Q3 2024 SecureWorks Corp Earnings Call
Participants
Alpana Wegner; CFO; SecureWorks Corp.
Kevin J. Toomey; VP of IR; SecureWorks Corp.
Wendy K. Thomas; CEO & Director; SecureWorks Corp.
Madeline Nicole Brooks; Research Analyst; BofA Securities, Research Division
Matthew Louis Saltzman; Research Associate; Morgan Stanley, Research Division
Michael Joseph Cikos; Senior Analyst; Needham & Company, LLC, Research Division
Presentation
Operator
Good morning, everyone. My name is Bruno and I'll be your conference call operator today. At this time, I would like to welcome everyone to the SecureWorks Third Quarter Fiscal 2024 Financial Results Conference Call.
(Operator Instructions)
A supplemental slide presentation to accompany the prepared remarks can be found on the company's website. After the speaker's remarks, there will be a question-and-answer session.
(Operator Instructions)
At this time, I would like to turn the call over to Kevin Toomey, SecureWorks Vice President of Investor Relations. Mr. Toomey, you may begin your conference.
Kevin J. Toomey
Thank you, operator. Good morning, and welcome to SecureWorks Third Quarter Fiscal 2024 Earnings Call. Joining me today are Wendy Thomas, our Chief Executive Officer; and Alpana Wegner, our Chief Financial Officer. During this call, unless otherwise indicated, we will reference non-GAAP financial measures. You will find the reconciliations between these GAAP and non-GAAP measures in the press release and presentation posted on our website earlier today. Finally, I'd like to remind you that all statements made during this call that relate to future results and events are forward-looking statements based on current expectations.
Actual results and events could differ materially from those projected, due to a number of risks and uncertainties, which are discussed in our press release, web deck and SEC filings, which you can also find on the Investor Relations website at investors.secureworks.com. We assume no obligation to update our forward-looking statements. With that, I'll turn the call over to SecureWorks' CEO, Wendy Thomas.
Wendy K. Thomas
Thank you, Kevin, and welcome, everyone. I'm pleased to share that our Taegis business continued to yield industry-leading results in 3Q with Taegis revenue expanding 41% year-over-year to over 67 million in the quarter. Taegis annual recurring revenue, or ARR, now stands at 279 million, a 25% growth over last year.
In the context of this growth, we recently were recognized as having the largest market share of cloud-native XDR at 32% as published in the IDC Worldwide cloud-native XDR market share report this quarter and we are delivering on our drive to profitability with a sequential improvement in adjusted EBITDA, narrowing our loss to 1 million in 3Q with a clear path to breakeven next quarter. In the Third Quarter, we also advanced across several priorities. We accelerated expansion of our platform features and capabilities to provide superior security outcomes for customers and partners. Added key partners to the Taegis ecosystem, broadening our reach and expanding our addressable market and reinforced our market leadership role with new recognition in the marketplace for our platform and solutions.
In fact, we are 1 of only 2 providers in the leader quadrant in the recent Forrester Wave, Managed Detection and Response Services in Europe. In short, we are building the foundation for long-term sustainable growth in our highly scalable Taegis business that is recognized by the market as a global leader in XDR. Why does that matter? It matters because XDR represents the next wave of security technology to address persistent security challenges unsolved by legacy SIEMs, EDR-focused prevention or a services-based approach.
Against a threat landscape that is constantly evolving companies continue to grapple with the sector of ransomware attacks, data breaches and more. In our recent Annual Threat Intel report, threat actor dwell times are down from nearly 5 days to just 24 hours over the last year. That is where the power of our Taegis solutions to prevent, detect and automate investigation and response comprehensively across the entire ecosystem brings ongoing customer protection and value.
Against this threat backdrop, companies are also looking to SecureWorks to help them navigate growing privacy and cybersecurity compliance regulations and data provenance protections. We help them outpace growing cyber risk, and manage against rising cyber insurance premiums. And the advanced AI and automation capabilities in Taegis mean we scale the security talent required to effectively manage detection and response for organizations at scale. The competitive advantages that ages and the SecureWorks suite of solutions offer are resonating in the market, demonstrably reducing risk and supporting resilience, driving demand for our solutions, and increasing the market's recognition that XDR is the next era in security. I'll turn now to our go-to-market progress.
As you know, our unique open-without-compromise approach to XDR creates multiple go-to-market channels for SecureWorks and greater addressable market and revenue growth opportunities for our partners. This past quarter, we achieved several milestones in expanding our partner ecosystem, and growing our deals on together. As an indicator of traction in Third Quarter, more than 90% of global Taegis' new logo business was closed with a partner, up from less than 40% this time a year ago. An example of the force multiplier, when we partner with a solution provider, is a competitive deal we recently won with a new customer and financial services.
