SecureWorks Corp.

Good morning and welcome to the SecureWorks first quarter fiscal 2022 financial results conference call. Following prepared remarks, we will conduct a question and answer session. If you have a question, simply press star then one on your telephone keypad at any time during the presentation. At this time, all participants are in a listen-only mode. We are webcasting this call live on the SecureWorks investor relations website. After the completion of the call, A recording of the call will be made available on the same site. Now, I will turn the call over to Paul Parrish, Chief Financial Officer. You may begin.

Thanks, everyone, for joining us. With me today is Mike Cody, our CEO, and Wendy Thomas, our President of Customer Success. During this call, we'll reference non-GAAP financial measures, including non-GAAP revenue, gross margin, operating expenses, operating income, net income, earnings per share, EBITDA, adjusted EBITDA, and cash flow from operations. A reconciliation of these measures to their most directly comparable GAAP measures can be found in our web deck and press release, which are available on our IR website. Please also note that all growth percentages refer to year-over-year change unless otherwise specified. Finally, I'd like to remind you that all statements made during this call that relate to future results and events are forward-looking statements based on current expectations. Actual results and events could differ materially from those projected due to a number of risks and uncertainties, which are discussed in our press release, web deck, and SEC filings. We assume no obligation to update our forward-looking statements. Now I'll turn it over to Mike.

Thanks, Paul, and thank you, everyone, for joining us on this call. I appreciate your interest in SecureWorks. Before I discuss the quarter, I'm announcing my upcoming retirement as CEO and a member of the SecureWorks Board of Directors, effective September 3rd, 2021. It's been an incredible pleasure and honor to have served as CEO of SecureWorks for almost 20 years. I thank our Board of Directors and all of my SecureWorks teammates over the years for for this incredible opportunity. When I joined SecureWorks in 2002, we were a small team with a vision to protect organizations from the growing threat of cybercrime. Now, nearly 20 years later, SecureWorks is a global leader in cybersecurity with the best threat intelligence and products to secure our customers and partners. We have grown from less than $1 million in revenue to over a half a billion dollars. We had a great first quarter which you will hear more about in a few minutes, and we continue to execute on our strategy. Our future is even brighter as our momentum in TAGIS customer acquisition, revenue, and ARR continues to accelerate. I put a lot of thought and preparation into this decision, working closely with the Board in recent years to prepare for this transition as we implement our succession plan. As a result, I am pleased to share that with my full support and recommendation, the SecureWorks Board of Directors has appointed Wendy Thomas to succeed me as the company's next president and CEO, effective September 3rd, 2021. Wendy has been with SecureWorks for nine years and has been instrumental in driving the company's strategy, including our focus on software development and the launch of Tagus. Please join me in congratulating Wendy.

Thank you, Mike. It's a privilege to serve as our next president and CEO. We're at a pivotal point in our business, and I'm confident that the momentum of our transformation will drive value for all of our stakeholders. I will be working closely with Mike in the coming months to ensure a seamless transition. And I'd also like to thank Mike for his leadership and mentorship over the years. Mike has built the company into what it is today, and I know I speak for so many in wishing him the very best. Now I'd like to turn it back over to Mike to go through the business results.

