Rapid7 Inc (RPD) Q4 2018 Earnings Conference Call Transcript
Image source: The Motley Fool.
Rapid7 Inc (NASDAQ: RPD)
Q4 2018 Earnings Conference Call
Feb. 07, 2019, 4:30 p.m. ET
Contents:
Prepared Remarks
Questions and Answers
Call Participants
Prepared Remarks:
Operator
Good day, ladies and gentlemen, and welcome to the Fourth Quarter and Full Year 2018 Earnings Conference Call. (Operator Instructions). As a reminder, this conference is being recorded.
I would now like to turn the conference over to Neeraj Mahajan, VP of Investor Relations. You may begin.
Neeraj Mahajan -- Vice President, Investor Relations
Thank you, operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's fourth quarter financial and operating results, in addition to our financial outlook for the first quarter and full fiscal year 2019. With me on call today with Corey Thomas, our President and CEO; and Jeff Kalowski, our CFO. We've distributed our earnings press release over the wire and it is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial slides. This call is being broadcast live via webcast and following the call, an audio replay will be available at investors.rapid7.com, until February 14, 2019.
As a reminder, our discussion today contains forward-looking statements about events and circumstances that have not yet occurred including without limitations statements regarding our objectives for future operations and future financial and business performance. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the expectations contained in these statements due to a number of risks and uncertainties, including those contained in most recent quarterly report on Form 10-Q and subsequent reports will be filed with Securities and Exchange Commission. The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call except to the extent required by applicable law.
Our commentary today will primarily be non-GAAP terms and unless otherwise stated, we will be presenting results in accordance with ASC 606. Reconciliations between our GAAP and non-GAAP results and guidance can be found in today's earnings press release. At times in our prepared comments or in responses to your questions, we may offer incremental metrics to provide greater insights into the dynamics of our business or our quarterly results. Please be advised that this additional detail maybe one-time in nature and we may or may not provide an update in the future on these metrics.
With that, I would like to turn the call over to Corey.
Corey E. Thomas -- President and Chief Executive Officer
Thank you, Neeraj, and good afternoon, everyone. Thank you all for joining us today on our fourth quarter and full year 2018 earnings call. Rapid7 had a great fourth quarter, capping off a very strong 2018. We are particularly pleased with the acceleration in the adoption of our cloud-based offerings. For the sixth quarter in a row, our ARR growth accelerated, reaching 53% driven by continued strong new customer growth, lower churn and the success of our platform strategy. We, again, exceeded our growth targets and look forward to another year of ARR growth of over 30% with improving operating leverage.
A few years ago, Rapid7 undertook the challenge of transforming the company. At that point, Rapid7 was primarily an on-premise perpetual revenue company with one main product, vulnerability management. Our vision was to build the leading cloud-based SecOps platform to address a world, where IT and security teams are stretched and complexity is increasing. And to do so in a way to make our solutions easy to deploy and easy to adopt in order to drive up-sell and crosssell. To do this, three years ago, we introduced Insight
platform with InsightVM and InsightIDR. Since then, we have launched InsightAppSec and InsightConnect, creating a true multiproduct platform.
Along with this, we transitioned our salesforce and more importantly, the entire organization to think and operate in terms of ARR. Today, we are a leading SecOps company with four major cloud-based pillars for growth.
We ended 2018 with more than 7,800 customers, an 11% increase. But more importantly, our product customers grew at a much higher rate. Over half of our customers are now taking advantage of the Insight platform, up from 37% last year. Recurring revenue, as a percentage of total revenue has grown over the last two years from 67% to 83%. Under ASC 605, ARR per customer has grown from less than $20,000 to over $32,000 in the last two years, and nearly 40% of our new ARR in Q4 came from products other than VM.
Rapid7 has been successfully transformed, and we did all of this, while consistently improving our operating margins for five years running, highlighting the leverage inherent in our operating model. This would not have been possible without the tireless effort of our highly committed and driven teams, who delivered in this complex transition.
Now before we talk about 2019 goals, let's do a quick recap of our 2018 goals. At the Analyst Day 2017 and during our Q4 2017 earnings call, we outlined a set of ambitious goals for the company in 2018, and I'm very proud that our team exceeded these goals. Our first goal in 2018 was to grow ARR by 30%-plus, and we delivered an exceptional growth number of 53%. Our second goal was to continue to expand our customer base. Last year, our customer base, again, grew by double digits, proving that we still have a large opportunity to expand our footprint and the products to win in the marketplace. Our third goal was to improve our operating profitability, which we did, while also making investments to drive growth. Our non-GAAP operating margin improved by almost 500 basis points under ASC 605.
While we feel very good about what we achieved thus far, we are not resting on our laurels and frankly, we're just getting started. With the business model and the cloud-based transition largely behind us, we're completely focused on our platform strategy to add long-term value to our customers and to have higher lifetime value for Rapid7. We have big aspirations.
