Rapid7, Inc.

Good afternoon and welcome to RAPID 7's first quarter 2023 earnings call. All participants are in a listen-only mode. After the speaker's presentation, we will conduct a question and answer session. To ask a question, you'll need to press star followed by the number one on your telephone keypad. As a reminder, this conference call is being recorded. I would now like to turn the call over to Sunil Shah, Vice President, Investor Relations. Thank you. Please go ahead.

Thank you, Operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's first quarter 2023 financial and operating results, in addition to our financial outlook for the second quarter and full fiscal year 2023. With me on the call today are Corey Thomas, our CEO, and Tim Adams, our CFO. We've distributed our earnings press release over the wire and it's now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast, and following the call, an audio replay will be available at investors.rapid7.com. During this call, we may make statements related to our business that are considered forward-looking under federal securities laws. These statements remain pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995, and include statements related to the company's positioning, strategy, business plans, and financial guidance for the second quarter and full year 2023, and the assumptions underlying such goals and guidance. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the future results expressed or implied in these statements due to a number of risks and uncertainties, including those contained in our most recent annual report on Form 10-K, filed on February 24, 2023, and in the subsequent reports that we filed with the SEC. The information provided on this conference call should be considered in light of such risks. Actual results and timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call except to the extent required by applicable law. Our commentary today will primarily be in non-GAAP terms, and reconciliations between our historical GAAP and non-GAAP results and guidance can be found in today's earnings press release and our website at investors.rapid7.com. At times, in our prepared remarks or in response to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or quarterly results. Please be advised that this additional detail may be one time in nature, and we may or may not update these metrics in the future. With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey.

Thank you, Sunil. And hello to everyone on the call today. Thank you for joining us this afternoon on our first quarter 2023 earnings call. I am pleased to report that Rapid7 started the year with strong momentum as we work to deliver customers a comprehensive security operations platform at the most compelling economic value. Faster than expected traction, from our threat-complete and cloud risk-complete consolidation offerings, which together represented over 20% of new ARR in the first quarter, supported steady customer demand for our Insight platform, driving 16% year-over-year growth in ARR to $728 million. Revenue and operating income both exceeded our expectations as customers gravitate towards our security operations solutions and as we manage the business for profitable growth. The customer spending environment in the first quarter was broadly in line with our expectations shared on the February earnings call. Despite ongoing complexity in customer budgets, including elevated levels of deal inspection, we saw strong underlying demand for our Insight platform to start the year. Our solutions solve a critical set of needs for security teams who are working through a complex threat landscape, constraints on talent, and worsening consequences from cybersecurity incidents. While overall demand trends were consistent with our expectations, I'm pleased to share that our teams are demonstrating the ability to execute in an environment with higher budget scrutiny and ongoing macroeconomic uncertainty. A few positive themes continue to resonate in our business throughout the first quarter. The first is that we're benefiting from a clear customer preference for consolidated security offerings. There is a persistent and crucial need to gain visibility and assess risk across traditional and cloud environments. And security teams are laser focused on improving both the effectiveness and efficiency of their programs while maximizing their budget dollars. Our solutions lean into this dynamic by offering best-in-class automated capabilities across cloud security, detection response, and vulnerability management, while being delivered through new and differentiated pricing and packaging models. As a result of this approach, we are at times seeing less competition for critical capabilities given the unique scope of our offerings, which in many cases, customers aren't able to consolidate on a single platform with other vendors. These dynamics highlight our unique competitive position as we look to capture greater wallet share in a consolidating security operations market. As customers gravitate towards vendor consolidation and our sales team ramps up on the new offerings, we are seeing the clear benefit in ASPs for our threat-complete and cloud risk-complete deals, which average more than two times our overall ASPs in the first quarter. our marketing enablement efforts around these offerings were largely competed in the first quarter. And so far, over one third of our sellers have sold at least one of our consolidation offerings. Another theme that continued in the first quarter was a growing traction with our differentiated cloud security solutions. Insight CloudSec provided customers real-time visibility into their cloud environments with a breadth of features, including posture management, agentless cloud vulnerability assessment, workload protection, cloud detection response, and automated remediation. The ability to bring these capabilities onto a cohesive platform offering is increasingly resonating with customers, particularly as usability and time to value have long been core differentiators for Rapid7. Cloud security has evolved over the last few years from a niche complex market into the one we see today, where mainstream enterprises show increasing demand for solutions that can solve their cloud challenges in an accessible, efficient, and automated fashion. Our approach to the market through a consolidated platform focused on accessibility and ease of use is making cloud security more accessible to a broader customer base. In addition, Cloud Risk Complete packages the breadth and depth of our top ranked cloud technology alongside our enterprise grade vulnerability management, which provides visibility to traditional environments. This comprehensive risk visibility across cloud and hybrid environments combined with the compelling package pricing structure is driving a strong value proposition for organizations of all sizes. A great example of the value we're bringing to customers through Cloud Risk Complete is a recent six-figure ARR deal with a mid-cap technology company. The customer was unhappy with their vulnerability management provider and searching for a replacement standalone VM solution. Our sellers were able to expand the conversation to include cloud security and application security as part of our new Cloud Risk Complete package offering. Rapid Sevens robust product features combined with real-time event-driven data harvesting stood out as competitive differentiators, as well as our ability to unite vulnerability data with cloud security data for more actionable alerts and more automated remediation. Ultimately, our sellers were able to bring together the customer's on-premise and cloud security teams to win this deal by combining three silo solutions into a unified platform with a single cost-efficient contract. Another first quarter example of our expanding value proposition for customers is a six-figure ARR deal with a regional healthcare company. The customer was struggling to use a legacy SIM solution managed by MSSP due to the complexity of the data and reports, as well as the quality of the alerts. They needed a way to identify user behavior in one unified way. and to find automated solutions that reduced manual work. Our managed detection response offering combined with Insight Connect automation allowed us to win the deal based on strong underlying technology amplified by the security expertise of our best in class SOC analyst. As part of our continued focus and commitment to customers, I'm thrilled to welcome Larry D'Angelo to Rapid7 as our Chief Customer Officer. This is a newly created role that oversees our sales organization and all of our customer success teams across advisory, onboarding, and support. Larry has extensive background at various software companies and private equity firms. And some of you may remember that he served as chief sales officer for LogMeIn for over eight years, helping the company scale from $100 million to $1.4 billion in revenues. We're excited to have Larry on our team and believe that customers will benefit from having a cohesive customer organization to support their growth throughout the end-to-end customer lifecycle. As we look out over the remainder of the year, we are encouraged by the underlying demand for our cloud-native insight platform, our ability to execute in a tighter budgetary environment, and our unique position in the customer-driven consolidation wave for security operations solutions. We're on track to meet our growth and profitability targets for 2023 and believe we're well positioned for long-term growth as we execute on our strategic vision to bring Rapid7 to the center of customer security operations programs. As we refine our go-to-market strategy and invest to support innovation, we are focused on delivering better security outcomes to the large market opportunity in front of us while maintaining a deliberate focus on expanding the efficiency and profitability of our business. With that, thank you for joining us on the call today. I will now turn the call over to our CFO, Tim Adams, to share additional detail on our financial results and outlook. Tim?

