SecureWorks Corp.

Good morning, everyone. My name is Bruno, and I will be your conference operator of today. At this time, I would like to welcome everyone to the SecureWorks fourth quarter and full year fiscal 2023 financial results. All lines have been placed on mute to prevent any background noise. A supplemental slide presentation to accompany the prepared remarks can be found on the company's website. After the speaker's remarks, there will be a question and answer session. If you'd like to ask a question during this time, please press star followed by one on your telephone keypad. If you'd like to withdraw your question, please press star followed by two. At this time, I would like to turn the call over to Kevin Toomey, SecureWorks Vice President of Investor Relations. Mr. Toomey, you may begin your conference.

Thanks, everyone, for joining us. With me this morning are Wendy Thomas, our CEO, and Paul Parrish, our CFO. During this call, unless otherwise indicated, we will reference non-GAAP financial measures. You will find the reconciliations between these GAAP and non-GAAP measures in the press release and presentation posted on our website earlier today. Please also note that all growth percentages refer to year-over-year changes, unless otherwise specified. Finally, I'd like to remind you that all statements made during this call that relate to future results and events are forward-looking statements based on current expectations. Actual results and events could differ materially from those projected due to a number of risks and uncertainties, which are discussed in our press release, web deck, and SEC filings. We assume no obligation to update our forward-looking statements. Now, I'll turn the call over to SecureWorks CEO, Wendy Thomas.