Thanks, Wendy. Wendy will also join me and Paul to answer questions during the Q&A at the end of this call. As I look across the threat landscape, organizations are facing an increasingly complex and hostile threat environment. Conventional point products operating in silos are not keeping up with the adversarial tradecraft, resulting in an increasing number of breaches. Organizations need comprehensive visibility in their IT infrastructure and efficient detection and response to attacks, but the market is overloaded with more and more point products that increase complexity, and we continue to have a shortage of security talent. In light of these challenges, our security products and expertise have never been in greater demand. Pages, our cloud-native security analytics platform, defends against these evolving attacks. Enriched by our firsthand threat intelligence, Tagis provides threat detection and response across endpoint, network, and cloud and offers a single solution for SIM, XDR, and SOAR use cases. We have made Tagis an open platform with hundreds of third-party endpoint, network, cloud, and threat intelligence integrations. By correlating events from these tools, we provide the comprehensive visibility customers need while maximizing their existing investments. Let me give you an example. Recently, an employee at one of our customers clicked on a link in an email which downloaded and executed a malicious script. Almost immediately, the customer's third-party endpoint product and Tagis XDR both triggered an alert. However, the endpoint product triggered hundreds of times for similar alerts across 30 different systems within the customer's environment. Using the same data, Tagus focused on the behavioral aspect of the event. Embedded with our deep intelligence of how attackers operate, Tagus is able to separate the true malicious activity from the noise, only alerting the company one time with the real threat. In addition, the attacker had successfully loaded a remote access tool onto the system. Moving beyond the visibility of the endpoint product, Tagus identified this attack pattern and cut off the intrusion with no harm to the customer. This is why Tagus is so powerful. It fills the gaps in visibility between point products that adversaries exploit, providing a holistic defense. Moving to results, our first quarter marked a strong beginning of the fiscal year with clear progress. TAGIS ARR has grown to $72.4 million and 17 percent of total ARR. Importantly, TAGIS ARR growth on an absolute basis continues to accelerate with $17.5 million added to ARR this quarter, up 35 percent from 12.9 million in the fourth quarter of fiscal 21. TAGIS revenue reached $14 million and the average revenue per Tagus customer was approximately $143,000. We ended the quarter with 500 customers on the Tagus platform, up 25 percent sequentially, as we added 100 customers in the first quarter. Finally, even as we're scaling Tagus, we achieved total gross margins of 62 percent, the highest in our history. When I speak with customers and prospects, they consistently ask for three things. One, the best security expertise and intelligence backed by machine learning and data science delivered in real time without security experts needing to tune their numerous products for each new threat tactic. Two, full visibility of their environment to clearly see how attacks spread throughout their network so when they respond, the entire attack is shut down. And three, they do not want to rip and replace their existing security infrastructure. Tagus XDR solves these problems. For example, we recently signed a Tagus contract with a large North American conglomerate. They wanted a software solution that could detect and respond to threats across their environment and help their team save time by focusing on severe or critical alerts. Before they became a customer, The Tagus XDR demo gave them full visibility across their environment, demonstrating its detection power. Now, they receive high-fidelity alerts that are automatically enriched with threat intelligence from our CTU research team. They have real-time access to SecureWorks chat with an expert to help with their investigations and reporting capabilities that provide the full story of their security program to share with their senior management and board of directors. Their feedback has been very positive. They feel confident in their security, and they're pleased with their choice of Tagis over other competitors. Now, let's talk about the progress on our portfolio. We're proud to announce that Tagis Managed XDR, our MDR solution, was named a leader in the Forrester 2021 MDR wave. While this recognition is gratifying, the team is focused on driving further enhancements. We recently released our TAGIS XDR adversary software coverage tool. This new tool shows granular detail on real threats as mapped by the MITRE ATT&CK framework and how TAGIS detects these attacker tactics, techniques, and procedures with TAGIS' XDR coverage now provided across 92% of the latest framework. And with research from ESG showing that 76 percent of XDR customers would reduce or phase out their SIEM based on XDR's improved detection and response capabilities, we are well positioned to benefit from this market shift. Finally, we're making continued progress on our go-to-market effort. As a reminder, we are investing significantly in our channel strategy to build momentum in the SecureWorks partner community, including an MSSP track. This push into the channel provides two key benefits. First, a robust partner program will help us accelerate Tagus sales. MSSPs get to add our leading software capabilities to their portfolio, while managed service providers can extend into security services by leveraging the Tagus platform and applications. In addition, our MSSP partner certification program addresses one of the fundamental challenges in our industry, a lack of security talent. We know this market better than almost anyone and have the unique ability to train MSSPs and empower them with the same software we use. Our first MSSPs have been trained and certified and are now selling pages. We are also excited to share that Dell announced a new managed detection and response service powered by Tagus XDR. This partnership unlocks the Dell relationship in a way that wasn't possible before, expanding our reach to tens of thousands of organizations that trust Dell for their IT, security, and services needs. Make no mistake. there is a lot of enthusiasm in the channel to get access to our software, investigation workflows, and threat intelligence. The work that we put in today is the foundation for our growth in the future. Looking ahead, we continue to remain laser-focused on three goals. First, innovating and expanding the TAGES platform. Second, ensuring the protection and success of our customers. And finally, accelerating our go-to-market. In closing, I am pleased with the progress we are making to strengthen the security community. Our work enables contributions and sharing from across the security landscape to collectively beat the adversary at scale. I will now turn it back to Paul.