Thank you, Corey, and good afternoon to everyone on today's call. Thank you for joining us. Before I turn to the results, a quick reminder that except for revenue, all financial results we will discuss today are non-GAAP financial measures unless otherwise stated. Additionally, reconciliations between our GAAP and non-GAAP results can be found in our earnings press release. Rapid7 ended the first quarter of 2023 with $728 million in ARR, representing growth of 16% year-over-year and consistent with our expectations. We continue to see year-over-year growth driven in large part by our anchor offerings of detection and response cloud security, and vulnerability management, which represent the foundational capabilities of our threat-complete and cloud risk-complete consolidation offerings. The breadth and effectiveness of our Insight platform, along with our ability to drive value with our complete offerings, are resonating with customers as they continue to navigate an evolving budgetary environment. We see ARR growth coming from both new and existing customers, with ARR per customer that grew 9% over the prior year to $66,000, while our global customer base grew 6% year over year to over 11,000 customers. As Corey mentioned earlier, over 20% of our new ARR in the first quarter was driven either by a threat complete or cloud risk complete offering. We see traction here both with landing new customers and expanding with our current customers with new ARR for complete deals seeing healthy contributions from each type of customer. First quarter revenue of $183 million grew 16% over the prior year and exceeded the high end of our guidance range. Over 95% of revenue in the quarter was recurring and product revenue grew 17% over the prior year to $174 million. International revenue grew 21% year over year and represented 21% of total revenue, while North America grew 15% over the prior year. Turning to our operating and profitability measures for the quarter. Product gross margin was 76% in the first quarter and overall gross margin was 73%. Both were within our stated range of expectations, which is mid 70s for product gross margin and low 70s for overall gross margin. Sales and marketing expenses represented 39% of revenue compared to 43% in the prior period. R&D and G&A expenses were 20% and 8% of revenue respectively compared to 23% and 9% in the first quarter of last year. We delivered strong first quarter operating income of $11 million above the high end of our guided range. Our adjusted EBITDA was $17 million in the quarter and diluted net income per share was $0.16. Moving to our balance sheet and cash flow statement. We ended the first quarter with cash, cash equivalents and investments of $270 million. Cash flow from operations was $6 million and free cash flow was ahead of our expectations and just below breakeven. This brings us to our outlook. We continue to believe that the largest drivers of ARR growth performance this year will be related to executional improvement, including continued momentum for our consolidated offerings, as well as the impact of the broader macroeconomic environment on customer buying behavior. We are pleased that our first quarter results track to the plan across all metrics, despite a noisy environment. Therefore, we are reiterating our full year 2023 ARR guidance of $815 to $825 million, representing year over year growth of 14 to 16%. We are raising total revenue guidance for the full year to $773 million to $779 million, reflecting outperformance in the first quarter. This range represents growth of 13% to 14% with high single digit growth contribution from our professional services revenue. On profitability, we are also raising our operating income guidance of $59 million to $63 million for the full year, which represents operating margin expansion of at least 300 basis points. The increase reflects the portion of the first quarter outperformance that was unrelated to timing of spend. We expect full year net income per share in the range of 83 to 89 cents based on an estimated 67.6 million diluted weighted average shares outstanding. And for free cash flow, we continue to expect approximately $80 million for the full year, which is approximately double our 2022 level and reflects over 400 basis points of free cash flow margin expansion. Moving to our outlook for the second quarter of 2023, we expect total revenue in the range of $187 million to $189 million. We expect non-GAAP operating income for the second quarter in the range of $7 to $9 million and non-GAAP net income per share of $0.09 to $0.12, which is based on 67.4 million diluted weighted average shares outstanding. Thank you for taking time to join us on the call today. And with that, we will open the line for questions. Operator?

