This conference call transcript was computer generated and almost certianly contains errors. This transcript is provided for information purposes only.EarningsCall, LLC makes no representation about the accuracy of the aforementioned transcript, and you are cautioned not to place undue reliance on the information provided by the transcript.
spk00: Good morning and welcome to the SecureWorks Third Quarter Fiscal 2022 Financial Results Conference Call. Following prepared remarks, we will conduct a question and answer session. If you have a question, simply press star then 1 on your telephone keypad at any time during the presentation. At this time, all participants are in listen-only mode. We are webcasting this call live on the SecureWorks Investor Relations website at After the completion of the call, a recording of the call will be made available on the same site. Now, I will turn the call over to Andrew Storm, Vice President of Investor Relations. You may begin.
spk03: Thanks, everyone, for joining us. I'm Andrew Storm, VP of Investor Relations at SecureWorks. And with me are Wendy Thomas, our CEM, and Paul Parrish, our CFO. During this call, we will reference non-GAAP financial measures. You will find the reconciliations between these GAAP and non-GAAP measures in the press release and presentation posted on our website earlier today. Please also note that all growth percentages refer to year-over-year changes unless otherwise specified. Finally, I'd like to remind you that all statements made during this call that relate to future results and events are forward-looking statements based on current expectations. Actual results and events could differ materially from those projected due to a number of risks and uncertainties, which are discussed in our press release, web deck, and SEC filings. We assume no obligation to update our forward-looking statements. Now, I'll turn it over to Wendy.
spk08: Thank you, Andrew, and welcome, everyone. Our focus at SecureWorks is to ensure our customers achieve their best security outcomes, and we help to secure their mission, their progress, by enabling them to outpace and outmaneuver the adversary. Buying individual security products that react independently won't make an organization safe because they fail to provide timely visibility into their entire technology infrastructure. For effective security, organizations require a holistic, integrated detection and response platform that measurably reduces their business risk from cyber exposure, optimizes their investment in security solutions, and addresses the shortage of expert security talent. Our Tagus solutions were purpose-built to solve these challenges. First, Tagus brings a comprehensive big data answer to security challenges, applying our analytics and wide breadth and depth of detections across the endpoint, network, cloud, email, and beyond, driving superior threat detection and enabling automated response. With over 98% coverage against most categories of the MITRE ATT&CK framework, Cages excels at detecting and halting sophisticated attacks early in the kill chain. Second, Cages was architected from day one to be extensible, unifying an organization's existing security infrastructure, empowering customers to maximize return on investment quickly. Industry analysts evaluating Cages regularly call out our breadth of integrations as a key differentiator in shortening customer time to value. And third, with our 20 years of experience running scaled, effective security operations built into the design of Tagus, our platform enables significant improvements in our customers' operating efficiency. A recent Forrester study concluded Tagus can reduce risk by 85%, with average savings of $1 million over three years, a solid return given our average Tagus spend per customer of $149,000. The market opportunity for us and our partners is large and growing, with an estimated addressable market approaching 100 billion by 2025, growing in the double digits annually. Reflecting the significant opportunity, we're proud to announce that in the third quarter, Tagus ARR nearly tripled from last year, reaching 123 million, and Tagus customers increased 170% year-over-year to 800. Our growth has been driven by the strength of our solutions, and our work to constantly innovate and improve our portfolio continues. In the third quarter, we announced the addition of a machine learning-based endpoint prevention solution to Tagus. The incorporation of superior prevention helps further reduce customer security risk and allows customers to both consolidate and reduce overall security spend. We recently launched a global technology alliance partner program with several initial partners, including AWS, Zscaler, Corelight, and others. Because Tagus was architected from the outside to be extensible, we're able to provide customer value quickly as we expand our technology alliance partner relationships. We also continue to improve our security orchestration and automation capabilities with best practice playbooks, additional connectors, and a growing set of automated response capabilities. These enhancements, along with custom reporting and extended log retention options, fuel our ability to display SIMs across security use cases. In fact, SIM displacement is a big opportunity for us. The SIM market for security is several billion dollars a year, despite the high cost to implement and maintain and low security efficacy. Our Tagus XDR use cases go beyond what SIMs promise. but never delivered on, especially on the response side. Increasingly, we're seeing companies put out RFPs to upgrade their SIMs, but switch to buying Tejas instead. As an example, we recently signed a UK logistics company to a multi-year deal. This customer had an existing SIM that they'd implemented, but there were significant gaps in visibility and coverage, and maintaining the system was requiring too much from their four-member team. In short, they were falling behind. So they put out an RFP to either supplement the support for their SIEM or transition to another solution, and 11 companies competed for