Thanks, Mike. As noted, in Q1, our Tagus ARR grew to $72.4 million at quarter end, revenue grew to $14 million, and we finished with 500 customers. We're most excited to see our ARR and customer momentum is accelerating sequentially, reinforcing our conviction that we can significantly scale the platform this year. Q1 revenue was down 1%, primarily driven by a reduction in non-strategic areas of the business as we pivot toward tagious growth opportunities. Total subscription customers were 3,600, down from 3,800 at year end. Tagus customers increased from 400 to 500, while managed security subscription customers decreased by 300. While our total subscription customer count is declining, we see a shift to better long-term economics. Whereas Tagus customers have an average ARR of $143,000, the median ARR per customer lost in Q1 was $22,000. Gross profit margins were 61.9 percent, up 170 basis points sequentially and 380 basis points year-over-year. Sequentially, we benefited from strong demand and instant response, resulting in high utilization of our teams, favorably impacting overall gross margins while we were continuing to scale Tejas. Year-over-year, we've seen significant improvement in our subscription-based solutions margin and expect a longer-term benefit from improving mix as our mix of software sales increases. Operating expenses were up 1%. R&D expenses increased to 19.4% of revenue, up from 16.1% in Q1 fiscal year 21, and we capitalized $1.6 million in incremental R&D spend as we accelerate investments in our security analytics platform. Sales and marketing expenses were 25.6% of revenue, down 40 basis points. And general administrative expenses totaled 13% of revenue, down from 14.5% last year, with the difference primarily attributable to professional fees and consulting costs last year. Adjusted EBITDA margin was 5.8%. Turning to cash performance and the strength of our balance sheet, cash flow used in operations was $30.6 million, with the Q1 use driven by our annual performance payouts, along with an increased working capital. CapEx was $2.3 million for the first quarter, including $1.8 million of capitalized R&D investments in Tejas, an overall increase of $1.3 million year-over-year. We ended the quarter with $181 million of cash in an untapped credit facility. Now for our outlook, starting with Tejas. For full fiscal 22, we continue to expect Tejas ARR of at least $150 million, which translates to revenue of $90 to $100 million. We expect continued strong growth in new customer acquisitions, accelerating as we ramp and leverage our channel sales and marketing investments. Further, we anticipate an accelerating portion of our existing customers will transition in fiscal 22 as they look to benefit from the additional capabilities offered by the platform. We remain committed to providing incremental disclosures as the year progresses and look forward to updating you on that in the future. We provided guidance in the press release, so I won't go through all the details, but a few points to call out. We are raising our full-year guidance and now expect revenue of $540 to $550 million, adjusted EBITDA of negative $5 million to positive $5 million, and a non-GAAP loss per share of 13 to 4 cents. We are increasing cash flow from operations guidance to break even to a positive $10 million. CapEx has increased to a $7 to $10 million range as we capitalize additional Tejas software development. Overall, it's an exciting year for the company and a pivotal transition period. There's a lot of work to do, and our focus is on executing against this transition to capture the significant value we see. I invite Mike and Wendy to join me now for Q&A. Operator, can you please introduce the first question?

Thank you. I will now open the call for questions. If you have a question, please press star then 1 on your telephone keypad. As a courtesy to others, please ask no more than two questions. We'll take our first question from Saqib Khalia with Barclays. Your line is now open.

