SecureWorks Corp.

Hello and welcome to today's SecureWorks second quarter fiscal 2023 earnings conference call. My name is Bailey and I'll be your moderator for today's call. All lines will be muted during the presentation portion of the call with an opportunity for questions and answers at the end. If you would like to ask a question, please press star followed by one on your telephone keypad. I would now like to pass the conference over to today's host, Paul Parrish, CFO. Please go ahead when you're ready.

Thanks everyone for joining us. With me this morning is Wendy Thomas, our CEO. During this call, unless otherwise indicated, we will reference non-GAAP financial measures. You will find the reconciliations between these GAAP and non-GAAP measures in the press release and presentation posted on our website earlier today. Please also note that all growth percentages refer to year-over-year changes unless otherwise specified. Finally, I'd like to remind you that all statements made during this call that relate to future results and events are forward-looking statements based on current expectations. Actual results and events could differ materially from those projected due to a number of risks and uncertainties, which are discussed in our press release, web deck, and SEC filings. We assume no obligation to update our forward-looking statements. Now, I'll turn it over to Wendy.

Thank you, Paul. And welcome everyone. Our transformation into a leading XDR solution provider with a strong recurring revenue model is accelerating. I'm pleased to report that we crossed the $200 million mark in Tejas ARR in the second quarter. Tejas ARR reached the $100 million milestone 10 quarters after launch. And now just four quarters later, we've doubled to $200 million. Tejas ARR and customer count numbers continue to put us among the fastest growth rates in the industry with triple digit growth in both areas, reflecting the addition of 800 customers since 2Q of last year to a total of 1500 Tejas customers. In terms of our business model transition, Tejas now represents 56% of our overall subscription ARR. and we remain on track for changes to be approximately 75% of ARR by the end of this fiscal year. So why is SecureWorks approach to XDR resonating in the market? Our changes platform is unique in four ways. One, superior detection, which means accuracy and speed with complete attack surface visibility and applicability. We ingest more than 486 billion events daily including events across more than 100 integrations, which we enrich with industry-leading threat intelligence and tens of thousands of expert curated signatures. Across our current customer implementations, 60% of the data we ingest through Tagus comes from sources other than Endpoints. This speaks loudly to the value and economy of Tagus XTR that combines data from Endpoints with data from cloud environments, email, network, identity systems, business applications, and more. We leverage 27 petabytes of diverse data with our machine learning models, combined with industry-leading threat intelligence, to produce best-in-class detection speed and efficacy. And we have a growing suite of proprietary advanced detectors, like our hands-on keyboard detector, that was trained on more than 3 trillion events. Using the power of machine learning, this detector recently identified a malicious post-exploit activity with an initial access vector never seen before. It's a perfect example of where we focus our machine learning research on the new techniques, tactics, and procedures where we do not yet have deployable threat intelligence or signatures, but that can be deployed with a high signal-to-noise ratio. For customers, this means we only alert when it matters. leading to a significant savings of valuable SecOps resources when leveraging Tagus. In short, Tagus lowers our customers' risk across their enterprise at a lower total cost of ownership, delivering the highest return on investment. Two, unmatched response. The second way our XDR platform is unique is the SOAR capabilities native to Tagus provide one, rapid and automated high security value response actions, things like host isolation or automated re-authentication prompts. And two, orchestrated workflows that quickly kick off customer remediation work streams, made easier with out-of-the-box integrations with providers like ServiceNow, Zendesk, PagerDuty, JIRA, and many others, maximizing efficiencies for our customers. It also means live access in under a minute to an expert SOC analyst via the live chat feature in our Tagus UI. We believe we lead the industry in speed and quality of response with the fastest time to detect, label, notify, and investigate among XDR providers. Three, we are open without compromise. Transparency and open interoperability have always been first-order principles for Tagus. Our platform was built from the ground up to integrate market-leading technologies and deliver incremental security value on day one. It's not about raw data aggregation. It's value delivered through actionable, security-relevant insights. And SecureWorks is committed to rapidly expanding integrations for Tagus with market-leading technologies so our customers get better more comprehensive detection with less time and effort to get to security value. For example, with the recent additions of Netscope and Skate Offense to our technology alliance partnership, we've expanded the reach of TAGE's OpenXDR to include additional solution areas being used by our customers, including SASE, CASB, and OT. We don't approach these partnerships as simple data exchange projects. Instead, we