Rapid7, Inc.

Good day and thank you for standing by. Welcome to the Rapid 7 fourth quarter and full year 2021 earnings conference call. At this time, all participants are in a listen-only mode. After the speaker's presentation, there will be a question and answer session. To ask a question during this session, you will need to press star one on your telephone. Please be advised today's conference is being recorded. If you require any further assistance, please press star then zero. I would now like to hand the conference over to your host today, Sunil Shah, Vice President, Investor Relations. Please go ahead.

Thank you, Operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's fourth quarter and full year 2021 financial and operating results, in addition to our financial outlook for the first quarter and full fiscal year 2022. With me on the call today are Corey Thomas, our CEO, and Tim Adams, our CFO. We have distributed our earnings press release over the wire and is now posted on our website, investors.rapid7.com, along with the updated company presentation and financial metrics files. This call is being broadcast live via webcast, and following the call, an audio replay will be available at investors.rapid7.com until February 16, 2022. During this call, we may make statements related to our business that are forward-looking under federal securities laws. These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to the company's positioning or future goals and financial guidance for the first quarter and full year 2022 and and the assumptions underlying such goals and guidance. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the expectations contained in these statements due to a number of risks and uncertainties, including those contained in our most recent quarterly report on Form 10-Q and in the subsequent reports that we filed with the SEC. The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and reported results should not be considered as an indication of future performance. RAPID-7 does not assume any obligation to update the information presented on this conference call except to the extent required by applicable law. Our commentary today will be primarily in non-GAAP terms, and reconciliations between our historical GAAP and non-GAAP results and guidance can be found in today's earnings press release. At times, in our prepared comments or in response to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be one time in nature, and we may or may not provide an update in the future on these metrics. With that, I'd like to turn the call over to our CEO, Corey Thomas.