Okay, great. Hey, good morning, guys. Thanks for taking my questions here, and congrats to both Mike and Wendy on your next chapters.

Thank you. Good morning. Thank you.

Good morning. Wendy, maybe just to start with you, and Mike, feel free to chime in here, but maybe you could talk a little bit about what you're seeing as core MSS customers have the option to convert to MDR, or let's just say convert to TAGIS. What sort of churn rate are you seeing as those customers make that decision? And conversely, what sort of run rate opportunity are you seeing as some of them do make that conversion. Does that make sense?

It does, yes. Thanks for that. So the great news is that our MSS base makes a great target for conversion to TAGIS. And as we've talked about before, we started a more formal program around that in fourth quarter of last year. And we're actually seeing acceleration of that conversion rate to TAGIS. just as we see an acceleration on new customer ads to Tagus. And what's been great is that we see them, on average, actually increase spend with us in that process. And that primarily comes from them increasing the coverage to their full environment right across endpoint cloud network business systems. And so they both gain in terms of efficacy efficiency because of the extension into investigations that are more automated and response capabilities. So there's an added benefit in ROI for them and an increased capture and spend for us. And you see that in our increasing total average revenue per customer, and that's driven by those higher average revenue per Tages customers.

That's great. Very helpful. Maybe for my follow-up for you, Paul, you know, I think you touched on this a little bit in your prepared remarks, but I was wondering if you could just talk a little bit about the differences in gross margin profile, you know, across sort of the, let's just call it the three main parts of the business, right, MSS, SAS, and SRC, even anecdotally, just to sort of get a sense for kind of how that shift could kind of play out over time.

We talked about this some in Investor Day when we had that last December. We haven't disclosed at that level of detail in our numbers. And as we continue to explore disclosures going forward, clearly that's something we'll look at and evaluate over time as size and scale occurs with our TAGIS deployment. So look at, I think, as has been discussed in the past, our SRC margins are ones that we're happy with. But, of course, over time, we see the TAGIS margins, as we sell more and more software only, those margins will grow resulting from that. So size and scale is very important to continue that growth of the gross margin curve as TAGIS is deployed. Got it.

Very helpful, guys. Thanks again.

Thank you. Our next question comes from the line of Mike Sickles with Needham & Company. Your line is now open.

Hey, guys. Thanks for taking the questions this morning. Congrats on the strong quarter. I was curious if we could dig into the gross margins. Paul, I think you had a comment that there was a partial benefit from higher utilization of your teams regarding the strong demand for incident response. And I'm curious, can you help us think about what that benefit was to the quarter as we're trying to look out for the remainder of the year if if gross margins should normalize downward if that incident response man lights up?

Well, we did benefit from that, and we're very proud of our teams, how they've responded to everything that's going on in the world, as we all know from reading the newspaper. The margins benefited. We didn't disclose how much that benefited from. But keep in mind, as we go through this year, this is a transition year for us as we're ramping up the efforts around TAGIS. gaining scale and size with customers on that. And there will be pressures on margin as you go through the movement between our customer base and could continue to improvement from IR. That's something that comes as the demand develops, and we all know that's strong in the economy right now, but that's not something we control. It's what's happening in the environment.

Understood. Okay. And then I guess the other question that I have for you, I know that you guys have been investing in the MSSP track as well as sales and marketing in general. So I'm curious with this decline that we saw in Q1, at least on a year-on-year and sequential basis, how should we think about sales and marketing as we move throughout the remainder of the year?

Yeah. So we're going to be continuing to invest in sales and marketing. As you're ramping a channel distribution up, there will be costs on the front end, and we'll see that affect FWOC 22 as part of the transition year.

Great. Thank you, guys. Thank you.

Thank you. Our next question comes from the line of Hamza Fadawalla with Morgan Stanley. Your line is now open.

Hey, guys, good morning. Thank you for taking my question and congrats to Mike on the retirement and congrats to Wendy on the on the new CEO appointment.

Thank you.

