U.S. Markets closed

Edited Transcript of RPD earnings conference call or presentation 7-Feb-19 9:30pm GMT

Q4 2018 Rapid7 Inc Earnings Call

Boston Feb 22, 2019 (Thomson StreetEvents) -- Edited Transcript of Rapid7 Inc earnings conference call or presentation Thursday, February 7, 2019 at 9:30:00pm GMT

TEXT version of Transcript

================================================================================

Corporate Participants

================================================================================

* Corey E. Thomas

Rapid7, Inc. - President, CEO & Director

* Jeffrey A. Kalowski

Rapid7, Inc. - CFO

* Neeraj Mahajan

Rapid7, Inc. - VP of IR

================================================================================

Conference Call Participants

================================================================================

* Daniel J.W. Park

Needham & Company, LLC, Research Division - Associate

* Elizabeth Wymond Verity

KeyBanc Capital Markets Inc., Research Division - Associate

* Gur Yehudah Talpaz

Stifel, Nicolaus & Company, Incorporated, Research Division - Analyst

* Jonathan Frank Ho

William Blair & Company L.L.C., Research Division - Technology Analyst

* Matthew George Hedberg

RBC Capital Markets, LLC, Research Division - Analyst

* Melissa A. Franchi

Morgan Stanley, Research Division - VP and Research Analyst

* Michael Turits

Raymond James & Associates, Inc., Research Division - MD of Equity Research & Infrastructure Software Analyst

* Saket Kalia

Barclays Bank PLC, Research Division - Senior Analyst

================================================================================

Presentation

--------------------------------------------------------------------------------

Operator [1]

--------------------------------------------------------------------------------

Good day, ladies and gentlemen, and welcome to the fourth quarter and full year 2018 earnings conference call. (Operator Instructions) As a reminder, this conference is being recorded.

I would now like to turn the conference over to

Neeraj Mahajan, VP of Investor Relations. You may begin.

--------------------------------------------------------------------------------

Neeraj Mahajan, Rapid7, Inc. - VP of IR [2]

--------------------------------------------------------------------------------

Thank you, operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's fourth quarter financial and operating results, in addition to our financial outlook for the first quarter and full fiscal year 2019. With me on call today are Corey Thomas, our President and CEO; and Jeff Kalowski, our CFO. We have distributed our earnings press release over the wire, and it is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file.

This call is being broadcast live via webcast. And following the call, an audio replay will be available at investors.rapid7.com until February 14, 2019.

As a reminder, our discussion today contains forward-looking statements about events and circumstances that have not yet occurred, including, without limitations, statements regarding our objectives of future operations and future financial and business performance. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us.

Actual outcomes and results may differ materially from the expectations contained in these statements due to a number of risks and uncertainties, including those contained in our most recent quarterly report on Form 10-Q and subsequent reports that we filed with the Securities and Exchange Commission. The information provided on this conference call should be considered in light of such risks.

Actual results to the timing of certain events may differ materially from the results or timing predicted or implied by such forwardly statements, and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call except to the extent required by applicable law.

Our commentary today will primarily be in non-GAAP terms and unless otherwise stated, we'll be presenting results in accordance with ASC 606. Reconciliations between our GAAP and non-GAAP results and guidance can be found in today's earnings press release.

At times, in our prepared comments or in response to certain questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be onetime in nature, and we may or may not provide an update in the future on these metrics.

With that, I'd like to turn the call over to Corey.

--------------------------------------------------------------------------------

Corey E. Thomas, Rapid7, Inc. - President, CEO & Director [3]

--------------------------------------------------------------------------------

Thank you, Neeraj, and good afternoon, everyone. Thank you all for joining us today on our fourth quarter and full year 2018 earnings call. Rapid7 had a great fourth quarter, capping off a very strong 2018. We are particularly pleased with the acceleration in the adoption of our cloud-based offerings. For the sixth quarter in a row, our ARR growth accelerated, reaching 53%, driven by continued strong new customer growth, lower churn and the success of our platform strategy. We, again, exceeded our growth targets and look forward to another year of ARR growth of over 30% with improving operating leverage.

A few years ago, Rapid7 undertook the challenge of transforming the company. At that point, Rapid7 was primarily an on-premise perpetual revenue company with one main product, vulnerability management. Our vision was to build the leading cloud-based SecOps platform to address a world where IT and security teams are stretched and complexity is increasing, and to do so in a way to make our solutions easy to deploy and easy to adopt in order to drive up-sell and cross-sell. To do this, 3 years ago, we introduced the Insight platform with InsightVM and InsightIDR. Since then, we have launched InsightAppSec and InsightConnect, creating a true multiproduct platform.

Along with this, we transitioned our sales force and more importantly, the entire organization, to think and operate in terms of ARR. Today, we are a leading SecOps company with 4 major cloud-based pillars for growth. We ended 2018 with more than 7,800 customers, an 11% increase. But more importantly, our product customers grew at a much higher rate. Over half of our customers have now taken advantage of the Insight platform, up from 37% last year.

Recurring revenue as a percentage of total revenue has grown over the last 2 years from 67% to 83%. Under ASC 605, ARR per customer has grown from less than $20,000 to over $32,000 in the last 2 years, and nearly 40% of our new ARR in Q4 came from products other than VM.

Rapid7 has been successfully transformed, and we did all of this while consistently improving our operating margins for 5 years running, highlighting the leverage inherent in our operating model. This would not have been possible without the tireless effort of our highly committed and driven teams who delivered in this complex transition.