the contract. The company chose SecureWorks Tagus for the following reasons. First, their security coverage went from 60% to 100%, reducing their financial risk of a breach. Second, our detectors and integrated SOAR capabilities, which are continuously updated and tuned by our data science and security experts, reduced the workload on their team, and significantly lowered the operating costs they initially budgeted for. Third, the simplicity of our pricing model resonated. They were weary of data overage charges and preferred our simple, predictable pricing model. And finally, our standard offering met their requirement for a minimum year of log retention. Big picture, switching to Tagus XDR met all their needs, cut their operating costs in half, significantly reduced their risk, and the deployment was far easier than the SIM had been. I'm hearing this story more and more from sales. Our biggest hurdle and our biggest opportunity is market awareness that these returns, in fact, can be achieved. It's early, but the math around total cost of ownership for customers is compelling, and the security outcomes are clearly better. To wrap up on product, I want to congratulate the team and call out some recent recognition Tejas XDR won the 2021 CISO Choice Awards for Best Security Analytics. IDC named us as a leader in their 2021 Worldwide Incident Readiness Report, covering both proactive and emergency incident response, powered by the Tejas platform. And our vulnerability management product, Tejas VDR, was reviewed by SC Media, with the conclusion stating, a novel and unique approach to removing much of the manual and mindless work associated with vulnerability management. The bold approach pays off and leaves us wondering, why doesn't everyone do it this way? The vulnerability management market is more mature than XDR, but we see a shift underway from compliance driven to risk and security driven solutions, making the market ripe for disruption with our solution well placed for this shift. This recognition was earned on the strength of our technology and the favorable references of our customers. In fact, a key to our success is the continuous and rapid innovation on Tagus fueled by the voice of our customers. And our customers regularly express their appreciation for how quickly we address their feedback. Our customer-centric approach is paying off. Turning to go-to-market, there is a large number of security service providers that could improve their security efficacy and operational efficiency with Tagus. As an example, this quarter, we displaced a major competitor at an existing MSSP in the Asia-Pac region. The aha moment came during a demo when they realized our solution is so intuitive it could make their junior analysts far more effective. Cages has everything needed delivered to their fingertips, all the counter-threat info, research, telemetry, all in one. They had also worried the competitor's solution was missing threats, but with our coverage fully transparent, and in the public via our software adversary tool, they were confident Tagus provides superior coverage. There are also thousands of technology services providers globally that want to extend their services into security. To succeed in this market, they need an expert security partner to help them ramp quickly and effectively. As the long-term leader in managed security services, we take everything we've learned and accomplished in our 20-plus year history and provide it to our partners, enabling them to deliver the same capabilities via our Tagus platform. While we launched our MSSP program in February, we're excited by the results to date, with 30 MSSP signed and 19 fully certified, with more in the pipeline. We'll continue to provide you updates on this front. Finally, we announced to our customers and partners the end of sale and end of life dates for the majority of our other managed security services. We will stop selling these services at the end of this fiscal year and will not renew contracts with end dates that extend beyond the close of our next fiscal year. This announcement, made early in the fourth quarter, has already driven an uptick in customer engagement to initiate the transition process onto Tagus. While the majority of our other MSS services are a natural transition, really an upgrade to Tagus, there are a handful of non-strategic services which we are transitioning to our MSSP partners or that our customers are taking in-house. To give you a sense of what I mean, let me share a customer story with you. We proactively reached out to an international media customer and asked if we could set up a demo of Tagus to show them how much incremental value it offers. Our team walked them through the capabilities and pricing, And after just a few conversations, they were sold on the depth and breadth of our detection capabilities, as well as expanded coverage of their entire network endpoint and cloud telemetry. And they were confident with the incident response support that reflects the real R in managed XDR. The end result was re-solutioning to Tagus for 20% higher ARR with higher margins. Part of the deal, however, was that they insourced the firewall management we had been providing. Because of this, the 20% lift in ARR was net of the loss of the firewall management revenue. Normalizing for that, we'd have been receiving 50% more ARR. Paul will give you more details of the financial profile of our transition, but this is a good example of the transition we're driving, increasing the security value delivered to our customers while executing a fundamental shift to a higher value business model. To bring this home, SecureWorks today is a very different company than it was just a few years ago when we first set our vision to turn the tide in the security fight. Our teams have delivered on this vision and are focused on supporting this transformation on behalf of our customers and partners. And I would be remiss if I did not thank them for all that we've accomplished so far and will continue to accomplish moving forward. With that, I'll turn the call over to Paul Parrish.