If you'd like to ask a question, please press star followed by one on your telephone keypad. In the interest of time, we ask that you please limit yourselves to one question. If you have any additional questions, please rejoin the queue. Thank you. Our first question comes from Matt Hedberg from RBC Capital Markets. Please go ahead. Your line is open.

Great. Thanks for taking my question. To keep it to one here, I guess maybe for Corey, the success on the complete offerings is really great to see. Obviously, there's clearly, I think, a security efficacy benefit there when customers are select one of those bundled offerings. But I'm wondering if you could talk to the ROI element from a customer's perspective when they consolidate on RPD. It seems to be a big part of the narrative here. I wonder if you could talk to that part.

Yeah, you're right, Matt. I think there's two things. One, customers are more interested in consolidation because they have to do more. I remind you that budgets are still growing. They're just growing at a slower rate than they were in the past with a little bit more uncertainty. And so what customers are trying to figure out by and large is really two separate things. One, they want to figure out how do they actually continue the security improvements that they've committed to that are necessary, that are critical in a more, I would just say, tighter budgetary environment going forward. But they also, importantly, want to figure out how to boost the productivity of their team. Because remember, it's not just the budgets that we talk about. It's also their teams and their team's effectiveness and their team's productivity. The value proposition around both the threat complete and the cloud risk complete is really focused on how do you actually solve the problem of either managing threats or managing risk, but really doing that at high levels of efficacy and high levels of productivity. And one of the side benefits of that is that it's also cost effective to leverage spend on a common platform. But the primary benefit is that we're driving productivity and efficiency. And the way that we actually do that with ThreatComplete is providing the complete SOC stack and solution around how people collect all the data across 100% of the environment to detect attacks, and then the analytics to respond, and then the automation to make sure that that response is robust. And on the cloud, risk-complete is really that integration of looking at the best-in-class across both the traditional VM, but also increasingly people are migrating to the cloud, and they want to find a way to actually manage the risk in their cloud environments holistically. So, again, it's a productivity boost in about how do they get more out of their talent and their staff, but also by consolidating the platform, they get a direct economic boost that gives them scale by investing with us. Thanks, Corey. Thank you very much.

Our next question comes from Saket Kalia from Barclays. Please go ahead. Your line is open.

Okay, great. Hey, guys. Thanks for taking my question here. Corey, just to make sure that this question is asked publicly, I was wondering if you could just comment at all on just the public headlines earlier this year around a sale process. Of course, the same question I asked last quarter. But also, maybe as part of that, comment on whether that is a process that's still ongoing.

uh, socket, you broke up a little bit towards the end, but I believe that you were, um, Apologies. We had a little technical difficulty. I believe you broke up towards the end, but I believe you were asking about the rumors that I addressed on the last call. And I'll just say it's still the same comment. We don't really comment on rumors. That said, we have a pretty exciting opportunity in front of us. We have momentum that I think is demonstrated by our results this quarter. And so we understand why people would actually talk about us. in that lens, but we're squarely focused on continuing to drive our performance in the business, deliver results for our customers, and we think that's going to deliver a great return for shareholders.

Got it. Fair enough. Thank you. Thank you.