Now before we talk about 2019 goals, let's do a quick recap of our 2018 goals. At the Analyst Day in 2017 and during our Q4 2017 earnings call, we outlined a set of ambitious goals for the company in 2018, and I'm very proud that our team exceeded these goals. Our first goal in 2018 was to grow ARR by 30%-plus, and we delivered an exceptional growth number of 53%. Our second goal was to continue to expand our customer base. Last year, our customer base, again, grew by double digits, proving that we still have a large opportunity to expand our footprint and the products to win in the marketplace. Our third goal was to improve our operating profitability, which we did while also making investments to drive growth. Our non-GAAP operating margin improved by almost 500 basis points under ASC 605.

While we feel very good about what we have achieved thus far, we are not resting on our laurels, and frankly, we're just getting started. With the business model and the cloud-based transition largely behind us, we are completely focused on our platform strategy to add long-term value to our customers and to have higher lifetime value for Rapid7. We have big aspirations.

Now let us turn to our 3 main goals for 2019. Our first goal is to continue to focus on strong ARR growth, and we are, again, forecasting ARR growth of 30%-plus in 2019, on top of the 53% in 2018. The ARR markets in, which we operate are strong and we now have 4 engines to drive the growth of our Insight platform. They are all in different stages of maturity, and each represents a significant opportunity and together, provide us with the foundation for meaningful levels of long-term growth.

InsightVM remains our largest product, and we expect the VM market to grow at a healthy rate in 2019. We continue to invest in this flagship product, strengthening this offering, including remediation and automation capabilities, which highlight our innovation and clearly differentiates us from the competition. We see continued adoption within our customer base and the ability to add new customers.

IDR, our second-largest product solution, continues to gain market share, and we saw triple-digit ARR growth in 2018, making this our fastest-growing product. We expect strong growth for IDR in 2019.

InsightAppSec, our third pillar, continues to see strong adoption, and we expect this strength to continue in 2019. Customers are challenged by the need to secure fast-growing modern applications driving demand. We provide one of the most comprehensive AppSec solutions to deliver continuous testing, monitoring and protection for these applications. In addition, in Q4 2018, we completed the acquisition of tCell, bringing next generation detection and response and integrated prevention capabilities to our application security portfolio.

Last but not least, InsightConnect. One of the first cloud-native security orchestration, automation and response solution in the market. It's the glue that connects all our other products with the ability to automate SecOps tasks and free up scarce security resources. While the overall market is still in the early innings, we are really excited about this product and its potential.

Our second goal is to continue to make it easier for our customers to adopt to our platform and optimize our customer economics. While we are making great strides, we believe that we are just scratching the surface of the potential ARR per customer. As they adapt more products, we are higher retention rates for our platform customers. A great example to highlight our multiproduct next-gen platform strategies resonating with customers is our win with a large publicly-traded financial institution.

This was an InsightVM customer looking to add more assets under coverage, but also within the market to replace its legacy SIEM solution. Like many organizations, they monitor a large network of assets but have very limited resources. With unified agents already installed on most of their assets through our InsightVM product, InsightIDR was easy to deploy, use and maintain. But the ability to automate a significant number of security tasks with our InsightConnect product was a huge differentiator versus the competition and clenched the deal for us.

To reach more of this potential, we are making multi-year investments to drive higher customer loyalty and customer satisfaction. We'll be optimizing our product portfolio and packaging to drive multiproduct sales to enable our customers to adapt and consume more of our offerings, which we expect will lead to higher retention rates and higher ARR per customer.

Our goal is to remove friction for customers by making product expansion simple and hassle-free. A customer who may currently use only InsightVM should be able to adapt all of our other products at the click of a button. We feel very confident in our ability to drive customer success and lifetime value because we have seen it in action across a growing portion of our customer base.

Our third goal is to continue to drive leverage in our business. In 2018, we saw operating leverage as the underlying economics of our business and sales model improved, and this gives us confidence in our ability to drive growth and scale for the long term. With the investments we intend to make in 2019, we expect to obtain long-term leverage in our call structure as we gain efficiencies throughout the business. We believe we're on a path to exit 2019 profitably on a non-GAAP basis, and we will strive to improve upon this every year.

In conclusion, we have established ourselves as a high-growth cloud software company on a path to sustainable profitability. We enter 2019 as a stronger company than at any time in our history. We are operating in strong end markets and have a platform with many levers for growth, driven by solutions designed to solve key SecOps challenges.

I would like to thank all of our employees, customers and partners for their ongoing commitment to Rapid7.

With that, let me turn the call over to our CFO, Jeff Kalowski. Jeff?

--------------------------------------------------------------------------------

Jeffrey A. Kalowski, Rapid7, Inc. - CFO [4]

--------------------------------------------------------------------------------

Thanks, Corey, and good afternoon, everyone. We're very pleased with our strong performance in the fourth quarter with results that exceeded guidance on all metrics. As Corey mentioned, we believe Rapid7 has established itself as a high-growth cloud software company on a path to sustainable profitability.

Before I begin discussing our strong results for the fourth quarter and full year 2018, I want to remind everyone for the last time, that as of January 1, 2018, we adopted ASC 606 on a modified retrospective basis. And therefore, we've been reporting each quarter's results in 2018 under both ASC 606 and ASC 605. We've included all of these details in our earnings press release today. When discussing our year-over-year growth rates and other key trends in our business, we will be comparing our results on an ASC 605 basis as we don't have prior year operating results under ASC 606, and a comparison would not be meaningful. Moving forward, all results will be under ASC 606.

