs in your view?

[Paul Parrish:]

As every companies looking at this, and we’re pretty excited about the things that we’ve learned through this process. It’s regrettable you have to go through something like the COVID pandemic to figure out how you do things more efficiently. And we have found we’re very effective, very efficient working remotely and we’re continuing to explore how that continues out in the future. Now, of course, as things loosen up and the vaccine is out there in the world, of course, you’ll see some cost come back in. But we’ve learned a lot through this process and so we’re excited about continuing these savings out in the future.

[Alex Henderson:]

Okay, thanks.

[Operator:]

Thank you. Our final question comes from Saket Kalia with Barclays. Your line is open.

[Saket Kalia:]

Hey, folks. Sorry to get back in queue here, but just had one quick housekeeping question that I think could benefit the group as well. Paul, maybe just for all of our models, can you just – can you remind us what was the split of SRC versus – I don’t want to just call it managed services, I guess I’ll call it subscription. What was that split between those two revenue lines?

[Paul Parrish:]

76% was the MSS and SRC was 24%.

[Saket Kalia:]

Got it. Very helpful. Thanks.

[Mike Cote:]

Thanks, Saket.

[Operator:]

Thank you. And there are no other questions in the queue. I’d like to turn the call back to management for any closing remarks.

[Paul Parrish:]

Alright. Thank you, operator. That wraps up today’s call. A replay of this webcast will be available on our Investor Relations page at secureworks.com, along with our Q3 FY ‘21 web deck with additional financial pages. Thanks again for joining us today. Have a good day.

[Mike Cote:]

Thank you.

[Operator:]

Ladies and gentlemen, this concludes today’s call. You may all disconnect. Everyone have a great day.