Our next question comes from Rob Owens from Piper Sandler. Please go ahead. Your line is open.

Yeah, good afternoon. Thanks for taking my question. I wanted to focus in a little bit around net new ARR, and obviously it's been under pressure. for the last year. And I think given you're holding ARR guidance for the year, it does require some acceleration in the back half. So is that a function of sales productivity? Is that a function of where the pipeline sets up at this point? Just some color would be appreciated. Thanks.

Our outlook was really based on two common things. One is execution of the Salesforce transformation, which I think we're well underway. I would just say we're ahead of schedule, and that's going to trend exactly as we expect it to. The second thing is could we actually build the critical pipe in the platform consolidation areas that we were looking for, which we are ahead of schedule and the pipeline builds continuous space. The third thing is, are the conversion rates for those areas where we expected them to be? And again, the conversion rates are quite strong in those areas. So as we sit here today with the pipeline build, the Salesforce adoption being not just deep, but also broad, and the conversion rates continuing to be strong, we're set up well for the second half of the year. And it's really predicated on those trends continuing. So not really a shift in the trends, it's just a continuation of those trends that's based into our core model. Thank you. Thank you very much.

Our next question comes from Shrenik Katari from Robert Baird. Please go ahead. Your line is open.

Great, great. Thanks a lot. Yeah, so very quickly on the traction that you guys highlighted on Insight DR and cloud security, it's kind of driving multi-product adoption for you guys. Can you, I mean, and you guys also highlighted kind of this gravitation towards vendor consolidation. And this is something which we have been hearing from your peers and rivals as well. and the benefit that you're seeing in ESP. So can you just comment quickly on the wind rates and the competitive environment that you're seeing right now? I know there's a lot of noise out there, but I would appreciate some comment there.

Yeah, I mean, look, I think we're well positioned if you think about consolidation and security operations space. There's few folks that actually span, cover the span of security operations. You look at us, we're at BM, we're at cloud security, multiple aspects of cloud security, CSPM, cloud vulnerability management. workload protection. We also have a quite impressive SIM technology that forms the core of our security operations platform for managed detection response, along with security automation. So if you look across security operations, I think we're set up better than anyone else I can think of to actually really drive consolidation in that space. So we don't have lots of direct competition. When you think about end-to-end security operations, how do you manage risk across both the cloud on-prem endpoint environments from a risk visibility and management perspective, and how you detect and respond to attacks across the environment from a security analytics and automation orchestration perspective. And so that the win rates is extraordinarily high. And what our sales force has, it's really because they're not challenged in that space. And what our sales force has actually learned is, frankly, to actually make that the primary focus with our consolidation offerings, because when we actually shift it to how do you actually think about accelerating your security operations momentum? at the best efficacy and the lowest possible long-term cost that really differentiates the dynamic for our sales team. And so that's what we're seeing in the space. What we see competition is primarily in the point solution space, not the consolidation space of security operations.

Corey, I would just add, we know it's still early with our consolidation offerings, but in Q1, over 20% of the new ARR came from the new packages. And we're seeing more and more of our sellers engage and be successful getting that sale. So that's up from what we saw in Q4. So it's two data points that are looking very positive. But as you said, this was always intended to really gain full momentum towards the second half of the year.

Thank you for the question.

Thanks, Corey.

Our next question comes from Michael Tourist from KeyBank Capital Markets. Please go ahead. Your line is open.

Hey, guys. This is Eric Keith on for Michael. Corey, I just wanted to make sure I understand just kind of high level. Just curious, it sounds like go-to-market execution is progressing better than expected. And then on the macro, it sounds like maybe it got a bit worse in the quarter, but no more than you were kind of already factoring in 90 days ago. So just one curious if that's right. And then kind of secondarily to that, if that kind of gives you some more confidence in that ARR guide for the year.

Yeah, I think that's the right descriptor. I would say we factored in a little bit of pressure this year. And I would say the pressure materialized largely in line with what we expected. And so that's why I say the market expectation is in line with our expectations, which, frankly, we feel good about at this stage. And then to your questions about the sales force, you know, the two things that actually give us confidence as we actually look out to the year are, one, the breadth of participation in the sales force. the retention of the Salesforce. But also look, Salesforce is live and breathe on confidence. And the fact that we actually have people both building the pipe and the pipeline converting while it's still early because the pipe's relatively fresh in the cycle, that actually gives the broader team confidence, and it also gives us better visibility and more predictability as we go forward. So I would say incrementally, because we've executed against the plan so far this year, that, yes, boosts our confidence. You have a plan. It's a high-confidence plan when you start off, but you want to see that you're executing against that plan, and we made steady execution against that plan as we've gone forward.

Great. Thanks, Corey.

Thank you.