do so from our rich heritage and long experience running security operation centers, where data from each source must work in concert to provide incremental security value. And one last important point on our approach to being open without compromise. Cages customers use the same UI as our security experts, which enables seamless collaboration and rich context for security events, allowing us to work with customers of any scale, and security depth. And finally, CAGIS is priced for predictability and clear value for customers. CAGIS is priced on a per endpoint basis with no hidden data overage charges, providing customers with predictability of spend. And for an easily comparable per endpoint price, we provide more, covering a customer's entire security estate, including endpoint, with an industry-leading one year of data retention as our standard offering. That's far beyond the typical 30 days that other XDR and EDR solutions include natively, largely because their data architecture was not designed to scale to big data in addition to fast data. How can we do this at scalable margins? Our data architecture. The security operations use cases we've experienced over decades have informed the unique data architecture that gives TAGIS a powerful competitive advantage in terms of speed, scale, and security value. Evidence of this unique approach to data includes superior data labeling and normalization to feed higher fidelity detections and filter out noisy alerts. We optimize our approach to streaming or real-time versus batch processing in support of detection analytics and machine learning use cases. This allows us to develop new detectors quickly to prove out their security value while providing industry leading time to detection for our most sophisticated analytics. We also optimize our use of search, designed for speed when warranted and for cost efficiency for longer term storage and retrieval. Innovations like these, drawn directly from our security expertise, enable us to price our solution on a predictable per endpoint basis. while still supporting a full spectrum of other cloud, network, and business system telemetry with more favorable data retention options and scalable margins, a distinct market advantage. In addition to more customers seeking XDR, we are seeing customers displace their SIMs for XDR. While the SIM market is worth close to $5 billion, we increasingly hear from prospective customers that their SIMs are essentially noise engines, they're ineffective, A recent new customer win selected SecureWorks over their SIEM for the following key reasons. First, predictable endpoint pricing versus their SIEM's data volume-driven pricing, which disincented them from securing their entire environment. Cages' standard 12-month data retention was key to this customer's threat-hunting objectives, and they gained value from the incident response built into the Cages offering, rather than requiring incremental investments and challenge. And while the endpoint detection and response market is $9 billion and growing, we've heard from prospective customers and we know from our XDR visibility that EDR alone misses much of the threat. We recently alerted one customer to an exploited Confluence server monitored by a third-party EDR product where the threat actor ended up downloading scripts and running crypto miners. Yet there were no native EDR alerts, but we detected the activity with Tejas XDR from the native EDR source telemetry. We also saw the same exploit on a different server from that customer's DNS logs where there was no agent installed, demonstrating the real power of XDR. When customers have XDR deployed across the enterprise, it's common for our threat intelligence to flag network traffic to command and control addresses and then be able to tie that back to the endpoint being exploited. While maintaining 100% visibility of the entire enterprise is always a challenge, With XDR, our customers are more likely to gain early visibility into a part of the kill chain to enable them to quickly take action. With the Cages platform, SecureWorks is delivering the most transparent, interoperable, and open XDR solution, with EDR natively included. The adversary will not get complacent, and neither will we. This past quarter, we've been joined by Mike Aiello as Chief Technology Officer of SecureWorks. With more than 20 years in security, Mike is shaping the next horizon for Tagus and bringing his customer and industry experience to our leadership team. Prior to SecureWorks, Mike was the Chief Product Officer for Human Security. And prior to that, served as the CEO of AppGate, the Product Management Director for Google Cloud Security, and as the Chief Information Security Officer for Goldman Sachs Consumer and Commercial Bank. We're bringing the best of everything to the table decades of security operations experience, an open and interoperable XDR platform with a unique data architecture, and the best security talent the industry has to offer. Today's markets are turbulent, driven, shaped, and reshaped by many forces, but we remain focused on keeping our customers secure, on defining the future of threat detection and analysis. and on driving superior long-term and sustainable growth and value creation for investors as we execute on our strategy and complete our transformation as an industry-leading XDR provider. I want to thank our customers and partners for joining forces with us and thank our teammates for their hard work and commitment to realizing SecureWorks' mission to secure human progress. With that, I'll turn the call over to Paul Parrish, our CFO.