One of its portfolio companies experienced a cyber-attack, that impacted business operations for an extended period, causing damaging effects both reputationally and financially. With a small centralized security team and multiple solutions deployed across its portfolio of companies, they were looking for holistic visibility and consistent protection across a diverse and siloed technology footprint. The customer cited 2 keys to their decision. Our partner's consultative services and ability to provide customized billing across their portfolio and our open XDR approach to securing diverse technology stacks in a unified multi-tenant approach.
Given the current macroeconomic backdrop, we're encouraged by our conversations with prospects who see the opportunity with Taegis to scale their spend on both security technology and talent and to reduce the number of security vendors that they manage, while delivering an improved security risk posture and outcomes for their business. For example, we recently signed a new customer, a large health care provider that wanted to replace their legacy SIEM as our small security team didn't have the time or expertise to continually manage and optimize it for their security coverage.
We won this customer after we were able to show, we had advanced detection and automated response capabilities, inclusive of but well beyond the end point, built into the Taegis platform. All this with no configuration required and with the use of the Taegis agent and unlimited 24/7 incident response included, we met their security needs with lower total spend. We continue to expand our MSSP partnerships and enable our Better Together go-to-market motion this quarter. We signed a new agreement with one of the largest multinational companies based in Asia Pacific, our largest Taegis managed services partner in the region.
While our MSSP partners appreciate the scale and margins available with an MDR offering on Taegis, they also cite our unique open endpoint approach with single agent capability and bolstering their ability to win in a broader addressable market. We recently worked with a partner to win a competitive deal with a new customer, a large manufacturing company, that was looking for our placement for their existing MSSP service wrapped around a SIM, which gave them no visibility into raw telemetry or alerts real time, forcing them to rely on periodic manual reports. The customer was aware that the attack sophistication had changed. They needed to, as they said, up their game, and they additionally wanted to secure their recent investment in Microsoft E5 licenses.
The customer was pleased with our open-without-compromise approach with full visibility and detection capabilities across their O365 and cloud ecosystem, which allows Taegis to be used collaboratively and most importantly, transparently across customer teams, our MSSP partners and SecureWorks security experts, all of whom have the same visibility into the efficacy and actions in the platform, the detection sources, threat context, investigation steps and more working interoperably in real time to be the adversary.
In addition to budget considerations, customers are focused on materially reducing cybersecurity risk and building their resilience and ability to respond successfully in case of an incident. Trends in recent years have shown an increase in customer preference for cyber insurance policies which offer faster response from a pool of preapproved incident response providers in a more cost-efficient manner for the customer. We signed with several large cyber insurance partners in Third Quarter, including one of the largest multinational insurance providers in Asia Pacific, AXA-XL and an exclusive partnership with privacy rules, an alliance of privacy-focused law firms with members in 60 countries.
We remain confident that our partnerships are an important path to market as customers value the advisory role that they play in recommending trusted solutions and in easing the procurement process. An insurance panel membership elevates SecureWorks brand presence and provide strong third-party validation of the Taegis platform and solutions, improving the go-to-market motions for SecureWorks and our partners. As with any new go-to-market motion, it takes time for investments to bear fruit, but we are putting the building blocks in place to position our business for long-term growth.
As I look at the market from a macro perspective, we continue to experience elongated sales cycles versus last year. The drivers during the customer decision-making process remain consistent as most organizations are focused on fiscal prudence around all investments. We continue to see elevated layers of deal review with higher-level approvals required in the customer decision-making process. We have yet to see indications that this will change in the near term. Additionally, Q4 has historically been the strongest quarter for sequential growth in Taegis ARR. However, we do not expect to see the same level of budget flush we've seen in past fourth quarters, which we are reflecting in our updated fiscal '24 ARR guidance.
Moving to an update on new product capabilities. This quarter, we delivered on the expansion of our platform capabilities to better support partners and customers. We introduced the ability for partners to accelerate customer onboarding with streamlined tenant management and advanced customer permission configurations to efficiently threat hunt across their customer base, leveraging our advanced proactive hunting playbooks, and to bring custom detections and intelligence to the platform with integrations natively. This is one of the many areas where we see the power of collaboration, community and being open without compromise as the most effective approach to outpacing the adversary.