Thank you, Kevin, and welcome, everyone. SecureWorks continues to deliver strong growth from our TAGIS XDR solutions. TAGIS revenue grew 120% year-over-year during fiscal 2023, with full-year revenue reaching $188 million. 2,000 TAGIS customers are now seeing the benefits of our XDR-based approach to manage detection and response, up 400 from third quarter. TAGES annual recurring revenue grew 58% year over year to $261 million. As an important indication of the acceleration of our business transformation, TAGES ARR now represents over 80% of our total ARR, up from 42% of the total at the end of the previous year. And we expect the mix of other MSS ARR to be minimal by year end, approximately 5% of the total, primarily in Japan. Reflecting on our business transition, when we began building Tagus, the XDR market didn't exist. We were building a technology platform to enable solutions that solved pressing customer needs, better security for their spend with fewer vendors to manage, and a step function reduction in the SecOps burden on their teams from false alerts and a lack of automated containment. As the possibilities of XDR become clear to the market, our vision remains to be the XDR platform that is fundamentally open, one that evolves seamlessly with customers' technology changes, and one that provides superior detection and unmatched response to prevent damaging security breaches, all in an industry-leading return on investment. And Tagus's unique approach to drive superior security outcomes is resonating with the market. Since launching Tagus in 2020, We've delivered a three-year compound annual growth rate of 156% in TAGIS ARR. Let me dive in a bit more on what makes TAGIS distinct in addressing customer security challenges across four categories. The first pillar that differentiates TAGIS from other solutions is its superior detection capabilities. Detection is more than finding everything that poses a threat. It's about finding and prioritizing the most potentially impactful threats We refer to this as finding the signal despite the alert noise. Over the last year, Cages filtered 99% of the high and critical alerts generated from third-party point security products as false positives. And while Cages is a powerful filter of noisy point solutions, with a full coverage approach to XDR, Cages regularly finds malicious activity that other point products miss. Cages' telemetry normalization techniques and proprietary algorithms detect threat actor behavior based on our proprietary knowledge of their tactics and techniques. In fact, this past quarter, we shared details of our approach through the CTU Threat Graph, our proprietary data warehouse with detection algorithms powered by more than 40 billion unique threat and knowledge nodes continuously updated by our in-house team of threat researchers. Much of the industry threat intelligence is published in a way that is difficult for most organizations to apply to their protection. With machine readable threat intelligence, updating our TAGIS detectors every hour, TAGIS powers superior detection with unmatched speed. To share a real world example of how this resonates, a global manufacturing customer with a small in-house security team recently licensed TAGIS. With their previous security services provider, They had no visibility into the effectiveness, and they knew that their vulnerability management had not been keeping pace. They were concerned about their risk of a breach. After deploying TAGIS, the platform quickly detected suspicious remote access activity to a specific device. This immediate detection, coupled with proactive monthly threat hunts included in the TAGIS subscription, quickly demonstrated the value of our integrated approach, the detection of malicious activity that other solutions missed, and customer confidence in their ongoing security with Tagis. Second, we continue to hear from customers that Tagis provides an unmatched level of response. The majority of security response actions across cloud, identity, network, and endpoint infrastructure occur automatically through the native SOAR capabilities in the Tagis platform. These capabilities are augmented and curated by our team of SecOps experts on behalf of partners and customers and are informed by the thousands of incident investigations and responses performed via the TAGIS platform each year. As an example, customers benefit from automated workflows that can simultaneously disable user logins in AWS while isolating relevant endpoint hosts when a critical risk is detected. SecureWorks has been using machine learning to maximize the performance of our detectors for several years. We found that over time, the quantity and quality of data drives machine learning model performance. The good news is we have more than we need, with 650 billion real-world events per day and thousands of incident responses each year. The proven combination of Tagus's holistic detection and automated response capabilities led to a deal recently won with an international healthcare company that was frustrated with their existing SIM solution. With the burden of maintaining integrations for security monitoring and a lack of automated investigations, their small team was stretched beyond capacity. Cages enabled them to focus on real cyber threats without adding to their security team while addressing their log management needs for less total spend. The added capability of the platform to help them proactively and continuously understand and optimize their security posture in comparison to industry peers was a key selling point to their executive team. Three, Tagus is open without compromise. We designed Tagus to address the reality and complexity of customer technology environments. Many customers come to us with endpoint technologies from multiple vendors, deployed simultaneously across their organizations. Additionally, we see teams who manage across hybrid and multi-cloud environments, Unlike other XDR or EDR platforms, we designed cages to excel in detections across these mixed environments with the proven ability to automate sophisticated response actions, all from a single pane of glass. This means better, faster