Thank you, Sunil, and good afternoon to everyone on today's call. Thank you for joining us. Rapid7 finished 2021 on a high note delivering strong fourth quarter results on broad-based strength across our security transformation and vulnerability management solutions. Security transformation saw year-over-year organic ARR growth of over 50%, exceeding our expectations for the quarter and the year, driven by our team's strong execution and the growing need for customers to manage increasingly complex security environments. We ended the year with $599 million of ARR, growth of 38% over the prior year, and growth of over 30% on an organic basis. These growth rates highlight the compelling value proposition our Insight platform is delivering to our customers and support our belief that 2022 will be another strong year for Rapid7. Our commitment to executing on our growth and profitability framework is evident in today's results. We delivered nearly 100 basis points of non-GAAP operating margin expansion for the year, while accelerating ARR growth and absorbing our largest ever acquisition to date. We also saw significant scale in cash flow, exceeding $50 million of operating cash flow in 2021 and delivering $35 million of free cash flow for the year ahead of expectations. This puts us on a great trajectory to execute against our mid and long-term free cash flow targets. While Tim will share more on our operating results during his prepared remarks, these financial highlights illustrate the strength of our underlying business and our commitment to making responsible investments in growth. We began last year with our three enduring goals in mind. To enable customers to securely transition to the cloud, to expand the capabilities and value proposition of our best-in-class insight platform, and to balance our dual mandate of scaling profitably while strategically investing to drive durable growth. In March, we expanded on this vision at our Investor Day, where we outlined our medium- to long-term financial goals and elaborated on a few key opportunities, including the large and expanded addressable market for our solutions, our ability to grow ARR per customer, by cross-selling and upselling into our base, focusing on higher growth strategic customers to support this expansion, and an under-penetrated international market with significant room for share gains. During 2021, we executed exceedingly well across all of these opportunities. We accelerated ARR growth while expanding our addressable market beyond $30 billion. ARR per customer with 17% for the year approaching $60,000 per customer. Customer growth accelerated driven by increased demand and notable improvements in retention as we eclipsed 10,000 customers globally. And we saw approximately 50% year-over-year growth in our international revenue. Moreover, the escalating cyber threat landscape we experienced throughout the year validates the durability of these opportunities as customers transform their businesses, Cloud adoption gains pace, and the ability to manage cybersecurity risk becomes even more challenging. These issues are now a top priority for executives and boards, particularly as the labor market for security professionals tightens and regulatory scrutiny and brand risk increase. These market conditions provided a healthy secular backdrop for our strong growth in 2021 and should support durable ongoing growth in 2022. I highlight three areas that are driving our success today. First, our Insight platform provides customers with a broad-based integrated suite of best-in-class security operations solutions. We've invested in and expanded our capabilities over the last few years to build a leading position in the extended detection and response, cloud security, and vulnerability risk management markets. We've further strengthened our our customer value proposition by adding platform services including SOAR and Threat Intelligence to provide security teams with comprehensive visibility, analytics, and automation that they need to manage an evolving IT environment. The depth and breadth of our platform is increasingly becoming a competitive differentiator. It's driving demand with our customers, particularly as security teams look to consolidate an increasingly fragmented set of security solutions. This is demonstrated by the strong growth we saw across our Insight platform throughout 2021, with particular strength driven by our security transformation solutions, which now represents the majority of our total ARR. We see a long runway ahead in terms of our platform opportunity as we expand our base of multi-product platform customers. The recent long for the shelf vulnerability highlights the value of holistic visibility and monitoring our Insight platform can provide in helping customers to drop better security outcomes. Beyond the critical importance of Insight VM and providing visibility to the risk in customer's traditional environments, customers are leveraging Insight CloudSec to identify vulnerable cloud instances, Insight IDR to monitor for attacker behavior related to log for sale, our application security capabilities to both monitor and block against attack attempts, and Velociraptor for forensics analysis of exploitation attempts against the vulnerability. The scope of incidents like Log4Shell demonstrates the persistent nature of the elevated threat landscape our customers are facing today and why we expect cybersecurity will remain top of mind for organizations of all sizes as we look ahead. The second aspect of our business I want to highlight is our market leading incident detection response. As the topic of XDR gains minds here, Many of you have asked how Rapid7's Insight IDR is delivering customer impact in this area. The answer is that we've always approached IDR from this perspective. When we began building IDR in 2013, most people were focused solely on data collection. Rapid7 took a detection-first approach, hence the name, Incident Detection and Response. By combining leading data collection capabilities on our Insight platform with detections From our analysis of attacker behavior and layering on user behavior analysis, file integrity monitoring, and compliance dashboards, we were able to build not just a market-leading SIEM, but also a market-disrupting capability to detect and respond to attacks more effectively. We have since extended the breadth and depth of our offering at a rich capability, including endpoint detection and forensics, and network traffic analysis, to provide more comprehensive visibility across customer environments, as well as embedding automation to drive productivity to help customers deliver better security outcomes. Our investments in natively integrating these capabilities is why customers are choosing Insight IAR to help minimize the seams and gaps that exist in their fragmented technology environments today. We continue to invest in extending our platform capabilities most recently via the addition of Insight's best-in-class threat intelligence offering. We remain early on our integration efforts, but have begun to see the vision of combined internal and external attack surface monitoring resonate with our customers. During the fourth quarter, we saw great progress on our ability to sell Insight into our existing customer base, with nearly 40% of our new threat intelligence business driven by cross-sell. A great example of this was a six-figure competitive displacement with a well-known global food and beverage brand. The customer added threat command alongside our detection and response and vulnerability management solutions, in part because of the enterprise-relevant alerts and the ability to automate workflows to improve the efficiency and effectiveness of their stock. We remained bullish. on our long-term opportunity to deliver a market-leading XDR solution to our customers as we continue to integrate threat intelligence into IAR. Lastly, I'd like to take a moment to discuss the emergence of our cloud-native security platform, Insight CloudSec. Digital transformation and the accelerating customer shift to cloud-based infrastructure is disrupting security programs. Cloud environments are more dynamic and scale at a different pace than traditional IT environments This is why security teams are increasingly looking for solutions that are built from the ground up to manage the unique risk in their cloud environments. While the cloud security market remains in its early days, it is clear to us that success in securing the cloud relies on holistic data collection, analytics, and automation, all capabilities that are core to Rapid7's DNA. This is how we have architected Insight CloudTech. by integrating three critical areas of technology to bring together multi-cloud data for rich visibility and analysis across cloud posture management, cloud workload protection, and cloud identity and entitlement management. We continue to innovate and invest heavily in this space, given the massive opportunity ahead to help our customers migrate securely to the cloud. Our approach is resonating with customers, as evidenced by a competitive six-figure deal with a Fortune 500 company The customer's homegrown approach to securing and growing multi-cloud environments was struggling to scale with the pace of their cloud development. They selected Insight CloudSec for our scalable automation, seamless integration with Insight VM, and our public cloud provider coverage that few competitors can match. Our swift time to value and out-of-the-box capabilities provided tangible benefits for the customer, allowing Insight CloudSec to become, in their words, a cornerstone of their security program. As we look across all three of these areas, we expect that many of the market dynamics we experienced in 2021 will continue to intensify in 2020T. The attacker landscape continues to become more hostile and the pace of innovation, particularly the move to the cloud, is accelerating and the security cap is getting wider. it is clear that security now has a permanent seat at the table in executive and board discussions. And we expect this to fuel durable growth for our best in-suite insight platform as we look ahead to 2022. These dynamics are also impacted by the increased turnover many companies are facing in today's labor market, exacerbating what has already been a tight talent environment for cybersecurity professionals. Rapid7's sustained focus on addressing the needs of resource-constrained customers by delivering best-in-class productivity and efficacy of security programs while lowering the cost of operations positions us well to drive strong customer impact through our Insight platform in this environment. As we march forward into 2022, we remain committed to executing against our three enduring goals for Rapid7. enhancing our customers' ability to securely transition to the cloud, building out an increasingly integrated best-in-suite platform experience, and driving sustained profitability growth. We believe that secular tailwinds in security and the evolving IT environment put us in a great position to execute on these goals in 2022, and we're confident that we have the right technology and people to drive another year of durable growth. Our team remains committed to delivering on our 2025 goal of becoming an over $1 billion Rule of 40 company, and we see great line of sight to achieving that given our strong execution in 2021. Amidst an ever-escalating cyber threat landscape, I am tremendously grateful to all of the security professionals around the world who work tirelessly to keep our technology environment safe. The Log4Shell vulnerability strains security teams at the end of an already busy year, and I'm proud of our Rapid7 team for their commitment to supporting our customers during the ongoing remediation efforts. We know that the threat environment will continue to escalate, impacting organizations of all sizes, and that gives us conviction in the importance of our mission to make the best in security operations achievable to all. Thank you to our team and to our customers for supporting us on this journey. Before I turn the call over to our new CFO, Tim Adams, I would like to thank Jeff Kolowski for his significant contributions over the last five years. When Jeff joined the company, we had a VM solution and an annual revenue run rate of around $150 million. Today, we have broad-based, best-in-class security operations platform generating nearly $600 million in annualized recurring revenue. Jeff was a critical player in this transformation. We wish him all of the best in retirement. Tim, we're thrilled to have you on board as we usher in the next chapter of Growth for Rapid7. And I'm excited about all the great experience you will bring to our leadership team. Thank you for joining us today. And now I will hand the call over to Tim.