spk01: Thanks, Wendy. To start, Tejas ARR continues to grow with over $123 million of ARR at the end of the quarter, up 22% over Q2. Tejas subscription revenue is up 159% year-over-year, while other MSS revenue declined 20%. Overall subscription revenues were down 4.9% year-over-year as we continue our transformation journey. Average revenue per TAGES customer was approximately $149,000, continuing to generate a premium to our $98,000 for non-TAGES customers. Professional services revenues of $30.7 million were down 8%, with total revenue declining 5.6%, primarily related to reduction in non-strategic business. We've been actively shedding costs through the exit of low-margin services, scaling support for our CTP platform, and driving automation throughout the business to improve margins. The result is gross margins expanded 300 basis points year-over-year to 64%, with non-GAAP subscription gross profit margins of 370 basis points, resulting in subscription gross profit of $400,000 year-over-year, despite the revenue decline. Sales and marketing was relatively flat sequentially, at 25% of revenue due to lower direct selling costs, largely offset by increased investments in channel and marketing. R&D rose year-over-year to 23% of revenue as we continue investing to drive innovation on Tejas and maintain our lead in threat intelligence and research. G&A was down year-over-year and flat as a percent of revenue. Adjusted EBITDA was $4.7 million down from $11 million last year as we invest in TAGIS. Cash flow provided by operations was $11.5 million, with capex of $1.6 million for the quarter. Our balance sheet remains strong with $205 million of cash, no debt, and an untapped credit facility. Looking forward to our guidance for FY22. We expect full year total revenue to be $535 million to $537 million, implying fourth quarter revenue of $128 million to $130 million. We expect Tagus revenue to be between $90 million to $92 million. Tagus revenue is being impacted by the timing of Resolution customers, as we do not fully recognize Tagus revenue until our prior services are completely shut down. We're not losing the customer revenue. It's just being recognized as revenue in other MSS. We're raising full-year adjusted EBITDA guidance to $9 to $11 million. Looking to FY23, we will provide guidance on our fourth quarter call, but want to give some color on what to expect. We are transforming SecureWorks as a company. Tejas and our strategic services are seeing significant growth offset by the intentional decline in revenue as we move away from non-strategic businesses. Over the last 12 months, subscription revenue declined by $12.6 million, yet non-GAAP subscription gross profits were up $5 million for a 320 basis points improvement in subscription gross margins. The improvement in subscription gross margins provides the evidence that our business shift is structurally improving for the better. Looking to FY23, we expect these trends to continue as we push to finalize our transition. Non-strategic services will continue to be a headwind, resulting in total ARR likely continuing to decline, with a bottom no sooner than the back half of next year. On the expense side, gross margins should continue expanding as our mix improves. Further, with growing industry recognition and a long list of customer referrals, we're going to increase investments in our brand awareness to drive growth. While sales and marketing has been flat through the end of Q3, we expect investments in Tejas to continue increasing, leading overall sales and marketing investments higher through next year. R&D will also increase through next year as we continue to invest in our products and the outcomes they drive for our customers. In summary, we had a solid quarter with evidence of our successful model transition continuing, and we look forward to our future. Wendy will now join us again as we begin our Q&A. Operator, can you please introduce the first question?