protection with scaled use of security resources. And we continue to make investments to protect even more customer attack surfaces. For example, we recently announced enhanced integrations with Google Cloud Platform and Google Workspace. Extended support for Google environments enhances alert visibility and traceability, delivering a simplified workflow for SOC analysts. I'll share a story from a recently signed deal with a financial services firm who had found gaps in their endpoint-centric solution during a security assessment and also had a small in-house IT team that was overburdened with alerts. Cages not only provided better protection for their entire technology estate, including endpoint, network, and cloud, but also answered their need for retention and centralization of log data. With the ease of deployment and the valuable MDR partner that SecureWorks brought to the table, they were quickly able to optimize their spend, provide relief to their team, while delivering better security outcomes to their business. Finally, customers choose Tagis for the measurable and superior return on investment. To help customers demonstrate the value of security investments to their leadership team, SecureWorks launched a new security posture dashboard in Tagis. The dashboard is dynamic, enabling customers to regularly monitor, maintain, and improve their readiness in the face of ongoing security alerts, and do so in real-time comparison to others in their industry. Let me share a customer story we recently signed with a global provider of insurance and reinsurance solutions. This customer needed to defend itself and its clients data by proactively anticipating cyber security threats protecting their brand from reputation damaging breaches. But they were also excited about the opportunity to drive new revenue opportunities by developing safe and secure cloud applications offered as a service to their existing customers. They shared with us that Tagus enabled them direct savings of at least $750,000 per year and potential cost avoidance of up to $100 million from a breach, and that their productivity was enhanced by approximately $375,000 a year due to an increase in their team's productivity. And as a provider of cybersecurity insurance, the customer is looking ahead to the benefit of increasing revenue and reduced cyber breaches. from Tagus-based offerings they will license to their customers. As we look at the security challenges that organizations face, we see that technology alone cannot solve all of the challenges. Many organizations struggle with a shortage of security talent and the diversity of skills needed to effectively manage security programs. Our product, Tagus XDR, was created to address these challenges. Tagus has embedded orchestration, and a collaborative interface and workflow designed to enable transparency and collaboration across customer teams, our partners, and our security experts. This allows everyone to work together in real time and see the same information, making the security program more effective no matter how it is delivered. Our unique open approach allows us to bring customers XDR-based MDR across multiple go-to-market paths. First, We partner with solution providers to sell Tagus with SecureWorks provided MDR. Second, managed services providers sell and deliver Tagus powered MDR to their end customers under their brands. We now have multiple MSSP partners who are building their business on Tagus because we have demonstrated a compelling return on investment. This is a growing opportunity for our business and a focus of our long-term strategy. Third, Enterprise customers who have their own SOC capabilities or who intend to grow their teams over time to a full-time SOC use Tagus to filter the signal from the noise, automate investigations and response capabilities, hunt, and manage incident workflows. These customers know that Tagus lets them automate the mundane and focus on adding value as security experts. In summary, Our strategy is for our XDR platform to power industry leading MDR capabilities, allowing us to grow our customer base and be the platform of choice as the XDR market matures. Let me change gears and talk about our path to profitability as we near the end of our business model shift. For the past few years, we have effectively been managing two distinct businesses. making investments in a growing higher margin SaaS subscription business while winding down our other MSS and outsourcing services lines of business. With the acceleration last year in our transformation, we have also been actively managing down our cost structure as we sunset those lines of business. With the end of life in other MSS services outside of Japan effective February 3rd of this year, we announced a workforce reduction of approximately 9%, a key step in aligning our expense base to our go-forward business. With the continued growth and scale that our TAGIS platform brings and our ability to reduce the remaining duplicative cost structures over the course of this fiscal year, we expect to exit fourth quarter of fiscal 24 near breakeven EBITDA, setting us up for growing profitability in our go-forward business in fiscal 25. I want to thank our customers and partners for joining forces with us, and I thank our teammates for their hard work and commitment to the SecureWorks mission of securing human progress. In addition, I'd like to thank Paul, our CFO, who last month announced his intent to retire from SecureWorks. Paul joined SecureWorks shortly after we launched Aegis, bringing highly relevant experience in the SaaS space, leading similar business transformation, He's led our finance and accounting team with absolute integrity in our financial reporting and business operations, with a lasting impact on our transformation team that we can all be proud of. We have an active search underway and expect to announce an appointment prior to Paul's retirement to ensure a smooth transition. Paul has been a valued partner, and I'm grateful for his leadership. And with that, I'll turn the call over to Paul Parrish, our CFO, to discuss our fourth quarter results. and outlook for the first quarter and fiscal year 2024.