We set a high bar for our operational and financial goals for 2018, and we exceeded them. With 4 key products on our Insight platform, we now have multiple levers for growth. We successfully transitioned to a recurring revenue model with over 83% of our total revenue that was occurring in Q4 2018, up from under 70% in Q4 2017 under ASC 605. Also 94% of our product revenue was recurring in Q4 2018, up from 81% in Q4 2017, again, under ASC 605.

At the beginning of 2018, we guided for ARR growth of at least 30%, and we delivered 53% growth. We ended the year with revenue of $244 million under ASC 606, a significant beat despite a decline in services revenue. We also delivered on the high end of our operating income guidance, reporting a non-GAAP operating loss of $20 million, while investing the upside in the business to further drive long-term growth and scale. All in all, a very strong year.

Let's turn to our fourth quarter 2018 results. First, on an ASC 605 basis. Total revenue for the fourth quarter was $70.6 million, an increase of 22% year-over-year, and recurring revenue grew by 47%.

Looking at the business geographically, in Q4, North America comprised 85% of revenue, growing 21% year-over-year. Rest of world revenue increased 30% year-over-year and contributed 15% of total revenue in the fourth quarter.

Our focus on recurring revenue drove a 50% increase in our product revenue, offset by a decline in maintenance and support and services revenue. As perpetual customers migrate to the Insight platform, maintenance revenue is reclassified to product revenue.

Non-GAAP operating loss in the fourth quarter was $7.2 million on an ASC 605 basis, an improvement compared to a loss of $7.6 million in the prior year period. Our non-GAAP operating margin improved from a loss of 13% in Q4 last year to a loss of 10% for Q4 2018. Adjusted EBITDA was a loss of $5.2 million for the fourth quarter compared to a loss of $6.3 million in the prior year period.

Now, I will discuss fourth quarter results on an ASC 606 basis. Total revenue was $68.8 million, above the high end of our guidance. Our product revenue was once again driven by strong and broad-based ARR bookings growth across VM, IDR and application security. With a favorable shift towards ARR bookings, as expected, we experienced a slowdown in our professional services bookings.

Visibility into our revenue forecast remains very high. Recurring revenue was 83% of total revenue and 93% of product revenue. 82% of total revenue came from deferred revenue on the balance sheet at the beginning of the quarter. The value of our annualized recurring revenue increased to $251.8 million at the end of the fourth quarter, a 53% increase year-over-year, and an acceleration from 46% growth in Q3, on top of 36% growth for the full year 2017.

Calculated billings for the fourth quarter was $94.3 million, driven by strong new ARR bookings as well as strong renewals performance. Average contract length was 16 months for total billings, down significantly from 25 months in the prior year period, and a slight decline from an average contract length of the 17 months we reported in Q3.

We once again saw our customer shift towards 1-year contracts with our move towards a subscription-based business model. As a reminder, we don't believe billings are a meaningful comparison to prior periods during this transition as they don't capture the benefit of a higher subscription mix and growth of our annual recurring revenue. Based on the trend over the last few quarters, we anticipate that contract lengths will remain in this range going forward.

Our customer count increased by 11% year-over-year, and we ended Q4 with more than 7,800 customers globally. Our customer growth reaccelerated, despite a decline in the number of nonrecurring services-only customers as we saw an increase in the growth of our product customers driven by the high growth of Insight platform customers. As a result, the customer base continues to improve and in Q4, our ARR per average customer increased to over $32,000, which is up 38% year-over-year. Overall, we continue to see strong bookings from new customers, up-sells and cross-sells.

Our expiring renewal rate remained at a high of 90% in the fourth quarter, and our renewal rate was 120%. This reflected the strong growth in ARR.

Turning to margins, total non-GAAP gross margin in Q4 2018 improved sequentially, up slightly to 74%. We're benefiting from a shift towards higher-margin product revenue as well as a stabilization in our product margins as we achieve more scale on our cloud platform. Product non-GAAP gross margin was 80%, up from 79% in Q3 2018. Professional services non-GAAP gross margins decreased to 30% from 32% in Q3 2018 due to lower revenue as a result of lower services bookings with a focus on ARR and more strategic professional services.

During the fourth quarter, sales and marketing expense decreased to 45% of revenue. We've realized almost 600 basis points of leverage in sales and marketing since Q1 2018 while continuing to show a meaningful growth in ARR.

R&D expenses were 22% of revenue, in line with Q3. G&A expenses were 11% of revenue, higher than in Q3, reflecting higher professional fees. Our non-GAAP operating loss was $2.7 million, well ahead of our guidance of a loss of $5.5 million to $4.5 million, and our operating margin improved to negative 4% compared to a negative 4.5% in Q3 2018.

Adjusted EBITDA for the fourth quarter was a loss of $0.7 million. Non-GAAP net loss per share was $0.05 in Q4 2018, also well ahead of our guidance.

In 2018, we strengthened the balance sheet with a follow-on offering, and then a convertible notes offering. These proceeds will enable us to continue to make strategic investments to extend our growth opportunity such as the tCell acquisition for which we paid $14.5 million in Q4 2018.

We ended Q4 with cash, cash equivalents and investments of $303.7 million. This compares to $311.1 million as of Q3 2018. Our Q4 cash flow from operations was $11.9 million, which reflected strong cash collections.

Now I will summarize full year 2018 results under ASC 606. Total revenue was $244.1 million, non-GAAP operating loss was $20.4 million and non-GAAP EPS was a loss of $0.41, all beating the high end of our most recent guidance.