spk00: I will now open the call for questions. If you have a question, press star then one on your telephone keypad. At a courtesy to others, please ask no more than two questions. We'll take our first question from Hamza Farawala with Warner Stanley. Your line is open.
spk06: Hi, guys. Thank you for the time. This is Ben Nidon for Hamza. Maybe to start off, my first question for Wendy. Can you please provide some more context on your partnership strategy for Tagus and any contributions you expect from the partnership pipeline?
spk08: Sure, good morning, and thanks for the question. So we, in our history, have always had deep partnerships with products in the industry simply because we want to be able to work holistically across our security, our customer security environment, right, and not force them into the risk of ripping and replacing, but to provide this kind of holistic visibility, detection, and response capabilities that let them stay completely secure So as those customers continue to evolve their environment to serve their business needs, we want to make sure that we're in a position to continue to secure them without a blip at all. And so we'll continue to work with the leading products in the marketplace in order to ensure that for our customers.
spk06: Awesome. And then a follow-up for Paul, perhaps. On pages, can you please provide a break out of net new logos versus conversion of the existing base?
spk01: So we've talked in the past about kind of a balanced, and so that balance is continuing between new logos and re-solutioning out of our base, and so that continued in Q3. Great. Thank you so much.
spk00: Thank you. Our next question comes from Sterling Audie with JP Morgan. Your line is open.
spk04: Yeah, thanks. Hi, guys. I wonder if you could give us a little color on what the competitive landscape for Tejas looked like in the quarter on some of those new logos. So when you did find that you went through an RFP process or were in kind of a short list comparison, what is the other solutions that you're seeing most often?
spk08: Sure. Good morning. The solution we see when there's actually an RFP, it is quite often to replace a legacy SIM. I think that's just kind of a life cycle, and customers are seeing the cost of maintaining that or looking for a new solution. And so those are really where we have the opportunity to come in and show them there's really a better solution around detection and automated response with XDR than that both saves them the cost of, you know, setting up, supporting, and maintaining those with their own team, as opposed to having us do all of the detection build, the advanced analytics, enriching data with context, mapping all of that to the MITRE TAC framework, and then enabling them with faster time to response. So, the economics of that is pretty compelling in those situations. But when we see an actual RFP, that's what we've seen the most for.
spk04: Gotcha. And can you help us understand, how are you managing headcount through the transition? Meaning, are you able to reappropriate people as certain, you know, parts of the business are phasing down? Can you reappropriate them into product-related roles, or is there actual turnover that you have to manage through?
spk08: Sure, it's a great question, and we have absolutely made an intentional effort around leveraging the expertise of our team to continue to support our customers before they transition and then transition our teammates to support TAGIS as our customers move as well. Now, in total, you'll see our headcount is declining, and that's just the nature of the shift towards partners who provide services as well as the ability to provide scaled services on top of TAGIS, and that largely you'll see continue.
spk07: Thank you.
spk00: Thank you. Our next question comes from Sakit Kalia with Barclays Capital. Your line is open.
spk02: Okay, great. Hey, good morning, guys. Thanks for taking my questions here. Good morning, Sakit. Hey, good morning. Paul, maybe we'll start with you. Can you just recap some of the mechanics there with SaaS revenue? You know, it feels like there's so much momentum there, but narrowing to the lower end of the range, it sounded like there was a mechanical issue. Can you just flush that out a little bit just to better understand it?
spk01: Yeah, I'm glad you're seeing the momentum because we're excited about the momentum with Tejas. And so as we're continuing this journey of the transformation, We can have quarters where we'll be a little bit stronger, and the contagious growth is strong, and it's just reflective of our continued momentum and our transformation. And overall, you'll see some decline, as I've mentioned in my comments as we look out into the future, but that's as we restructure, and the proof points in that is the gross margin improvement. So we see this all consistent with our plan.