Thanks, Wendy. After nearly 41 years in industry, I made the decision to retire, and I'm looking forward to the next chapter in my life. It's been an honor to have served as CFO of SecureWorks during such a pivotal time in the security industry, and I thank all of my teammates and peers at SecureWorks for this opportunity. Tejas showed continued strong growth in the quarter, TAGE's subscription revenue was $60.2 million for the fourth quarter, up 106% year-over-year. For the full fiscal year 2023, TAGE's revenue was $188 million, growing 120% year-over-year. ARR increased $97 million year-over-year to end Q4 at $261 million, representing year-over-year growth of 58%. Tagus ARR was driven partly by stronger resolutioning, upsell, and cross-sell. We added 800 customers since Q4 of last year to end the year at 2,000 total Tagus customers. An average revenue per Tagus customer was approximately $132,000, a meaningful premium to the overall industry average. It is important to note also that ARPC is similar for new Tagus customer additions and re-solutioned customers. An important milestone we set out this year to achieve ARR from the Tagus platform contributing more than 75% of total subscription ARR. We're happy to report that we ended the fourth quarter at 82% of ARR from our Tagus platform, up from 42% at the beginning of FY23. Approximately 5% will remain by the end of FY24, enabling us to address our duplicative cost structure over the course of the year. Total revenue was $115 million in Q4, which was above the high end of our guidance of $110 million to $112 million, driven by outperformance in both subscription and professional services revenues. In Q4, our total gross profits decreased due to the revenue declines associated with the end of life for our non-strategic services. We were able to keep gross margins relatively flat by continuing to scale TAGIS as the other MSS business descales into sunset. Subscription gross margins, including both TAGIS and other MSS, were 69.4 percent, better than Q3 subscription gross margins of 68.3 percent with the mixed shift to TAGIS. Q4 professional services adjusted gross margins of 42.8% were down slightly from Q4 in prior year. As we continue to focus our professional service offerings on TAGES adjacent services, our professional services revenue now represents only 21% of our total revenue in line with our revenue mix objectives. Sales and marketing expense in Q4 was similar to the prior year quarter. The increase to 35 percent of revenue from 29.9 percent in Q4 of FY22 is due to the change in total revenue associated with the end of life for our non-strategic services. Our investments in sales and marketing have increased our recognition as a leading XDR platform and MDR provider and supported our transition to a partner-first model. R&D expense was 29.8 percent of revenue up from 22.6% in the fourth quarter of last year. Our changes to investments reflect the launch of integrations, capabilities, and features aligned directly to feedback from our partners and customers. Total G&A expense as compared to the prior year Q4 reflects the impact of the benefit realized in Q4 FY22 from the timing of expense accruals during FY22. G&A was 17% of revenue, up from 12.3% in Q4 last year, which also reflects the decline in revenue affecting the percentage. Adjusted EBITDA loss was $19.7 million compared to a $2.1 million gain in prior year Q4. The overall change was driven by a combination of lower gross profits of $8 million and the remainders related to operating expense items I've just discussed. In Q4 of FY23, adjusted EBITDA excludes $15.5 million of one-time reorganization costs consisting primarily of severance and other termination benefits and real estate reduction-related expenses. Cash flow provided by operations in Q4 FY23 was $6 million compared with $19 million provided by operations in prior Q4, which primarily reflects the impact of lower adjusted EBITDA. CapEx was $1 million for the quarter, relatively flat with the prior year. We finished the quarter with a strong balance sheet, $143.5 million of cash, no debt, and an untapped credit facility. Turning to our guidance for FY24. We expect Tejas ARR to end FY24 at $300 million or higher. We expect other MSS ARR to represent approximately 5% of total ARR at the end of FY24. We expect full-year total revenue to be $380 million to $400 million, with the first quarter revenue of $96 million to $98 million. Keep in mind, we have a 53-week year in FY23 compared to 52 weeks in FY24. We expect full-year TAGIS revenue to be $270 million to $280 million. TAGIS description gross margins are expected to increase in FY24 and beyond. The benefit of that within total gross margin will be offset by the duplicative, fixed, and transition cost as we sunset support for our other MSS services. Full-year adjusted EBITDA range is expected to be between negative $29 million to $39 million. This guidance reflects the following expectations. Sales and marketing as a percent of revenue is expected to decline modestly in FY24. Our investment in R&D will remain flat as a percentage of the lower revenue base as we continue to lower our engineering support costs for our other MSS business. G&A spend will decline and expected to remain flat as a percentage of revenue year over year. Operating expenses in FY24 should decrease on an absolute basis as we manage the cost in proportion to the revenue opportunity. We estimate there is approximately $25 million of duplicative, fixed, and transition-related costs that we are incurring, with $15 million in cost of revenues and $10 million in OpEx. As we turn down our other MSS services, we will manage the related costs out positively impacting FY24 and FY25. As we accelerate the sunset of other MSS and benefit from scale in our TAGIS-centric go-forward business, we expect to be near break-even EBITDA in the fourth quarter of FY24. As we exit this year, our business will have the transition behind us with a path to EBITDA profitability in the following fiscal year. Finally, EPS loss is expected to be in the $0.26 to $0.35 range. In summary, FY23 was a year of significant milestones in the company expansion of its Tagus XDR platform, and FY24 is the year that we will begin to reflect shift in our business mix and growth potential from our go-forward business. Wendy will now join us again as we begin Q&A. Operator, can you please introduce the first question?