Thank you. Maybe for my first question for Wendy and Mike, just around sort of the momentum you're seeing around the partnership ecosystem. So you announced some new distribution partnerships for cages. I think I read one in Asia pack. Can you talk a little bit more about how you're trying to bring on sort of net new distribution partners to the KGIS FDR platform? And then I have a quick follow-up for Paul.

Sure. I can talk a little bit about that. So I'm glad you read the recent announcement. And as you know, we have been focused on building out our channel program, and there's sort of a two-part focus to that. The first was really starting with expanding our distribution and resale relationships. And the second, which was launched more recently in May, is the Managed Security Service Provider Partner Program. And no small part of that MSSP program is continuing to work with distributors and resellers on the first part of the strategy with respect to channels. to really create this force multiplier for us to address, frankly, a growing market opportunity and extend the reach of the platform. So we're really pleased with the momentum of the number and the quality of partners and distribution partners that we've signed up to date. I think you'll see us continue to grow and announce those partnerships and see traction from that over time over the course of the rest of the year.

Got it. Helpful. And then just a follow-up for Paul. Paul, you mentioned some of the transition impacts, but at what point do you think we can get to a point where we sort of reach an inflection point in overall ARR where it starts to grow again? Is that going to be beyond FY22? Could we see that potentially later this year? Any color you can give us there.

Yeah, so we haven't given guidance beyond this year. And we're going to give the guidance on the ARR related to TAGIS, which we're very excited about, as you can see in the growth percentages as we grow up to greater than $150 million in ARR. So we discussed some of this when we had the Investor Day, and you can go back and look at the growth that we talked about during the Investor Day, but look out beyond FY22. for that occurrence, and 23 wouldn't be outside the norm for some expectation. Thank you.

Thank you. Our next question comes from the line of Brian Essex with Goldman Sachs. Your line is now open.

Hey, good morning. Thank you for taking the question. Wendy and Mike, congrats for me as well. Wendy, looking forward to working with you, and Mike, best of luck on your next steps.

Thanks, Brian.

Thank you. Maybe if I could dig in a little bit to the customer growth. If we look at the Cages customer growth, just want to get a better understanding of where those customers are sourced from, how many are conversions from the existing installed base, And what is the primary motion of the customer acquisition on the Tagus platform at this point?

So the growth is coming roughly from half from existing customers, half from new logos. And the excitement around Tagus is, is causing many people to look at our product with excitement and repurchasing it. And so we're excited about that. I think over time the growth in new logos will continue to go up that curve, and the existing customers will come down as that percentage, but roughly 50-50 right now.

And I'll just add in, as we mentioned, we are seeing accelerating momentum in both new customer additions and the number of customers that are re-solutioning onto the platform. So you'll see that combined kind of fuel to the growth. And in terms of total logo count, the pressure you see is really around the churn of much smaller customers. So the median customer that we lost had an average revenue of about $25,000. So it's just a reflection, frankly, of the shift in our business model kind of farther up market and, and powered by that, by the momentum that we see on both sides of the house on Tejas.

Right, right. That makes a lot of sense. So thank you for that. And I guess, what is that process like? If you, if within the installed bases you've identified, or I imagine you identify customers that are, that are kind of ripe for conversion, how far are we through that process? And Does that become a competitive process? Is this a catalyst for, you know, customers to evaluate other options outside of SecureWorks? Or do you have a natural benefit as an incumbent in that relationship and you're familiar with the platform and you've already started that education process so that you kind of grease the rails, so to speak, to onboard existing customers for conversion onto TAGs? Just want to get a better understanding of you know, how that process manifests itself in your customer growth?

Yeah, it's a great question. And as I mentioned, as we've gone on this journey with our customers starting late last year, we've certainly improved a few things that you touched on. First and foremost, we've always approached this as making sure that for our customers it feels like an upgrade experience. We do have the advantage of knowing them very, very well, right? We know everything about their environment and their security use cases. And so we make that process as painless and seamless as possible. The second thing to your point about, you know, potentially exposing this to become a competitive bidding situation, what we've done is approach customers who are the right fit now, and that makes sense for them, regardless of when their contract end date is. And in fact, it's been better to have that conversation well in advance of their renewal date because we are perfectly fine to exchange contractually committed spend from one platform or set of solutions to the other. And that tends to not open up a competitive situation as a competitor is unlikely to do that.