spk02: Got it. Well, so that's very helpful, Paul. Maybe on the SaaS revenue, though, specifically, I think, you know, that was going, I think the prior guide was 90 to 100 million. That's getting narrowed to 90 to 92 million. You brought up something around timing with, you know, with customer migrating. Can you just dig into sort of how that works?
spk01: Yeah. So as a customer agrees to resolution, there are some things internally that they work through. And the timing of that may have some impact on how quickly they move over. And so we'll have some ebbs and flows of that. But the overall revenue remains with our company as they convert over to Tejas.
spk02: Okay, got it. All right, got it. That's helpful. Wendy, for you, maybe for the follow-up, maybe just off the last question on SIM, maybe the question is, what do you find are the pain points that Tejas solves versus a traditional SIM? I mean, you gave an example. It sounds like cost is one of them. What about from a tech perspective or a security perspective? Can you just dig into sort of why Tagus wins versus a traditional SIEM?
spk08: Sure. It really has to do with at the outset from the plug-and-play ability to integrate with their data sources, our ability to leverage our cloud-based architecture to to do the analytics that their team does not have to build and maintain. Now we absolutely provide the ability for customers to customize alerts or suppression rules or that kind of thing specific to their environment or to help them with that. But to do that on their behalf rather than them having to staff and maintain a team to maintain the things that a security expert like us can do on their behalf really saves them time and effort, lets their team focus on things specific to their organization, and really the efficacy and the time to that efficacy is much faster as we deploy across the entire customer base.
spk02: Got it. Very helpful.
spk08: The ability to automate the response as well. Sure. Absolutely.
spk00: Thank you. Our next question comes from Brian Essek with Goldman Sachs, your line is open.
spk05: Great. Good morning, and thank you for taking the question. Wendy, I just wanted to ask, you know, if you could provide a little bit more detail about the machine learning endpoint prevention product that you're introducing. Was that organically developed? Is it a partner? And what are the dynamics of that solution? What does it tend to look like relative to some of the emerging, you know, other options out there?
spk08: Sure, absolutely. So that is a combination of partnership and integration with our technology. And we've frankly been hearing from customers that they've been unhappy with our existing prevention solution, and they wanted to be able to just have that as a one-stop shop as they work with us. The difference that we bring with the machine learning approach there is that we can automatically disrupt endpoint threats. So the additional value for us in combining it is to enhance the investigations in the TAGIS XDR piece with that prevention context as well. If you think about the ideal application of machine learning here, there is a tremendous amount of labeled data. So taking this approach versus a rules-based approach to prevention, which is much easier to evade, we find is much more effective for customers.
spk05: Okay, but at this point you're not indicating who the partner would be so we can get an idea of the platform and the technology?
spk08: No, we're not.
spk05: Okay, fair enough. And then maybe just to follow up, with the customers that have not agreed to Resolution, what is, What is the nature of those customers? I guess what's the primary reason why they're not resolutioning yet? And how do you intend to manage that install base with kind of end-of-life looming?
spk08: Sure. So if you step back and look at that total subscription error, the largest impact to that in terms of a headwind really is primarily the non-strategic revenue that we don't want to continue in. And so that is the majority of the impact, as opposed to customers who are in our target for re-solutioning, if you will. Those customers largely are transitioning to TAGIS. When you look at the mix of the subscription customer count coming down, what you see is that the average revenue on those customers who are not moving are very small, kind of sub-20,000 per. So the shift to a holistic security solution on pages with the full coverage just may not be the kind of compliance checkbox play that they're looking for.
spk05: Got it. Got it. Very helpful. Thank you. I'll jump back in the queue.
spk00: Thank you. And once again, if you would like to ask a question, press the star, then the one key on your touchtone telephones. And our next question comes from Mike Sikos with Needham. Your line is open.