Adjusted EBITDA was a loss of $13.4 million.

Cash provided by operating activities was $6.1 million for the full year of 2018 compared to $13.3 million in 2017. Cash flow from operations for the year was impacted by our rapid shift to subscription revenue and shorter contract lengths and a decrease in professional services bookings. However, the speed at which we transitioned to a subscription model is a strong positive for the long-term growth and profitability of our business.

Now moving on to the guidance. As you might recall during our Analyst Day at the end of 2017, we set ARR growth expectations to be 30% CAGR through 2020. We're happy to say we achieved ARR growth of 53% in 2018 and again, expect to be growing ARR by over 30% in 2019.

For Q1 2019, we anticipate total revenue to be in the range of $68.9 million to $70.5 million. We anticipate non-GAAP operating loss to be in the range of $5.5 million to $4.5 million. We anticipate non-GAAP net loss per share for Q1 to be in the range of $0.10 to $0.08, which is based on an anticipated 47.9 million weighted average shares outstanding.

For the full year of 2019, we anticipate total revenue to be in the range of $304 million to $312 million, which is 26% growth at the midpoint. We expect non-GAAP operating income to be breakeven in 2019, which is a meaningful improvement from the $20 million loss in 2018. As Corey mentioned, we'll continue to make additional investments, and we expect to invest any upside back into the business. We believe these investments will support a much larger business, delivering improved scale and sustainable levels of profitability in 2020 and beyond.

We anticipate non-GAAP net income per share to be $0.05, which is based on an anticipated 51.9 million diluted weighted average shares outstanding. The weighted average shares outstanding for the first quarter of 2019 represent basic shares outstanding, given our projected non-GAAP net loss. The weighted average shares outstanding for the full year 2019 represent the diluted shares outstanding, given our projected non-GAAP net income. Non-GAAP net income for full year 2019 largely represents interest income on projected cash and investments. On a GAAP basis, we expect a full year net loss for 2019.

We expect cash flow from operations to, again, be positive in 2019. As a reminder, we're moving our global headquarters and consolidating facilities this year and hence, our free cash flow will be negative as a result of significant capital improvements in 2019, but these expenditures will decline substantially in 2020.

In conclusion, this was another strong quarter and year for Rapid7, driven by significant ARR growth, shift towards the cloud and subscription revenue and realized leverage in the business.

With that, we appreciate your time and support, and we'll open the call for any questions. Operator?

================================================================================

Questions and Answers

--------------------------------------------------------------------------------

Operator [1]

--------------------------------------------------------------------------------

(Operator Instructions) Our first question comes from Rob Owens of KeyBanc Capital Markets.

--------------------------------------------------------------------------------

Elizabeth Wymond Verity, KeyBanc Capital Markets Inc., Research Division - Associate [2]

--------------------------------------------------------------------------------

This is Liz on for Rob. Really nice to hear the strength in IDR this quarter. Would love to expand on what percentage of new -- of the new ARR deals include multiple products versus starting with VM and expanding there?

--------------------------------------------------------------------------------

Corey E. Thomas, Rapid7, Inc. - President, CEO & Director [3]

--------------------------------------------------------------------------------

This is Corey, so one, thank you for joining us and Jeff and I can tag team it. We didn't give a detailed breakdown on the call. I think one of the key underlying questions that I think you're getting to is that are we growing the business outside of VM. And the answer is absolutely, yes, we are. One of the statistics I shared on the call is that if you look at new ARR, almost 40% of our new ARR in Q4 came outside of vulnerability management, in a quarter, by the way, where we had very healthy growth with inside of vulnerability management itself. And so from our perspective, the -- if you think about our IDR business as being the largest driver of that business, even though all of the different product areas are performing well, we have a very, very healthy business both within VM and outside of VM.

--------------------------------------------------------------------------------

Jeffrey A. Kalowski, Rapid7, Inc. - CFO [4]

--------------------------------------------------------------------------------

Yes, I'll just point out that our platform customers grew again this quarter, and the products per customer, for platform customers, are higher than average, which is 1.5. Also, we have 3 drivers of growth. We have new customers, cross-sell and up-sell, and all 3 segments grew nicely this quarter, and also evidenced by our 120% overall rate, renewal rate.

--------------------------------------------------------------------------------

Elizabeth Wymond Verity, KeyBanc Capital Markets Inc., Research Division - Associate [5]

--------------------------------------------------------------------------------

Great. And then just quickly with -- love an update on how the tCell acquisition is being incorporated and maybe how that factors into expectations for 2020?

--------------------------------------------------------------------------------

Corey E. Thomas, Rapid7, Inc. - President, CEO & Director [6]

--------------------------------------------------------------------------------

Yes. So one, we have a great traction overall in application security with our DAST solution. As you point out, we acquired tCell at the end of last year to really position us as one of the leading cloud AppSec companies where we're actually looking at both application security testing, monitoring and in-app protection. tCell is in its incubation and inclusion to our platform stage right now. We have not built in significant contribution to our overall model for this year. As per our habit, as we actually build out new product offerings, we really focus on nailing the customer use case, building a strong value proposition and demand. So you'll see that come in, in subsequent years, but it's not factored in heavily into our expectations for this year.

--------------------------------------------------------------------------------

Operator [7]

--------------------------------------------------------------------------------

Our next question comes from Saket Kalia of Barclays.