Our next question comes from Greg Moskowitz from Musoho. Please go ahead. Your line is open.

Hey, thank you for taking the question. It's great to hear about the traction with Threat Complete and Cloud Risk Complete, including that ASPs have been showing more than a 2x uplift. Is it fair to assume that you're seeing more of an uptake for these packages from enterprises as opposed to mid-market? And secondly, now that you have a few more months of data, do you have a sense of whether or not this strong ASP uplift could be sustainable? Thanks.

Yeah, it's a great question. As you would expect, yes, we do see early on a bit more of the bias around the consolidation offerings come from more enterprise-oriented or larger customers in the mix. That said, we do expect that to change. We have high resonance and excitement on our mid-size team. You know, from an expectations standpoint, perspective, the mid-market is in line with what we expected, but our team has lots of excitement about the pipeline that they're actually building there. The conversion rates, while very early, are healthy there. So we do expect that to span. And we actually think the case for consolidation is extraordinarily strong, not just in the enterprise, but also in the mid-market space.

Okay, that's helpful.

Thanks, Corey. Thank you.

Our next question comes from Brian Essex from J.P. Morgan. Please go ahead. Your line is open.

Hi, good afternoon. Thank you for taking the question. Maybe, Corey, just maybe if we can dig in and understand the setup for the second half of the year, both from a macro as well as a sales productivity standpoint in terms of what your expectations are embedded in the guidance for the rest of the year. So I guess on the sales front, are you assuming any kind of, I guess maybe what was the linearity of hiring last year and is there a certain maturity baked into your assumptions that you need to see from the sales force And then from a macro perspective, is it stay the same, deteriorate? What's the setup? Yeah, it's a great question.

So I will sort of like break down the balance. So one on the Salesforce side, I would say, look, our biggest assumption was that we would be able to retain the critical parts of the Salesforce and that they would actually be able to continue to be productive. We retain the productivity as a building is where we expect it would need it to be. So I would say the Salesforce piece is set up well. Keep in mind that we actually have a good setup when you think about a year over year comparative basis. We have a more experienced sales team. They've had sort of a ramp period on the new offerings. The offerings are competitive. The conversion rates are stable. And so from a Salesforce setup, we feel extraordinarily strong about the setup for the back half of the year. There's work to do, but both on a comparative basis and an outlook basis, we actually feel relatively good there. You know, the second part of the assumption for the second half of the year was predicated on the first half of the year, that we could actually build the right pipe. I would say we're still building the pipe, but the pipeline build that we're actually doing is actually increasing at the rate that we actually have. And so we think we'll have enough things, even in this pressured environment, for the back half of the year. And we expect the conversion rates to stay consistent with what we've seen in the recent quarter. Now, all that tees up to our expectations for the back half of the year is it continues to be a pressuring environment. We are not expecting the economic outlook to actually get better. We're still expecting volatility. We're still expecting pressure. And what gives me confidence is our sales team has shown that they can actually deal with that environment. That's a little bit of why we actually are having higher pipeline requirements, because we expect more things to be noisy and cycle. It's a little bit why our sales teams had to learn how to navigate, I would say, changing deal cycles. We expect longer sales cycles. But all that's baked into our assumptions. And so I would say our trends as we're set up today are for what we're seeing to continue forward for what we saw in Q1 and continue forward Q2 and Q3 and Q4.

Corey, it's worth underscoring that point because our sellers are really adapting to this environment. We know there's budget scrutiny across customers, across the board, and I think they really appreciate their understanding how to sell better in that environment.

Absolutely. Thank you for the question.

Super helpful caller. Thank you.

Thanks.

Our next question comes from Brad Reback from Stiefel. Please go ahead. Your line is open.

Great. Thanks very much. Corey, last quarter you talked about international retention rates being a bit of a headwind. Maybe you can talk to where they were this quarter and what the expectations are for the rest of the year. Thanks.

Yeah, I'll tag team that with Tim. But what I would say is that in general, from our expectations, the international team is performing in line even slightly better than what I expected. And so we feel pretty good about the outlook for the year going forward as far as our international teams go.

Yeah, no, Corey, that's right. Look, we've made that investment internationally. We're starting to see signs that it is paying off internationally. The retention has improved, let me say modestly, in Q1. Overall, retention is in line with our expectations and continues to be stable in North America, but something that's very important. We put a lot of effort into it and pay a lot of attention to it.

Thanks for the question.

Thanks very much.

Our next question comes from Matt Saltzman from Morgan Stanley. Please go ahead. Your line is open.

Hey, team. Good afternoon. Thanks for taking the question. um so fully appreciate the ars the the key top line metric that we want to focus on here but just in thinking about how that all flows through the model um can't help but notice that billings were a little bit lighter than expected in q1 so i'm curious what was the dr what the driver that was and kind of where you expect to make that up um you know over the course of the year to still achieve the updated revenue guide. Thanks.