Got it. That's super helpful. Thank you very much.

Thank you. Once again, if you do have a question, Press star 1 on your telephone keypad. That's star 1 to ask a question. We'll now take our final question from Sterling Audie with J.P. Morgan. Your line is now open.

Hey, guys. Hopefully last but not least. Mike, you know... Mike, it just seems like yesterday that we were standing at RSA having our first conversation. So congratulations on, you know, a wonderful tenure. You know, growing a company from as small as you started to where you are now is no small feat. Wendy, congratulations and well-deserved on the appointment.

Thanks very much, Sterling. Was that RSA event 20 years ago or 10 years ago? Yeah, exactly.

I'm just going to say yes and leave it there.

Good answer.

So I just wanted to dive into Tejas in terms of the customer profile. Given the average size, it would seem that it looks like it's trending towards a larger customer. I'm kind of curious if you can give a sense of where you're seeing the sweet spot of the land, and then I have one follow-up.

Sure, I'm happy to take that. So you're right, and you can obviously see that reflected in the growing revenue per. And as we've talked about before, we really target what we would term sort of mid-market in terms of security program as opposed to necessarily the size of the customer because, you know, clearly in the financial services sector, for example, highly mature customers who have been, you know, dealing with regulatory compliance around security and just, frankly, being the target of attacks early, early on, that they've advanced much farther than necessarily some other industries. And so what we talk about is really customers who – are willing to invest in security, but they might have a very small security team with kind of a roadmap and a desire to increase their maturity with a partner like us, or folks who put together sort of best in breed solutions, and they're looking for a platform to basically help them scale across all of their point products in place and drive kind of efficacy and efficiency across their security stack. Whether they're assembling those solutions or they're looking for a partner to run security with them, that tends to be our sweet spot of both new customers and customers that are transitioning over. And they're willing and able to invest in a security program that's really driving an amount of spend with us that's probably the right business model for us.

That makes sense. And then on the new logos that you brought in, I'm curious – Who are you seeing as that final short list of vendors that are vying for those opportunities? And are you actually, in all these cases, going through some sort of official RFP, or are they just looking to you as a vendor and they're not really going through, you know, a full-blown bake-off process? They're just coming to you because of your expertise in the industry?

We really see a mix of both. Well, I'll say this. We definitely see customers that come straight to us simply because of our reputation in the marketplace. We also have customers who do, to use your term, a bake-off, but not necessarily kind of a formal RFP process, and I think that's related to the target segments that we primarily operate in. When they are doing that sort of comparison shopping, I'd probably call it, The ability to, frankly, deploy our demo in their environment and immediately start to see detections that they hadn't seen before tends to help us. And to do that not just on their endpoint or in a container environment, but to be able to see that holistically across their network, that tends to help us have a pretty high win rate as soon as they sort of see what they're dealing with. So they may have other players in there doing a similar demo who want to put in their own proprietary tech stack. So we tend to win with this open platform approach.

Right. And competitively, when you see who are you competing, what products are you competing against most frequently?

Well, there's certainly some emerging XDR players who may be in the mix, or it may simply be a sort of a bake-off of security spend or share of wallet. As we introduced capabilities recently around sort of covering many of the SIM use cases and can help customers reduce their sort of total cost of ownerships with features in our XDR platform that cover use cases for other point products, that also tends to help us win in those types of share of wallet bake-offs.

Makes sense. Thank you.

Sure.

Okay. Well, thank you. That wraps the Q&A and today's call. A replay of this webcast will be available on our investor relations page at secureworks.com, along with our Q1 and full year fiscal 22 web deck with additional financial tables. Thanks again for joining us today and have a good day.

Ladies and gentlemen that concludes today's call. You may now disconnect at this time.