--------------------------------------------------------------------------------

Saket Kalia, Barclays Bank PLC, Research Division - Senior Analyst [8]

--------------------------------------------------------------------------------

Corey, maybe starting with you. It's a question I asked last quarter, but it's interesting to look at again. Obviously, a lot to talk about, but one item that was nice to see was another quarter of 90% expiring renewal rate. And so 2 consecutive quarters with a 9-handle net renewal rate, can you just talk about whether you think that's sustainable? And what are the drivers of that slightly improved renewal rate, in your view?

--------------------------------------------------------------------------------

Corey E. Thomas, Rapid7, Inc. - President, CEO & Director [9]

--------------------------------------------------------------------------------

Yes. So I think there's a couple of drivers. So the first thing is that we fully expect -- and when you look at the underlying product lines and product offerings, each and every last one of them will continue to improve their renewal rate for the foreseeable future, in my mind, and we've seen consistent performance there. Now to get to your question about what the drivers are, there's a couple of drivers. The first, and I think the most important is, what's the renewal rate of each of the individual product lines? The second one is, what's the mix shifts. As you can imagine, more established products have a much higher renewal rate than a product that would have just come out last year. So what's the mix shift based on maturity of product offerings? And the last one is what's the tail from our "historical perpetual customers" that had 3-year deals into the mix there? When you look at the most important name, which is the underlying renewal rate, we're highly confident that that's going to continue to improve. When you get to the other 2, which are both really mix related, those are things that we sort of like, pay attention to after the fact, but they're not really fundamental drivers. We want all of our businesses to grow quite well, and so if one is growing at 30%, another's at 50%, we're still happy because we're actually growing and taking share in the market. But that can have slight impact on our overall renewal rate. So we really focus on the fundamental vein, and so to answer your question, the fundamental renewal rate of our products as they come up for renewal, we see continued opportunity to improve that. The overall renewal rate is really going to have a lot to do with mix shift.

--------------------------------------------------------------------------------

Saket Kalia, Barclays Bank PLC, Research Division - Senior Analyst [10]

--------------------------------------------------------------------------------

Got it. That's really helpful. Maybe for my follow-up for you, Jeff. Clearly, we've outperformed our expectations that we laid out here on 2018. And based on the guide that you're putting up for 2019, it seems like we're going a little bit faster as well. And so I want to bring it back to the original framework that we've put out for the long-term model out to '20, open-ended question, how do we think about that framework now that we've put a bow on 2018 and have put a better-than-expected guide out for '19.

--------------------------------------------------------------------------------

Jeffrey A. Kalowski, Rapid7, Inc. - CFO [11]

--------------------------------------------------------------------------------

Yes. So, Saket, yes, we are exceeding our 2020 goals. At Analyst Day, I think we laid out a $350 million ARR growth, which was a 30% CAGR and revenue at $350 million. So it's clear that those numbers have to go up and will be exceeded. Rather than give a specific number, our feeling is what we want to do is get through 2019, get more visibility and update those numbers in the second half of the year rather than giving anything specific right now. But you are correct that those numbers have to go up.

--------------------------------------------------------------------------------

Operator [12]

--------------------------------------------------------------------------------

Our next question comes from Gur Talpaz of Stifel.

--------------------------------------------------------------------------------

Gur Yehudah Talpaz, Stifel, Nicolaus & Company, Incorporated, Research Division - Analyst [13]

--------------------------------------------------------------------------------

First question here, a really, really great ARR number, 53% growth this quarter. My question is if you look into next year, you're striking a confidence tone here calling for 30%-plus growth again in 2019. So what gives you the confidence, as of today, to kind of sort of say that, especially after kind of delivering a very, very strong end to the 2018 number?

--------------------------------------------------------------------------------

Corey E. Thomas, Rapid7, Inc. - President, CEO & Director [14]

--------------------------------------------------------------------------------

Well, I think the first and most important thing is we actually have strong and healthy end markets. It's much easier if you have really, really strong and healthy end markets actually for your team's performance to actually make a difference. And we are in very, very strong end markets, and I'll say that includes every aspect of what we're doing. The second thing is that we actually have established clear customer demand. So in those strong end markets, we actually have clear customer demand, and we're seeing increasing customer preference. And so that gives us the ability to look out and say, how do we think about our pipeline, how do we think about the opportunities that we're seeing, and how do we think about the future. And I think the third key thing and this goes to the previous question is that we've built a strong business last year, and we're seeing great health in our overall customer environment, and that allows us to actually have a great foundation to grow our overall customer economics as we go forward.

--------------------------------------------------------------------------------

Gur Yehudah Talpaz, Stifel, Nicolaus & Company, Incorporated, Research Division - Analyst [15]

--------------------------------------------------------------------------------

No, that's helpful. And, Corey, another one for you. You talked a bit about InsightConnect on the call itself but something you said kind of piqued my interest. How do you view InsightConnect as a pull-through, if you will, for additional solution adoption, meaning for VM customers that may adopt InsightConnect. Is it easier for them now to go and adopt IDR and AppSec? And how do you think about that as a mechanism for up-sell to products outside of both Connect and VM?