Thanks, Wendy. Tagus continues to gain traction in the market. ARR increased $100 million year over year to end Q2 at $201 million, another triple digit growth rate over prior year Q2. We've added 800 customers since Q2 of last year, up 114% over the prior year to end the quarter at 1500 total Tagus customers. Tagus subscription revenue was $42.8 million for the quarter up 131% year-over-year. And average revenue per Tagus customer was approximately $136,000, up sequentially from $130,000 in Q1, and remaining a premium to our non-Tagus customer revenue, which averages $85,000 per customer. As we continue to resolution customers and grow new business on the platform, we ended the second quarter with 56% of total ARR on Tagus. We continue to see Tagus expanding to about three-quarters of total AR by the time we exit this fiscal year, as we continue transitioning from non-strategic services to our Tagus-led business model. On an overall basis, total revenue was $116 million in Q2, which was consistent with our expectations, despite an approximately $3 million FX headwind. We continue to scale our cost structure and benefit from our Tagus-led solution mix shift, Overall Q2 gross margins expanded from prior year Q2 to 61.3%. As we continue raising our voice and profile in the market with targeted investments in sales and marketing, sales and marketing costs have increased to 33.8% of revenue, up from 25.1% in Q2 of FY22 and 31.1% in Q1. We also continue working closely with our customers to innovate and deliver new features that align with their strategic priorities and our development roadmap, further differentiating Tejas in a fast-growing market. Accordingly, R&D has increased to 26.7% of revenue, up from 21.5% of revenue in the second quarter of last year, and 25.3% of revenue in Q1. G&A expenses were slightly down in dollars compared to Q2 of the prior year on lower employee-related expenses, professional service, and consulting-related costs. Adjusted EBITDA loss was $14.3 million compared to a $3.6 million gain in prior year Q2. The overall swing of $18 million was driven by a combination of reduced revenue and gross profit as we actively exited non-strategic lower margin services and continued investments focused on our long-term growth strategy. Cash flow used by operations in 2Q fiscal 2023 was $17 million, compared with $17 million provided by operations in prior year Q2. CapEx was $2 million for the quarter, relatively flat with the prior year. We finished the quarter with a strong balance sheet, $167 million of cash, no debt, and an untapped credit facility. Turning to our guidance for FY23. As both Wendy and I detailed earlier, we saw healthy growth in our TAGIS solutions, which are helping drive better outcomes for customers on their most urgent security challenges, and our business model transformation continues to accelerate. In midst of this progress, the strength of the dollar has resulted in FX headwinds, and we expect to see a lower level of professional services revenue than reflected in our previous guidance. Given these dynamics, We now expect full year revenue to be in the $458 million to $465 million range with FX impacting around 50% of the change in guidance and the remaining reduction primarily driven by lower professional services. TAGUS ARR guidance remains unchanged. We continue to expect TAGUS ARR to end FY23 at $265 million or higher. organic growth to contribute approximately $50 million of the incremental Tejas ARR. Sales should accelerate through the second half as we get the full benefit of our first half investments carrying through to FY24 and beyond. We're accelerating investments in global awareness and global distribution with the returns expected to be more meaningful in the back half of the year and into FY24. We have updated the other MSS ARR component to now end FY23 below $70 million. Of the approximately $70 million of ARR remaining at year-end, we continue to expect resolutioning to be largely complete in FY24 and enable us to eliminate duplicative costs to support CTP platform and services. Additionally, we have narrowed the following guidance ranges from our previous guidance. Full-year non-GAAP net loss to be in the $55 to $59 million range, with full year EPS laws in the 64 to 70 cents range. Full year adjusted EBITDA in the negative 63 to $68 million range, which includes our investments in sales and marketing and R&D, reflecting our continued management of spend to revenue and cashflow use and operations in the 60 and $65 million range. Regarding Q3, we expect revenue of $111 million to $113 million and an EPS loss in the 20 to 22 cents range. In closing, FY23 continues to be an inflection point in the company's transition as we shed non-strategic services and complete the re-solutioning of our base to Tejas with a significant majority of customers completing that transition by FY23 year-end. We are optimistic about our unique opportunity to capture XDR spend with our Tejas solutions while helping customers consolidate their security budgets to drive better efficiency of their spend. We're making consistent progress against our transformation with continued improvement in our business mix and growth potential. Wendy will now join us again as we begin Q&A. Operator, can you please introduce the first question?