Hey, Matt. No, I appreciate the question. Look, ARR is the core metric that we share with everyone, which embeds a lot of different things to get to that number, the new, the expand, retention, et cetera. I think you do have to be a little careful when you're looking at a quarterly billings number. We do look at that, but I do think a better way to look at it is on the last 12 months worth of billing. And if you do that, you'll see that that growth rate is more in line with the growth rate that we're seeing in ARR. There can be some anomalies. There's not a lot of those in terms of timing of billings with certain customers. But I would encourage you, Maverick, to take that longer term view. And I think it's probably the more indicative view that's going to link to ARR.

Thanks for the question.

Our next question comes from Adam Tindall from Raymond James. Please go ahead. Your line is open.

Okay, thanks. Good afternoon. Hey, Corey, coming off of RSA, cloud security was certainly a big theme. And on one hand, you know, kind of viewed as a hidden asset within the Rapid7 model. On the other hand, there were some private companies with very healthy funding suggesting that they're taking share in cloud security and coming out with hybrid and runtime capability in the back half of this year that'll go after some of the more traditional vulnerability management players like Rapid7. So I just wanted to give you the floor, you know, the truth behind some of those fears and competing with Wiz and how you're thinking about potentially defending that threat in the back half of this year. Thanks.

So first of all, I actually think it'll be great. It'll help market for customers that the way they should think about is across their complete environment. And when you have customers that say, I want to look at risk across on-prem, endpoint, and the cloud, we will actually dominate in that space. And there's a couple different reasons. One, I think Wiz or any other player will find this an incredibly long tail on vulnerability management. You can do some of the easy Windows pieces, but when you think about what customers are looking for for enterprise-grade vulnerability management, You have to be able to collect all the data, look at all the content, assess that, and look across that. That's not a 12-month engineering effort. If it was, this market would have been disrupted a long time ago. Most importantly, as we've been investing in the maturity of the cloud security, we've been under-marketing and under-selling it. So from a head-to-head perspective, We actually have quite a compelling capability in cloud, and now we've been ramping up in our focus on the sales and marketing of that. Now, when you combine all that together, it benefits us to actually have the market think about the way that we think about it, is that you should manage your risk holistically, whether it's hybrid, whether it's on-prem, whether it's at the endpoint, or whether it's at the cloud. And the faster that the market thinks about that, the easier it will be for Rapid7 to actually execute a strategy. And in that model, I think that we will be anyone head to head from a technology comparison basis. So we welcome any competitor in the market helping us frame the way that customers should think about it holistically from an end to end perspective, because they think that that benefits us. And we're certainly going to be investing in helping customers understand that they should be investing in those end to end risk management platforms.

Great points. Thank you.

Thanks.

Our next question comes from Joel Fishbein from Truist. Please go ahead. Your line is open.

Thanks for taking my question. Corey, one for you. I know it was a small acquisition, but Minerva, you did a little while ago. I know it wasn't very big, but I'd love to understand how that fits into the overall theme going forward, whether it will be fully integrated and how it will be sold going forward. Thanks. Appreciate it.

You know, great question. It's a tech and team deal and really enables us to unlock our threat complete strategy. You know, as you're aware, is that we have lots of demand for customers to actually help them manage from the endpoint to the cloud, the ability to detect, respond and remediate threats. Now, one of the things that our customers asked us for is that they had a wide range of endpoint technologies and antivirus technologies. The ones that could actually sort of like afford to or focused or had advanced endpoint protection technologies, we integrate with those, we'll continue to integrate with those, and we're happy with a partnership or coopetition approach. But for those that actually truly just had simple AV, And they relied on us to provide their end-to-end detection and response capability. Minerva allows us to actually do advanced in-memory protection on those endpoints that allows us to make sure that when we detect the threats, those customers are empowered to stop those. The same way our automation and our SOAR technology allows them to actually orchestrate across the environment and stop, the same way that we actually are able to stop processes, isolate resources, contain users. That same mentality is what actually has us actually helping our customers respond to their need for cost-effective detection response. And frankly, customers shouldn't have to make the trade-off between spending lots of money to actually have a highly effective and efficient end-to-end detection response capability. So again, our focus is meeting customers where they are, endpoint to the cloud, and providing the capabilities that they're asking for to deliver a robust detection response platform. Great. Thank you. Thank you.

Our next question comes from Gray Powell from BTIG. Please go ahead. Your line is open.

Great. Thanks for taking the question. So, yeah, it was good to see the increase in the complete mix to 20% of net new ARR. I think that number was 10% last quarter. And then can you maybe just – was that more on the cloud security side, or is that more the threat complete products? Just be curious what drove that improvement.