--------------------------------------------------------------------------------

Corey E. Thomas, Rapid7, Inc. - President, CEO & Director [16]

--------------------------------------------------------------------------------

Yes, if you think about what our general message is around SecOps, it has several pillars. But one of them is bringing together different constituencies in the IT environment. So the IT people, the security people, the DevOps people, what you're finding in most modern IT shops is it's moving from these big multi-year projects to this ongoing evolution and improvement. And we think the value of what InsightConnect brings to the table is it delivers immediate productivity value but it then allows people to organically expand and solve additional problems. And so if you think about the combination of InsightConnect and what we're investing in our core systems and platform to make it easier to cross-sell and up-sell, we expect problem solving to be more organic and economical for our customer, and that's the way that DevOps customers behave, that's the way application security customers behave. That's a lot of the way that customers increasingly want to do. They're like, I want to solve my problem at my pace when I want to solve it. And InsightConnect, and some of the enhancements that we're making allow that to be the case. And so yes, we do expect that as we go forward, not just this year but more importantly over the next several years, we'll see increasing ability for our customers to adopt multiple of our solutions and for solutions to work tightly together and frankly, for us to actually integrate with other solutions in their environment. And again, our whole purpose is how do we draw productivity for our customers and make it easier for them to do their jobs.

--------------------------------------------------------------------------------

Operator [17]

--------------------------------------------------------------------------------

And our next question comes from Matt Hedberg of RBC Capital Markets.

--------------------------------------------------------------------------------

Matthew George Hedberg, RBC Capital Markets, LLC, Research Division - Analyst [18]

--------------------------------------------------------------------------------

Corey, you talked about strong expectation for VM, more growth in for 2019, that's great. I'm wondering, could you help us understand, and I'm sure it's hard to generalize, but just roughly speaking, what percentage of your customers' network aren't being scanned right now? Is there sort of a ballpark figure kind of -- that you guys kind of see in an average customer?

--------------------------------------------------------------------------------

Corey E. Thomas, Rapid7, Inc. - President, CEO & Director [19]

--------------------------------------------------------------------------------

Yes. So it's tricky because we're doing a very good job of actually adding new customers, which if you think about new customers actually come in at a lower number of assets under management. And so the way to add those in such ways, what I would say is that we've seen a steady increase. Right now, our rough estimate, it is a rough estimate, have it on average at roughly 30% of assets under management. So they're currently being managed in our customer environment, but that's a mix of some very mature customers. And frankly, we've done a tremendous -- our teams have done a tremendous job of continuing to add new customers in.

--------------------------------------------------------------------------------

Matthew George Hedberg, RBC Capital Markets, LLC, Research Division - Analyst [20]

--------------------------------------------------------------------------------

That's great. That's fantastic to hear. It seems like there's a lot of upside to that. And then I guess, as a follow-up, we continue to hear really good things in the channel about AppSec. I mean, obviously, IDR has been doing great, but I think AppSec continues to resonate with some of the partners that we talk to. Can you talk a little bit more about what's driving that strength? Are there higher attach rates in certain customers, or maybe just a little bit more detail on kind of what you guys are seeing from AppSec?

--------------------------------------------------------------------------------

Corey E. Thomas, Rapid7, Inc. - President, CEO & Director [21]

--------------------------------------------------------------------------------

Yes, I mean, one of the things that we just love about AppSec, and there's many things that we love about it is -- but the most important thing is that underlying fundamentals are great. People are just adding applications at an extraordinary pace and an extraordinary rate. The second thing is it is -- has lagged historically the awareness curve that you actually have to secure those applications. But the awareness curve is catching up fast. So you have lots of applications being added. People are increasingly aware that they need to secure those applications, and we're steadily building out our application security portfolio. That's a great combination and mix. And we're actually starting from a space where we have one of the best ranked DAST platform, and that's the application security testing platform, in the world. So we started from a place of strength, and we're continuing to add great capabilities over time. And I think that's where you see lots of the demand and the momentum come from. The last thing I would say is that we actually think we're very well positioned to actually become a strong leader in the overall cloud application security space, which is where people are deploying apps in the future, and that's a big part of the reason why we bought tCell and making lots of investments in that general area.

--------------------------------------------------------------------------------

Operator [22]

--------------------------------------------------------------------------------

And our next question comes from Michael Turits from Raymond James.

--------------------------------------------------------------------------------

Michael Turits, Raymond James & Associates, Inc., Research Division - MD of Equity Research & Infrastructure Software Analyst [23]

--------------------------------------------------------------------------------

First of all, can you drill down a little bit more on InsightIDR in terms of who you're competing with, who you see, and where you're winning? And I would assume that you're growing faster -- your percentage -- your growth of new ARR than the rest of the business, I just wanted to check?

--------------------------------------------------------------------------------

Corey E. Thomas, Rapid7, Inc. - President, CEO & Director [24]

--------------------------------------------------------------------------------

Yes, so Jeff and I will tag team it. So I'll talk about the qualitative and Jeff can talk about some of the growth dynamics that are there. Qualitatively, we did a big innovation with InsightIDR, and our overall goal was to disrupt the SIEM market by making it much more easy, much more approachable and to really drive productivity and efficacy of the ability to detect and respond to attacks. The obvious first place, if you look back a couple of years when that value proposition resonated, was, of course, in the midsize enterprise, and we've actually continued that great traction there. What we're seeing is that like it's happened with VM and its happened in our broader market is that, that steadily and consistent expanded and now, we're actually managing quite a number of actually, very large and complex customers. And so we expect future growth to happen both in the midsize enterprise space and the large enterprise space, and we're seeing a significant evidence of that, especially if you look at last quarter and the last year that we actually had, which has been a steady increase in that area.

--------------------------------------------------------------------------------

Jeffrey A. Kalowski, Rapid7, Inc. - CFO [25]

--------------------------------------------------------------------------------

Yes. So Michael, we have reported IDR growth as being triple digit in the past, and it continued to grow triple digits on ARR year-over-year.