At this time, I would like to remind everyone that in order to ask a question, you have to press star followed by one on your telephone keypad. We will pause for just a moment to compile the Q&A roster.

Our first question comes from Sakit Kalia from Barclays.

Sakit, your line is now open. Please go ahead.

Okay, great. Hey, it's Sackett from Barclays. Morning. Thanks for taking my questions here. And Paul, congrats on your next chapter. Thank you.

Good morning, Sackett.

Sure. Hey, morning, Wendy. Maybe I'll start with you. You had an example or two of SIM displacements in your prepared remarks. Maybe the question for you, Wendy, is how do you think about the velocity of SIM displacements in the industry right now? And related to that, do you feel like that Tagus is getting enough reference customers here where the sales cycles are maybe getting a little shorter or at the very least more predictable?

Yeah, it's a great question. I think we're just at the beginning edge of this opportunity of transition and displacement. I think there's two questions that we've seen with customers as they're going into this. The first one was, well, you know, is XDR a better solution? What is this? How does it work? And I can talk a little bit about that. And the second one is, how do I transition smoothly with no risk, no gaps, no bad experience for the end user? And so on the solution front, obviously, as the XDR market is getting much more recognition, attraction, sort of third-party validation, the elements of Better economics, better security effectiveness, and better efficiency of SecOps teams is proven true. Log retention included in the base price of XDR without any surprise. Data overages, those types of things, really hits the economics and predictability. The tune detections and the filtering of noise of TAGIS in particular speaks to the effectiveness. And then the embedded orchestration, investigation, hunting, response, And the workflows really drive the SecOps efficiency. So I think that part is becoming pretty clear. The second part is where we have a unique advantage. And that's because we have been re-solutioning customers to Tagus for the last couple of years. And the playbooks, the customer referenceability, the eye towards either the end user experience, or in the case of MSSPs, their customer experience, And we can demonstrate the ways that we make that an incredibly smooth and risk-free and good experience transition has played well not just with SIEM customers, but particularly with MSSPs who want to make that transition. And that's where we're uniquely positioned in terms of those referenceable customers and, frankly, tactics that the customers can get comfortable with.

Got it. Got it. That makes a lot of sense.

Paul, maybe for you, I think you touched on this a little bit at the end of your prepared comments, but just to maybe ask the question slightly differently, can we just talk about how big MSS revenue is expected to be in fiscal 24? Now, we said it's going to be about 5% of ARR, but just remind us how big MSS revenue should be here in fiscal 24. I think it's primarily going to be Japan. And maybe as part of that, I think you talked about sort of, I think a gross margin sort of trajectory, right? But if you just look at the gross margins on Tejas versus other MS, or actually, if you just look at the gross margins on Tejas, if MSS were to go to sort of zero right over time, what does that gross margin look like just in the Tejas business?

Yeah, thanks for the question. As I pointed out in the prepared remarks, Tejas revenue is going to be 270 to 280 for the year, and our overall revenue is 380 to 400. So think of Tejas being about 70% of our overall revenue. and our professional services are running somewhere close to 20%, plus or minus a couple of percentage points. And so that leaves the other MSS in that 10% range, plus or minus a couple of percent during the year, and see that ramping down that revenue during the year as non-strategic services and other MSS rolls off. And gross margins in there, Tagus is running higher than other MSS, but we have the drag on our other MSS of our duplicative services as well as just the descaling of our other MSS as it rolls toward the tail end of this. So you're going to see the true impact of our TAGIS revenues as we excel out into FY the following year, FY25. So we're not providing specifically that individual guidance around gross margins between TAGIS and other MSS, but see the benefit as we roll into FY25 of having TAGIS margins.

Very helpful. Thanks, guys.

We have our next question from Mike Sikos from Needham. Mike, your line is now open. Please go ahead. Great.

Thanks, guys. And I had a question really first on housekeeping, but can you give us what the MSS customer count and the total subscription customer count was exiting fiscal 23? Yeah.

So total customer count is 4,500. TAGIS customer count is 2,000.

Other MSS is 700, so subscription customer is 2,500. Got it. Thank you.

Thank you for that. One of the things that I'm trying to back into here, I guess if I look at the 96 million that TAGIS just generated in net new ARR over the course of fiscal 23, is there a way for us to think about how much of that net new ARR was from migrating existing customers versus landing and addressing new customers that previously weren't on the SecureWorks platform?