No, we got traction on both sides of the equation there. And the pipeline build has been healthy for both. And so we'll continue to focus on both. We don't, I can't recall, we don't do the line item reporting here on it, but we actually have gotten traction across both of those portfolios.

Yeah, Greg, and you're right. It was 10% of new ARR in Q4. So it's up significantly in Q1. Got it. All right. Thank you very much.

Thank you.

Our next question comes from Jonathan Ho from William Blair. Please go ahead. Your line is open.

Hi. Thanks for taking my question. And this is Garrett Burkemont for Jonathan Ho. So you mentioned the sales transition is ahead of schedule, ahead of your expectations. So can you just expand on that a little bit? Maybe what specifically is progressing well there and maybe where there's still room for improvement? Thanks.

Yeah, well, I think there's room for improvement in this is we have to hit the plan. So we're ahead of schedule on the plan, but because you're ahead of schedule, you still have to manage to the plan. And so that's the big, there's no big gap on sort of like where we expect it to be. And then specifically, you know, what's ahead and what's the next steps in the plan is, you know, there's a couple of elements that we've actually emphasized. One is that could you do the transition and retain the sales team and check? We've actually done a very good job of actually doing the transition and retaining the sales team with confidence. The second part is, could you actually get pipeline build, not just across a few people, but across a broad base of people? And nicely, we're seeing pipeline build continually starting to actually ramp and increase across a broader and broader selection of the sales force. And then thirdly, I think Tim highlighted this in his remarks, is that it's is not just a few reps, but is a larger and larger cross-section of reps landing deals. This is why that sort of moving from 10% to 20% over 20% matters. It's because you need the success to actually follow it. And so in Q1, we actually saw that progress. That was ahead of where we wanted to be. And we need to continue to see that progress in Q2. Now, our outlook for Q2 presumes that that progress continues because that's the setup that we have both in the pipeline and the conversion rates that we've seen. But those are the elements of the sales force is, Are they, you know, are they there? Are they motivated? Are they building the pipe in the right areas? Are they converting that pipe? And are they closing deals? And so far versus plan, it's at or better than what we expected across all of those metrics. Thank you for the question. Got it. Thank you. Yep. Thanks.

Our next question comes from Joshua Tilton from Wolf Research. Please go ahead. Your line is open.

Hey, guys. Thanks for taking my question. I know there's been a lot on it, but I kind of just want to come back to the guidance. It does imply that you guys have to kind of triple your net new ARR by 4Q. So assuming that this all does go to plan and you achieve that, you know, what percentage of net new ARR by the end of the year is going to come from these complete consolidated offerings? And I'm only asking because it does feel like in addition to just these bundles ramping, you sort of need to see a pretty meaningful improvement in the rest of the business. So one, am I looking at this the right way? And two, can you maybe just unpack for us the other 80% of net new ARR? You know, what's driving that and how will that trend for the rest of the year?

Yeah, so one, the primary drivers of the other part of the business, AR, is what you would expect it to be. It is our traditional detection response that doesn't have the complete consolidation factors around it. So think about that, the standalone SIEM category, it's vulnerability management, and it's standalone cloud. And really what you actually have there is, I would say, it's less efficient. You can clearly see that from the ASP dynamics than the packages. So you get efficiency as you actually build out the packages. But to clarify a couple things for you. One, in no way do we expect it to be 100% of our sales that are in the platform consolidations. We don't assume it. It's not in our base model. It's not remotely close to it. We still have to execute on ensuring that we actually are successful in landing and closing the traditional SIM, MDR, vulnerability management, cloud security, those elements. We still have to do upsell and cross-sell. So we have to add threat intelligence on. We have to add Sorum. All of those things are part of the business. So the way that I would actually just think about sort of like the back half of the year is one, I would just think about the backdrop and the setup. It's not just how it relates to this year. It's also what's the comparative basis to last year. Keep in mind, we actually had, we talked about sort of like the challenge at the end of last year, but we actually have those year-over-year comparables with a much stronger sales team that's actually more mature and in process with a stronger product portfolio. So one, if you just think about the setup, it's actually a much more favorable setup than the headline, I think, analysis that you actually gave would indicate. The second thing is that we have to have a robust pipe. We're building that. We're training towards the pipe that we actually need. for the back half of the year. And then we have to execute on the packages. It's clearly going to be above 20%, but we still have to execute on the other aspects of the business. But we are executing on those other aspects of the business. Cloud is actually, our performance in cloud is actually getting better. Even though VM is where we expected it to be, And I think we're in line with the market there. We still will close business. But most importantly, we're still going to be executing on the cross-sell and up-sell. So the expansion and the install base, which again is still a material part of the business, will be executed on that. So if you take that total setup, the setup... the packages, the upsell and the cross-sell, and then executing run rate against the parts of the business that we've already been executing against. I think we're set up quite well for the second half of the year and Q4. So I agree with the analysis that you actually gave from a numeric perspective.