--------------------------------------------------------------------------------

Michael Turits, Raymond James & Associates, Inc., Research Division - MD of Equity Research & Infrastructure Software Analyst [26]

--------------------------------------------------------------------------------

And then, well, if I could just get a follow-up in that on the investment side. You're going to be breakeven, you say, for next year. But can you talk about where -- prioritize where the incremental investments are that keep you at that level or higher right now?

--------------------------------------------------------------------------------

Corey E. Thomas, Rapid7, Inc. - President, CEO & Director [27]

--------------------------------------------------------------------------------

Yes. So I mean, to take a step back, the primary data we're actually focused on is we've come to the hard part of the cloud SaaS migration. We think we have the opportunity to be a high-growth and profitable cloud SaaS security company. And so where we'll really focus our investments on are continuing to actually focus on the customer experience, which will actually make our customer economics better and better, which will drive profitability over time. So simply the 3 areas that we're focused on. The first one is systems investments that allow us to more seamlessly have customers cross-sell and up-sell. We want them to get our technology when they want it and when they need it. And the real benefit of this is that it provides more flexibility for the customer, giving them a better experience, and it will lower our overall cost-to-sell into the future, that's a great overall investment that actually drives growth and profitability in the future. Similarly, we actually are investing in the overall customer engagement and customer management. The way to think about that is it makes it easier for customers to achieve outcomes and be successful. And by focusing on systems and processes around that, it allows us to address a much larger customer base and have better outcomes in that customer base at a lower cost that we've experienced in the past. And then the last thing we're focusing on is the pricing and packaging ecosystem at the systems level. We're continuing to grow geographically around the world. We're continuing to grow through the channel, both specific channel partners and the range and types of channel partners, and we're just selling lots of products to customers. What we want to enable is every customer can get the product that they want, at the time they want it, at a price point that's compelling for them to expand and grow in the business. We look at those overall investments as really maximizing our customer economics and our ARR per customer and our customer lifetime value that allow us to maintain the momentum that we have of actually growing quite well while continuing to improve profitability.

--------------------------------------------------------------------------------

Operator [28]

--------------------------------------------------------------------------------

Our next question comes from Jonathan Ho, William Blair.

--------------------------------------------------------------------------------

Jonathan Frank Ho, William Blair & Company L.L.C., Research Division - Technology Analyst [29]

--------------------------------------------------------------------------------

I just wanted to start with sort of the non-VM products and whether or not you're starting to see them serve as entry points to win new customers, or is this primarily still sort of add-on to existing VM customers as part of that cross-sell and up-sell motion?

--------------------------------------------------------------------------------

Corey E. Thomas, Rapid7, Inc. - President, CEO & Director [30]

--------------------------------------------------------------------------------

It's a great question. What I'll say is IDR has always been a entry point. Early on, even IDR was sort of like half entry points to the new customers and half of the installed base. I would say, right now, all of the products actually effectively serve as entry points into new customers, at slightly different rates, but all of our products, whether it's AppSec, security orchestration and automation, which we recently introduced to SGA, or IDR, they all serve as mainly paths for actually acquiring new customers. And the nice thing is that we're starting to see momentum where we're going with IDR customer and add VM. Or we'll go in with an AppSec customer and add VM or IDR. And so it's a very, very effective overall customer adoption strategy for us, which is why we have lots of visibility and confidence in our model to actually continue to expand ARR per customer.

--------------------------------------------------------------------------------

Jonathan Frank Ho, William Blair & Company L.L.C., Research Division - Technology Analyst [31]

--------------------------------------------------------------------------------

Got it. And just given some of the uncertainty out there in the global macro, whether it's from the Fed or from various regions, like Brexit, I mean, are you as concerned at all about any of that noise maybe filtering down to either security spend or your areas of the market?

--------------------------------------------------------------------------------

Corey E. Thomas, Rapid7, Inc. - President, CEO & Director [32]

--------------------------------------------------------------------------------

I mean, you all would be much more experts on the globe. I can tell you what we see, and we pay attention to it tightly because we know how economics works and that things filter down over time. What we see right now is a recognition that there is broad demand for security, and for the SecOps offerings that we actually have. So all customers, whether they have budget today or whether they're trying to get budget, recognize that there is a strong need out there. And the second thing that we see is that right now, people are actually funding or finding ways to actually fund that need. So it's a very healthy environment right now. What I would say is that we are lucky to be in a space where people see it as a need. So even for organizations that may be budget constrained, they're saying, how do I get to this over time, which is exactly -- because I've been doing this for a while, that's exactly the kind of space you want to be in is where people are finding ways to actually fund your solutions over time because they add value.

--------------------------------------------------------------------------------

Operator [33]

--------------------------------------------------------------------------------

Our next question comes from Alex Henderson from Needham and Company.

--------------------------------------------------------------------------------

Daniel J.W. Park, Needham & Company, LLC, Research Division - Associate [34]

--------------------------------------------------------------------------------

This is actually Dan Park on for Alex. So I know it's still very early innings, but could you maybe provide an update on the automation and orchestration features implemented within inside VM and IDR, and if this is starting to drive some additional customer interest?