Thank you.

The first question for today's call comes from the line of Mike Sikos from Needham. Please go ahead. Your line is now open.

Hi, guys. Thanks for getting me on. Thanks for all the color. I do appreciate it. I wanted to ask about the fiscal 23 revenue guidance reduction that we're seeing today. And just for clarity here, so you guys in Q2 came in line with your revenue guide despite the $3 million FX headwind. Can you remind us, I guess, what was management anticipating in Q2 from an FX perspective, just to see whether or not, how much of a headwind it was versus what you guys previously assumed?

Yeah. So currencies moved primarily Japan and British Pound a large part in Q2. So as we entered into that quarter, we were looking at, you know, similar FX rates to what we saw at year end in the first quarter. So we didn't have a lot of FX impact in Q2 as we gave guidance.

Okay. Okay. And as I think about, I'm looking at the full year revenue guide today. So I think at the midpoint, we're taking down full year revenues by about $21 million. And I just want to make sure I'm clear here. So we're saying that 50% of that cut is tied. Sorry, I don't want to keep going on top of you.

That's correct. 21 million cut and roughly 50% is the average.

50% from FX. And can you explain to me the remainder coming from lower professional services? I just wanted to make sure I understood what was the driver behind that lower demand for that PS.

So as we took a look at the growth in our strategic professional services for this year, we saw a trend up as we put together our guidance. We, of course, in our professional services have what we refer to as non-strategic that's coming down. And the growth pattern there is not developing at the rate that we saw in the guidance. And so that's why we're bringing down the professional services side of that.

Okay. Okay. And then just one more, if I could. I wanted to see, can we get in color on what the total customer base was for MSS or the company's total subscription customer base? I know that we cited the the 1,500 customers for TAGES today. We just wanted to see how quickly customers are migrating or what that MSS base is like as we stand at the end of this quarter.

So as you'll find when you get our queue, it'll be 1,900 other MSS customers, and combined we've got a total of 3,100 customers.

Terrific. Thank you very much. I'll turn it over to my colleagues. Appreciate it.

Thank you. The final question for today's call comes from the line of Hamza Fudewala from Morgan Stanley. Please go ahead. Your line is now open.

Great. Thank you for taking my question, and good morning, everyone. Wendy, maybe a couple of questions for you. A lot of really great detail on the XDR offering. It seems like you're really ingesting a lot of threat telemetry from a variety of different vectors. I'm just curious around just general market awareness around XDR. It does seem like there's a lot of marketing out there, yet a lot of the logs are still coming through these traditional SIMs. So what would you attribute that to? Do you think there's just a lot of FUD in the marketplace, if you will, and customers will start to understand this technology better as the education of this starts to increase? you know, is this something that will take time for customers to fully migrate their security analytics approaches towards XDR?

Yeah, it's a great question because if you look at really MDR and XDR, they're still fairly early in the proverbial hype cycle, if you will, so there's a combination of stage of length of time in market and therefore awareness is growing but nowhere close to what it is for more mature established markets like CIM or such. There's a couple of things that we look to to see the movement in customer awareness or prospect awareness of what XDR and MDR really mean. And one of those is that the content of RFPs actually naming XDR or MDR instead of SIM or MSSP or those types of things. So that's a good indicator for us that the awareness is growing. And the second is that we see the customers or prospects joining things like our webinars about how to actually make an easy transition from a SIM to XDR, being one of our most subscribed sets of content. So there's definitely now awareness that it is an opportunity and security. I think people are very much in the investigation mode. And when you show them what it means in terms of effectiveness of security, lower costs to implement, maintain, and manage, the case is getting pretty compelling. And so we are seeing now more customer shifts, you know, customer acquisition shifts from SIM In fact, displacing multiple SIMs in a lot of cases to Tejas. So it's on its journey.

Got it. Got it. And I was wondering if you could just speak around the demand environment. You know, obviously Tejas is doing quite well. I think Paul did mention maybe a little bit lower demand for some of the non-strategic services. We've heard from a number of security companies that, you know, there were, instances of longer sales cycles, particularly midway through Q2. So just curious what you're seeing and maybe what contributed to that lower demand for the non-strategic portion of the business.