Yeah, Corey, I would just underscore, we know the market opportunity there is it's over 30 billion. So it's huge. We know the demand environment is there. Yes, there are some challenges from macroeconomic budgets being tightened, but security is still critically strategic for all of our customers and our prospects. We see the pipeline, we see the conversion rates, we have the mature sellers, and we have the breadth of products, and we have the packages. And now it just comes down to execution, which we said will be heavily oriented toward the second half of the year. We're off to a good start, but we have more work to do. Absolutely.

Thank you for the question.

Our next question comes from Alex Henderson from Needham and Company. Please go ahead. The line is open.

Great. Actually, a pretty good follow-up to the question that was just asked, and I thought that was a good question as well. But I was hoping you could give us some sense of what a success trajectory would look like for the new ARR from these packages. If it's 10% going to 20%, is it 35 or 40 next quarter and 50, 60% in the out period? What portion of new ARR should be coming from it to hit your model as we go through 2Q, 3Q, and into 4Q?

Yeah, so it's a good question. It's directionally up. We're not going to provide a specific number at this time and at this stage. But what I would say is we would expect it to continue to expand. And most importantly, keep in mind, it's not just the packages. We also expect to continue to be doing cross selling and upselling. And so when we think about our ARR and expansion, there's a number of different elements that are involved there. But I would say we absolutely directionally expect it to continue to expand, but it's too premature to provide you a specific number of what it's going to be like per quarter by quarter right now.

Yeah. Well, if you're not going to answer that one, maybe I could ask another one. Can you give us any sense of whether there was any disruption associated with the financial debacle impacting the CFO behavior of your customers in late March with the linearity or any hesitation?

Yes, I'll give you a very quick response there. So one, what I would say is just like the whole world, I think lots of people took a moment and a breath to actually say, like, what does this mean? So we definitely saw some impact and some customers actually slowed down a little bit to say, like, hey, what does this mean? Is this sort of an indicator of a future sort of like banking crisis? But what I would say is both from our sales team perspective and our customer perspectives, that was only like a breath. It was a moment. And they got back to the business. And we actually had a fairly strong close to the quarter overall. But there was a breath that actually happened there. All right. Thank you for the questions. And let's keep going.

Our next question comes from Mike Walkley from Canaccord Genuity. Please go ahead. Your line is open.

Hey, guys. Good afternoon. It's Daniel on for Mike. Thanks for taking the question. Yeah, I just wanted to see if you guys could provide some detail on how the productivity of your sales reps are trending, especially as they're now selling the two complete bundles. Is this, I guess, sort of in line with what you had previously been expecting, or are they ahead of progress?

It's in line with what we were expecting. And I would just say the progress goes a little bit to the earlier questions about the mix shift and the pipeline build. That's where we're actually ahead. And frankly, the sales of the new packages and bundles, that's where we're ahead. But I would say the overall productivity is in line to expectation. Again, our expectations assumed that there was going to be a ramp based on training, which we're seeing and we're expecting and we're delivering accordingly. And, you know, we are seeing some of the larger deals that we actually talked about earlier, which do have slightly longer deal cycles in addition to the environment. So I'll say productivity is exactly what we expect it to be. And so as we look forward, that actually gives us the confidence that we are building pipes that can actually close at the productivity rates we expect in the back half of the year.

Our last question will come from Shabli Seyrafi from FBN Securities. Please go ahead. Your line is open.

Yes, thank you very much. So your 10k showed that your sales and marketing employee headcount grew by 16% in 2022. What kind of headcount growth in S&M do you expect in 23?

I think as Tim sort of like conveyed it earlier, I think we are looking for a pretty modest growth there. I think we expect more productivity increases. We have the benefit of actually having the people in place. It was allowing them to get more tenured, to get the training, the enablement and the ramping. So I would expect modest and that's really a focus on the productivity. And I think we're trending well there.

Yeah, Shevely, as you know, we've doubled our profitability guidance from year over year and free cash flow, and we are certainly very committed to that. We got in front of the headcount hiring curve over a year ago, and it's something that we're just going to watch very carefully along with all of the expenses, the way we invest in the business.

Absolutely. Thank you for the question. Thanks.

We have no further questions. I would like to turn the call back over to Corey Thomas for closing remarks.

Well, thank you all for spending time with us this evening. And I hope you all have the great rest of the day and a good week.

This concludes today's conference call. Thank you for your participation. You may now disconnect.