--------------------------------------------------------------------------------

Corey E. Thomas, Rapid7, Inc. - President, CEO & Director [35]

--------------------------------------------------------------------------------

Yes. So the -- for those of you who may recall, our InsightConnect, which is the evolution of command, really had 2 primarily strategic benefits for us. One is actually establishing new market, that was a value add. The second benefit was it differentiated significantly our existing solutions, specifically InsightVM and InsightIDR. And third, it actually made our products a lot more sticky for customers. I mean, those are 3 really big things. So I'll talk about each of those environment. And so one, we have launched Insight -- we have launched InsightConnect, and we're seeing good momentum pipeline, the adoption's early, but we're seeing healthy ASPs and good adoption, and we're very optimistic about the future even though it's still in the very, very early innings. The second, it has been a clear differentiator for both InsightVM and InsightIDR, because these are 2 areas where people are just under-resourced and under-constrained. We've had many conversations with customers about, how can I go beyond 30% of my environment for assets under management with VM when I don't have the resources or the capability to manage the vulnerabilities and the threats that I actually have today. Well, it turns out, if you can actually automate more of that, the customer's happy and then they actually take on the next stuff to the environment and that can move to 40% or 50%. The value proposition is resonating quite well overall. Likewise, with InsightIDR, the whole focus that we continue to evolve and continue to add the ability to is how do I make it faster to investigate things, and how do you make it faster to respond and remediate things. We're seeing very, very strong demand in the InsightIDR space, and it is a meaningful differentiator increasingly of why we win. The nice thing that we expect, and it's still early just because when we released it, is that for each of these capabilities, for the customers that we've seen who have deployed these capabilities, it actually is extraordinarily sticky in their environment, far than you see reflected in the fact that our platform customers have a much higher renewal rate, but we think that our platform increasingly is a much, much more sticky proposition than the offerings that exist in the SIEM or VM market a couple of years ago.

--------------------------------------------------------------------------------

Operator [36]

--------------------------------------------------------------------------------

(Operator Instructions) Our next question comes from Lisa Franchi of Morgan Stanley.

--------------------------------------------------------------------------------

Melissa A. Franchi, Morgan Stanley, Research Division - VP and Research Analyst [37]

--------------------------------------------------------------------------------

Corey, you talked about being underpenetrated into your customer base. I'm wondering to what extent you're starting to see customers extend vulnerability management or InsightVM into maybe more what's called modern IT assets like IoT/OT? And do you feel like you have the technology today to well address those use cases?

--------------------------------------------------------------------------------

Corey E. Thomas, Rapid7, Inc. - President, CEO & Director [38]

--------------------------------------------------------------------------------

Yes. So one, we actually have a wide deviation customers who come in. We do a great job of adding new customers. So customers who come in, come in with a lower rate. What we also find is that customers expand and can expand to a very high rate. So we are seeing high levels of penetration in customers that have been with us for a while and of course, customers come in lower. We also see great adoption across the landscape. So customers' priorities, as we actually see them, are their core network data center assets, their endpoints, their applications, then the rest of their environment and that includes the IoT environment. We're actually obsessively focused on actually operate it in a way that actually customers see. So what we see adoption today in and where we have great products that deliver that today is that, one, we build it with the strongest solution, perhaps, the covering core infrastructure. Two, we actually feel that we have the strongest solution for actually covering cloud environments, and we see great uptick and greater adoption in overall cloud environments. Three, applications are where the gain is in the future, it's strategic, it's important, it's what we were exposed. We have, of the traditional VM competitors, the most mature and advanced operating application security, and we're there. And in the IoT space, we have coverage today, and we're actually in the process of having -- in the process of continuing to expand our efforts to look at IOT and OT.

--------------------------------------------------------------------------------

Melissa A. Franchi, Morgan Stanley, Research Division - VP and Research Analyst [39]

--------------------------------------------------------------------------------

Okay, got it. That's helpful. And then just as a follow-up, you've talked about focusing on resource-constrained enterprises, but it seems like you're also having some traction in large enterprises as well. Can you maybe talk about what sort of adoption you're seeing in larger enterprises? And to what extent are you investing in that opportunity versus this -- that opportunity sort of coming to you?

--------------------------------------------------------------------------------

Corey E. Thomas, Rapid7, Inc. - President, CEO & Director [40]

--------------------------------------------------------------------------------

Yes. So first and foremost, we're actually seeing significant traction. We still have roughly 40% of the Fortune 100. We have some great brands that actually have enterprise-wide coverage, that are large enterprise across all sectors, frankly, whether you look at sort of like the finance sector; the technology sector, where we have an amazing footprint; the oil and gas industry. So we actually have the traction and it's been growing steadily over time. The marquee in that segment, which is continuing to get more and more enterprise adoption and of course, our InsightVM solution, and we're seeing rapid adoption right now with the InsightIDR. And oddly enough, InsightConnect has actually started in different parts of the market. And then lastly is our application security offering, which frankly, started off with a heavier enterprise bias than any of our other offerings. So we actually have traction and momentum across the enterprise segment. To your question about the sort of the focus. From a products perspective, we have been and we are always focused on actually ensuring that all of our customers are successful, and we'll continue to make sure that we're meeting the needs and exceeding the needs of the large enterprise as well as the midsize enterprise customers. Now when we introduce new offerings, we always, just like anyone who's actually really good at something like those that our product does, is you start with the target customer, you get success with your target customer and then you expand. And we're extraordinarily disciplined about that because that's what allows you to build a sustainable long-term business. We're at the stage now with InsightIDR where we have a great core customer and now, we're rapidly expanding that customer and we're adding capability, and that's working out very well.

--------------------------------------------------------------------------------

Operator [41]

--------------------------------------------------------------------------------

And ladies and gentlemen, this does conclude our question-and-answer session. Thank you for participating in today's conference. This concludes today's program. You may all disconnect. Everyone, have a great day.