Sure. I'll actually separate those two a bit. I mean, it is our goal to accelerate the transition of the business, to shorten that tail, if you will, and to move some of those non-strategic services to partners more. more quickly while resolutioning the core business to Tagus. So that is not necessarily a bad thing from our seat. In terms of sales cycles for Tagus generally, I think we've seen a similar impact from the market, which is you sort of look at the beginning of pipeline, healthy, good quality, the time cycle to what we call the technical win. we don't see really being impacted what we see is the is the timeline from technical win to commercial close that's where we do see a lengthening in the cycle and there's really two factors uh typically we see contributing to that one is additional layers if you will of either procurement or even c-suite review of deals or needing to sign off on things i think there's some some tighter controls around budgets generally And the second one is sometimes there's turnover in the prospect as the deal is coming to a close, and that can pause the process for a bit of a reeducation and a restart. So those are really the two things, turnover and extra scrutiny on the procurement side.

Got it. Very clear. Thank you.

Thank you. Thank you. We now have a follow-up question from Mike Sikos from Needham. Please go ahead.

Hey, guys. Thanks for getting me back on. I appreciate the fact that me and Hans are just playing a big punk here. But on the customer count, I did want to come back to it, and I just want to hear your sense on the philosophy or the strategy, right? So if I'm thinking about the total customer count for MSS today, we're still seeing those declines today. we're down to about 1,900 customers. Page's customers are ramping, but on an aggregate basis, your total subscription customers are still leaking lower. And I just wanted to see, can you provide us any color you have that offers conviction or confidence in the strategy as far as being able to attack a larger market opportunity or attract more customers to the SecureWorks platform longer term?

Sure. It's a good question. Let me talk a little bit about the average revenue per because the demographic of the customer base is part of the answer on the customer count. So if you look at the pages Tages platform, we are specifically targeting customers who are a minimum of 500 endpoints or more. That was not necessarily our approach with the MSSP business. And if you look at the number of customers that were turned from MSSP as opposed to transitioning to Tages, they've been averaging, and this is not just this quarter, but through the process, on less than $30,000 per. So there really aren't all ready to or have the capacity or willingness to spend the minimum amount for MDR, XDR coverage. So there is some shift in the customers that make sense for the Tagus platform. And you see that in the average across all of the MSSP customers in the mid-80s, as Paul talked about, and on Tagus being in the $130,000 range. So we're definitely targeting up market. up margin and customers who have the ability to expand with us in the future as well. So there is a mixed shift in terms of the size that you're seeing in the count and the average revenue.

Got it. Thank you for that. And last one on my side, but just coming back to the gross margins for this quarter, I know that we had a slight uptick when looking at it from a year-on-year basis. but it did leap lower from COLA at that 63% to 64% range we've been in over the last two to three quarters. And I just wanted to see, at least on a sequential basis, what caused that degradation and how should we be thinking about gross margins for the rest of the year?

Thank you. Yeah. So as we talked about the year, this is the transformation year, and so we'll have certain calls come in as we're – managing the cost in proportion to that revenue mix as we bring down the older CTP to the going pages going forward. So there'll be certain quarters impacted for some of those costs.

So this quarter gross margins were impacted some of those costs.

Actually, so really just a function of the revenue makeshift that's taking place as well as some of the pressures with the the cost versus the shrinking revenue base in aggregate. Yes.

Right. So as you see TAGE is continuing to expand, you start to get squeezed a bit as you come to the tail end of the TTP platform. And then that overhang, clearly we've talked before about the 30 million, well 15 in COGS, 15 in FX of sort of fixed costs on TTP that we're sort of duplicatively swallowing this year. And as we head into next year and get through the ARR transition, we will see that improvement in cost structure, both on the OPEX and the gross margin side as the CTP overhang comes out.

Terrific. Thank you. That makes a lot of sense, and I appreciate all the extra detail there. Thank you, guys.

Yeah, thanks for the question, Clint.

Thank you. There are no further questions registered at this time, so I'd like to pass the conference back over to Paul Parrish for closing remarks.

Okay. That wraps up the Q&A in today's call. A replay of this webcast will be available on our investor relations page at secureworks.com, along with our Q2 web deck with additional financial tables. Thanks again for joining us today. Have a good day.

Thank you.

This concludes today's conference call. Thank you all for your participation. You may now disconnect your lines.