Yeah. So it's somewhere in that 40-ish percentile was the new logo cross-sell type activity. The re-solutioning side of that 60-ish percentage points, a little bit less than that, was re-solutioning as we exited Q4. And we talked about that earlier quarters that, uh, That mix was slightly off that 50-50 that we were projecting for the year, but slightly high on resolution Q4, but very similar to Q3. And as we project out into FY24, we're seeing 85% of our growth coming from our new logo cross-sell, organic growth. And so we still have a small portion, mainly Japan, to resolution, and that's going to be what make up about 15% of that growth.

Got it.

I think you're probably answering my next question already, but I just want to stress test it here. So if I think about pages, say, or guidance in the out year expected to be at least 300 million, and we're seeing that, which implies that at the low end, $40 million in that new ARR over the course of fiscal 24. If I compare that 40 million in fiscal 24 to the 96 million in fiscal 23, the reason for that delta is really just because we've, we've done a good job resolutioning a large chunk of the customers. And really the focus now is going to be a bunch more on landing new logos with pages. Is that a fair characterization or is there anything else that I should be thinking through there?

No, you're right. We're focused on new customers and cross-selling our existing customers, selling more additional features, functionality to existing customers.

Got it. Got it. And then one more, if I could,

But on the revenue, I guess you guys have delivered this outperformance in Q4. If I go back a quarter, you guys had said you were expecting about a $1.5 million headwind from FX. Can you just remind us, did that $1.5 million essentially play out, or was there any movement there to think about when trying to diagnose the upside you delivered?

Yeah, FX actually swung a little bit our favor. It wasn't the big headwind we expected going into Q4, but it's continuing to blow the directions on FX. So we don't see it as a big tailwind coming into this year, but I'm not guessing what FX is doing.

Understood. Understood. Thank you. I'll turn it over to my colleagues. Appreciate the call today, Paul. Thanks.

Our next question comes from Madeline Brooks from Bank of America. Madeline, your line's now open. Please go ahead.

Hi, Wendy and Paul. Good morning. Thanks for taking my questions. Just two here for me. I guess at first with the restructuring and then thinking about how we try and reaccelerate growth once the transition is complete, do you feel comfortable that the staff that you have now, especially from a go-to-market perspective, will be able to deliver on growth once we do get past some of these economic headwinds. And my second question, too, is just a follow-up on the net new customers. Is there any chance that you're providing complete net new customers outside of cross-sell? Thank you.

Let me take the first one, and then I'll let you take the second one. So in terms of the restructuring think about and then I'll answer the sales kind of headcount. We have essentially two businesses that we are managing through. Obviously, the restructuring is related to the end of life date for our other MSS business outside of Japan, February 3rd. And so, obviously, the staffing and the cost structure related to that, we had a set of restructuring actions related to manage our cost structure down relative to the to the sunset of many of those lines of business. And we will continue to manage that process as we end this year with, as Paul said, less than 5% of the error are on the other MSS revenue line. When you then separate that out, there's other parts of the business, of course, where we are growing the organization, different set of skill sets. Sales is certainly one of those. One of the key things for us on the sales and marketing side is that we had a number of sales professionals who were focused on resolutioning, so not quite a third of our quota-carrying headcount, and we transitioned those at the end of the year, again, outside of a handful in Japan, to hunting to new territories where they also can benefit from cross-sell and up-sell opportunities as well, but their primary role is focused on new business from new customers. So we get sort of a lift, if you will, in terms of hunting new from that transition as they ramp their territories. But in total, that's remaining about the same as it was before the total sales quota carrying headcount.

And then for the split of new logo and cross-sell, we're thinking about half and half between the new logos and cross-sell. And that's how we got our site set for FY24. Great.

Thanks so much. We currently have no further questions.

I would like to hand back to Mr. Toomey for final remarks.

Great. Now that wraps the Q&A in today's call.

A replay of this webcast will be available on our investor relations page at secureworks.com, along with our Q4 supplemental deck with additional financial tables.

Thanks again for joining us today.

Ladies and gentlemen, this concludes today's call. You can now disconnect your lines. Thank you.