Because we understand the growing importance of cloud protection for our customers, we launched several new capabilities this quarter, including additional AWS integrations, providing increased visibility and leveraging Taegis' detection capabilities for cloud-based threats, Taegis' endpoint agent support for additional Linux distributions helping protect a broader set of cloud-based workloads and making key cloud workload metadata available within Taegis, driving faster triage, investigation and response workflows.
We also delivered on the expansion of our platform capabilities to add features that advanced security and permission configurations in Taegis to address the needs of diverse operational environments, integrating advanced threat detection for real-time awareness. The enhanced security and permission configurations in Taegis cater to a variety of operational needs, offering partners and customers are more versatile, tailored and comprehensive stock platform. I continue to be pleased with the outcomes AI is generating for our customers. Taegis has leveraged AI since inception. Our first advanced detectors for machine learning and deep learning base, and we have used AI heavily to drive automation and efficiency through every aspect of the platform.
This quarter, we continue to make significant advancements in the Taegis platform, leveraging the integration of machine learning and large language models alongside our unique cloud architecture to enhance the platform security analytics and SecOps efficiency. Over the last year, we saw significant gains from AI-assisted automation, decision-making and threat detection. With our investments we have leveraged our body of investigation reports as training data for the development of a customer-facing reporting system that creates, enriches and escalates investigation reports in less than half the manual process time.
We launched a patent pending prioritization engine, which processes more than 1 trillion events across our customers. This system helps surface critical threats to better secure customers, while improving notification times by 80% and reducing stock analyst triage workload by 50%, largely through the elimination of low confident alerts. This has led to detection improvements for our customers and efficiency gains for us. AI technology is crucial to bridging the widening security talent gap, bolstering our collective defense mechanisms and democratizing advanced security capabilities. But at SecureWorks, we integrate generative AI into our processes with deliberation and care. Our stance is clear. No technology, however, advanced is presumed secure.
It must first endure our rigorous and comprehensive development practices, only after thorough testing by our product team and security analysts, do we consider deploying new capabilities into our platform and making them available to our customers. Our approach is methodical, conducting controlled experiments, continuously educating our team and crucially ensuring that any new capabilities aligned with our stringent development criteria before, during and after release. In this way, we not only stay at the forefront of AI development, but we ensure it's not only secure, but underpins rapid innovation, while upholding our unwavering commitment to deliver on our company purpose to secure human progress.
We are delivering and remain committed to building the foundation for sustainable growth that allows us to scale, realized improvements in productivity and drive operational efficiencies into the business that will enable us to deliver positive adjusted EBITDA. As we saw this quarter, we are driving Taegis margin expansion through automation, continued cloud architecture scaling and by leveraging our investments in AI. It's equally important that we continue to invest in the highest quality solutions to reduce risk and provide superior security outcomes for our customers and partners to retain our market leadership position.
We are rapidly approaching the sunset of our other MSS business in the First Quarter of fiscal '25, a milestone that is a significant positive for our business and which will alleviate the remaining headwind on our total revenue. Our Q3 results give us further confidence in reaching the key milestone of adjusted EBITDA profitability, and we're reaching the inflection point before we complete the wind down of our other MSS business lines. We will continue to reduce costs related to our sunsetting businesses during the first half of fiscal '25, which will contribute to our profitability into the future.
I want to thank our customers and partners for joining forces with us and my thanks to our teammates for their diligence, integrity and commitment to securing our customers. With that, I'll turn the call over to Alpana to walk through our financial results and guidance.
Alpana Wegner
Thanks, Wendy. Good morning, everyone. I'm pleased we delivered against our financial commitments in the Third Quarter and the progress we've made on our path to profitability and cash flow generation. I'll start with the highlights of our Q3 financial results, and then I will provide expectations for the remainder of the year. Total revenue for the quarter was $89.4 million, slightly above the midpoint of our guidance of $88 million to $90 million. Total revenue continued to be impacted by the wind down of our other MSS business.
Taegis subscription revenue was $67.3 million, up 1% sequentially and 41% year-over-year, in line with our expectations. Taegis ARR increased 25% year-over-year to $278.7 million, now representing 92% of our total ARR. Average revenue per Taegis customer expanded sequentially to $139,000 driven by higher new logo ARPC and continued expansion of spend by our existing customers. Taegis ARPC remains a premium to both the industry average and to our historical other MSS average, underscoring the value that Taegis provides our customers.
Non-GAAP Taegis gross margin expanded 200 basis points sequentially to 72.7% this quarter and showed an improvement of 510 basis points versus Third Quarter a year ago, demonstrating the scale opportunity within the Taegis business. As Wendy shared earlier, our unique cloud architecture allows us to improve our operational efficiency to drive Taegis margin expansion by using automation, investment in AI and machine learning. Adjusted EBITDA loss was $1.2 million compared to a $17.2 million loss in the prior year period, reflecting the expansion of gross margin within our Taegis business I just discussed, as well as the benefit of the restructuring activities from earlier this year.