spk07: Hey, guys. Thanks for taking the questions here. First one on the non-strategic revenue. I know we're all on our side trying to juggle our models and figure out this contagious transition, but at the same time, you guys are walking away from this non-strategic revenue. With most of fiscal 22 now behind us, can you give us a better sense of what that headwind is has been, and I guess ballpark. Is most of that behind us at this point, or are we expecting a bigger headwind as we look at the fiscal 23 with some of the preliminary commentary you guys provided?
spk08: Sure. So, as we do disclose the kind of total subscription ARR and then the TAGIS portion of that ARR, what you can see is we're moving towards a shift where the inflection point comes of Tejas becoming the majority of that mix. We see that happening next year. And as we move through that majority mix shift to Tejas, the headwind on that will be coming behind us. But we definitely do see that continuing next year as we continue to execute the transition, but expect the bulk of that, with a couple of exceptions in certain markets, to be to be in the second half of next year. And I'll just reinforce what Paul talked about, is that as we deliberately move on from some of these businesses to see the revenue decline but the gross profit dollars actually increase, we are creating value here by shifting the mix of the business to the right things going forward, but realize the total revenue headwind can be hard to click underneath.
spk07: Understood on the improving gross margin dynamics and profitability with the subscription and TAGIS, but no quantifiable measurements as far as that non-strategic headwind that we're facing?
spk08: We are not quantifying that for reasons of we're going to fight for every dollar of that to keep competitors from coming after that over the course of next year.
spk07: Okay. And another question, if I could, just coming back to the, I guess, commentary on the TAGIS revenue, those customers who are resolutioning, and it sounds like this ties to the customer timelines, right? And they're coming off services before they go on to TAGIS XDR. And I guess, can you help us better understand what are some of the reasons or challenges that that a customer has, or why wouldn't they be making a quicker transition?
spk04: All right.
spk01: So we had a little problem with the phone here. I apologize. So customers agree to re-solution, and so we begin the timeline with them, which is a quick process for many. For some, there's some slowness there. The revenue stays the revenue of our company as they re-solution. So the estimates that we gave early on had additional revenue that is still remaining in CTP that will then come over to TAGIS as they fully re-solution.
spk08: So just to give a little color as they... as they potentially have that one last data source that they want to customize into the platform. If there's anything remaining on the previous platform, it remains in that other MSS category until they are completely off of the CTP platform. We're not splitting.
spk07: Understood. Got it. Thank you.
spk00: Thank you, and our last question comes from Saket Kalia with Barclays. Your line is open.
spk02: Hey, guys.
spk03: Sorry, me again.
spk02: Just wanted to hop in and just ask a follow-up to you, Paul. You know, I think the end of life, right, or sort of the comments that you made just around CTP and how that will, you know, support there will discontinue sort of in a phased fashion, right? Can you just recap that for us a little bit? And maybe, I know you can't talk about the numbers necessarily, but how did the shape of that look like over the next two or three years? I mean, is there a point that MSS or the non-TAGIS, non-SRC revenue approaches really a point of immateriality? Sorry, there was a lot there. Does that make sense?
spk01: Well, if you go back to our long-term model we covered during Investor Day, our overall, our subscription revenues will increase significantly over that horizon you just laid out. So the professional services will continue to grow, but they will be a smaller portion of the overall pie as we continue to grow a subscription. Right.
spk08: Well, we do see that just becoming the majority next year in the total subscription error. And so that's when, to your point, towards the end of next year, the the materiality of the other MSS, if you will, starts to be less of an impactful headwind.
spk02: Understood. Understood. Got it. That's very helpful. Thanks, guys.
spk00: Thank you. And there are no other questions in the queue. I'd like to turn the call back to Paul Parrish for closing remarks.
spk01: Okay. That wraps up the Q&A and today's call. A replay of this webcast will be available on our investor relations page at secureworks.com, along with our Q3 web deck with additional financial tables. Thanks again for joining us today. Have a good day.
spk00: This concludes today's conference call. Thank you for participating. You may now disconnect.
Disclaimer