Turning to the balance sheet and capital allocation. We ended the Third Quarter with a strong balance sheet with $58.1 million in cash, no debt and an undrawn credit facility. We used $4.5 million of cash from operations compared with $26.8 million used in the prior year period, which primarily reflects a decrease in our net loss and the timing of working capital.
Now turning to our guidance. Before I go through our detailed guidance, I'd like to provide some commentary on what is shaping our full year outlook for Taegis ARR. First, we continue to experience a challenging macro environment that is leading to elongated sales cycles, we don't see any evidence of this changing in the near term. And second, we are not expecting the same magnitude of Fourth Quarter budget flush that we've seen historically. For the full year, we now expect Taegis ARR to end at $280 million or greater. We continue to expect other MSS ARR to represent 5% or less of total ARR, and we expect Taegis revenue to end between $264 million to $266 million, and a total revenue between $363 million to $365 million, reflecting the continued wind down of our other MSS business with an expected end of life in the First Quarter of next fiscal year.
Our outlook on profitability has slightly improved, taking into consideration our Q3 results. We now expect for the full year Taegis gross margins to be greater than 71% with Q4 margins remaining relatively flat to the Third Quarter, we expect adjusted EBITDA to be between negative $31 million to $33 million with Q4 adjusted EBITDA of breakeven to slightly positive. We expect full year non-GAAP EPS loss to between $0.33 to $0.35 and we continue to expect net cash used in operating activities to be between $70 million and $80 million and CapEx of $6 million to $8 million.
In terms of fiscal 2025, we will provide guidance for Q1 and the full year on our Q4 earnings call in March. In closing, we remain confident in the ability to drive sustainable profitable growth based on the progress we've made in building a strong partner ecosystem. The customer outcomes from the investments in our unique Taegis XDR platform, the continued opportunity for scale driven by our cloud architecture and the upcoming end of life of our other MSS business. Thank you for joining us on the call today. Wendy will now rejoin us as we begin Q&A. Operator, can you please introduce the first question?
Question and Answer Session
Operator
(Operator Instructions)
Our first question comes from Mike Cikos from Needham.
Michael Joseph Cikos
You have Mike Cikos here, I did just want to follow up since I know Alpana just went through the guidance considerations here. And I know you -- we have this revised ARR guidance for Taegis with respect to the elongated sales cycles and the now -- we're expecting not a similar budget plus the previous year. Like can you help us unpack those 2 items as far as inputs for the ARR guidance? How much is coming from the elongated sales cycles versus the reduced budget flush expectations? And really, if you could also qualify that sales cycle elongation we're seeing, is that even on a sequential basis? Or is it more of a year-to-year comment?
Wendy K. Thomas
Sure. Mike, thanks for the questions. So let me break those 2 apart for you. In terms of the elongated sales cycle, that continues to be up versus last year, not a material change sequentially from 2Q. So the majority for us is looking as we head into the Fourth Quarter, not seeing the normal sort of seasonal shift in pipeline as we come in from the normal kind of budget flush. I think that's just related to the continued caution around making investments, right? These are multiyear investments in security, and it's important and the additional layers of review and approval to make sure that those decisions that lock them in are good ones. And that's just the piece that we see along with not getting to kind of use your budget this year. It's more loose than used it in the Fourth Quarter.
Michael Joseph Cikos
Got it. And I did just want to come back to the comment as well. I believe Wendy, in the prepared remarks and correct me if I'm wrong on go-to-market, but more than 90% of global Taegis new logo business in the quarter was driven from quarters -- from partners, I'm sorry, versus 40% last year. And I just wanted to make sure I'm interpreting that correctly, like the Taegis customer count, I think, has been relatively stable around 2,000 customers now for the last 4 quarters. And I'm trying to just figure out, does it take time for those new logos to show up in the customer count? Or how is -- I guess, when can we expect broader market traction with Taegis, just given that customer count for Taegis has been relatively stable for the, I guess, a year now?
Wendy K. Thomas
Sure. So part of our partner go-to-market strategy is going to market with managed security partners. And as I talked about, we continue to sign larger high-profile partners in that space because they see the efficacy of the platform. But currently, in our customer count, we only count those partners no matter how many end customers they add as one customer in our accounts. So we have highlighted the expansion in average revenue per customer.
So as you saw that was 139,000 versus up from 135,000-or-so last quarter. And that's why we measure both of those is because that's an important measure of market traction that isn't necessarily reflected in the way we report our customer count today.
Alpana Wegner
Yes. And Mike, this is Alpana. One other thing I might just add -- the logo counts also don't, as Wendy said, don't give us a reflection from an overall sort of scale. And one of the other things that we do look to is endpoints. And I would say that what we see sequentially there quarter-over-quarter is growth. Again, just underscoring the expansion may not be able to be seen through the logo counts, but we're pleased with the progress that we're making.
Operator
(Operator Instructions)
Our next question comes from Hamza Fodderwala from Morgan Stanley.
Matthew Louis Saltzman
Great. This is Matt Saltzman on for Hamza. So I know you mentioned that the Q4 pipeline might be a little bit lighter just since you're not expecting that same level of budget flush this year. But could you talk a little bit about pipeline early into fiscal '25? I know you're not ready to formally guide yet, but how are demand trends looking as the pipeline builds for next year? And anything we should be thinking about in terms of demand dynamics that you're seeing in the market today?
Wendy K. Thomas
Sure. We absolutely see the total pipeline remaining healthy. What we didn't see was the kind of pull into Fourth Quarter that we typically see around trying to take advantage of end-of-year budget. So that's one thing for us. The other is that for our go-to-market shift here, the increasing mix from partners is also pretty important. What we see around other things of kind of the pace of -- or the win rates on sort of technical approvals and win rates on proof of value or proof of concepts remain steady. So it's just that same sort of cautious multilayered assessment of things and not the rush to buy inside of that pipeline that we may have seen in years past.
Matthew Louis Saltzman
Got it. And maybe if I could just ask a quick follow-up just around go-to-market orientation being more skewed towards partners now. Do you feel that maybe things might actually not be as -- I guess maybe there aren't as many headwinds in Q4 as you would usually expect, but maybe there's just less visibility because you're going through that partner channel?
Wendy K. Thomas
In terms of the pipeline?
Matthew Louis Saltzman
Yes. Just in terms of customer spend attention since a lot of those engagements are happening at the partner level now, perhaps there's just lower visibility and things may not actually be that bad. Or kind of -- I guess, to ask a better question, how do you think about assessing the demand environment when more of the go-to-market is going via external sources?
Wendy K. Thomas
Sure. It's a good question, and we have been cautious in terms of learning the win rates and cycle times with relatively new partnerships. So there's certainly a learning curve that we're on there in terms of predictability. We do engage with those deals and have some amount of visibility into the pipeline from deal registration and such. But it is true. It is a different motion. And therefore, our sort of range of outcomes on that can be a little more dispersed than it was when we were a pure direct model a couple of years ago.
Operator
Our next question comes from Tal Liani from Bank of America.
Madeline Nicole Brooks
You have Madeline on for Tal this morning. Just one quick one for me. I just want to go back to the budget flush commentary. If we look across cyber peers over the last year, budget flush -- the lack of the 4Q budget flush also happened last year. And some would argue to a bigger expense because it was definitely more unexpected last year. I feel like though, given the macro environment that we've been in over the last 12 months and potentially even more, budget flush was -- the lack of budget flush was expected, right? We saw it last year. So I guess I just want to understand why it's new for just you guys this year or why maybe the impact is greater for you this year versus peers who aren't feeling the same.
Alpana Wegner
Madeline, this is Alpana. Thanks for the question. I would say that for us, it was more in our commentary is really around the change in the guide. Last year, in Q4, we did see a good amount of budget flush come through. You can see sequentially when you look from Q3 to Q4 last year, we had a nice quarter from an ARR growth perspective. And really, the commentary was just around when we set our guide last quarter, we had some expectations not to the same level as last year, but we did think we'd see some. And so the revised view is really as we move through Q3.
And as we've looked at the pipeline and the demand that we're seeing, while there's a lot of good activity and good discussions with prospects and we're seeing, the sales cycles and the demand holding, we didn't see that natural increase, albeit at a lower level than last year that we were expecting when we had previous set our guide.
Operator
We currently have no further questions. So I would like to hand the call back to Kevin Toomey for closing remarks. Kevin, please go ahead.
Kevin J. Toomey
Okay. Thank you. That wraps the Q&A and today's call. A replay of this webcast will be available on our Investor Relations page at secureworks.com, along with our supplemental web deck with additional financial tables. Thanks again for joining us today.
Operator
Ladies and gentlemen, this concludes today's call. Thank you for joining. You may now disconnect your lines. Thank you.