Now let us turn to our three main goals for 2019. Our first goal is to continue to focus on strong ARR growth, and we are again forecasting ARR growth of 30%-plus in 2019, on top of the 53% in 2018. The end markets in which we operate are strong and we now have four engines to drive the growth of our Insight platform, they are all in different stages of maturity, with each represents a significant opportunity and together provide us with a foundation for meaningful level of long-term growth.
InsightVM remains our largest products, and we expect to be a market to grow at a healthy rate in 2019. We continue to invest in this flagship product, strengthening this offering, including remediation and automation capabilities, which highlight our innovation and clearly differentiates us from the competition. We see continued adoption within our customer base and the ability to add new customers. IDR, our second-largest product solution, continues to gain market share and we saw triple-digit ARR growth in 2018, making this our fastest-growing product. We expect strong growth for IDR in 2019.
InsightAppSec, our third pillar, continues to see strong adoption and we expect the strength to continue in 2019. Customers are challenged by the need to secure fast-growing modern applications, thriving demand. We provide one of the most comprehensive AppSec solutions to deliver continuous testing, monitoring and protection for these applications. In addition, in Q4 2018, we completed the acquisition of tCell, bringing next generation detection and response an integrated prevention capabilities to our application security portfolio.
Last but not least, InsightConnect. One of the first cloud native security orchestration, automation and response solution in the market is the glue that connects all our other products with the ability to automate SecOps task and free up scarce security resources. While the overall market is still in the early innings, we are really excited about this product and its potential.
Our second goal is to continue to make it easier for our customers to adopt to our platform and optimize our customer economics. While we are making great strides, we believe that we're just scratching the surface of the potential ARR per customer. As they adapt more products, we are seeing retention rates for our platform customers. A great example to highlight on our multiproduct next-gen platform strategies resonating with customers is our win with a large publicly traded financial institution.
This was an InsightVM customer looking to add more assets under coverage, but also within the market to replace its legacy SIEM solution. Like many organizations, they monitor a large network assets and have very limited resources. With unified it is already installed on most of their assets through our InsightVM product, InsightIDR was easy to deploy, use and maintain. With the ability to automate a significant number of security task with our InsightConnect product was a huge differentiator versus the competition and clinched the deal for us.
To reach more of this potential, we are making multi-year investments to drive higher customer loyalty and customer satisfaction. We'll be optimizing our product portfolio and packaging to drive multiproduct sales to enable our customers to adapt and consume more of our offerings, which we expect will lead to higher retention rates and higher ARR per customer.
Our goal is to remove friction for customers by making quality expansion simple and hassle-free. A customer who may currently use only InsightVM should be able to adapt all of our other products at the click of a button. We feel very confident in our ability to drive customer success and lifetime value because we have seen it in action across a growing portion of our customer base.
Our third goal is to continue to drive leverage in our business. In 2018, we saw operating leverage as the underlying economics of our business and sales model improvements, and this gives us confidence in our ability to drive growth and scale for the long term. With the investments we intend to make in 2019, we expect to obtain long-term leverage in our call structure as we gain efficiencies throughout the business. We believe we are on a path to exit 2019 profitably on a non-GAAP basis, and we will strive to improve upon this every year.
In conclusion, we have established ourselves as a high-growth cloud software company on a path to sustainable profitability. We enter 2019 as a stronger company than at any time in our history. We are operating in strong end markets and have a platform with many levers for growth, driven by solutions designed to solve key SecOps challenges.
I would like to thank all of our employees, customers and partners for their ongoing commitment to Rapid7.
With that, let me turn the call over to our CFO, Jeff Kalowski. Jeff?
Jeff Kalowski -- Chief Financial Officer
Thanks, Corey, and good afternoon, everyone. We're very pleased with our strong performance in the fourth quarter with results that exceeded guidance on all metrics. As Corey mentioned, we believe Rapid7 has established itself as a high-growth cloud software company on a path to sustainable profitability.
Before I begin discussing our strong results for the fourth quarter and full year 2018, I want to remind everyone for the last time, that as of January 1, 2018, we adopted ASC 606 on a modified retrospective basis. And therefore, we've been reporting each quarter's results in 2018 under both ASC 606 and ASC 605. We've included all of these details in our earnings press release today. When discussing our year-over-year growth rates and other key trends in our business, we will be comparing our results on an ASC 605 basis, as we don't have prior year operating results under ASC 606, and a comparison would not be meaningful.
Moving forward, all results will be under ASC 606. We set a high bar for our operational and financial goals for 2018, and we exceeded them. With four key products on our Insight platform, we now have multiple levers for growth. We successfully transitioned to a recurring revenue model with over 83% of our total revenue that was recurring in Q4 2018, up from under 70% in Q4 2017 under ASC 605. Also 94% of our product revenue was recurring in Q4 2018, up from 81% in Q4 2017, again, under ASC 605.
At the beginning of 2018, we guided for ARR growth of at least 30%, and we delivered 53% growth. We ended the year with revenue of $244 million under ASC 606, a significant beat despite a decline in services revenue. We also delivered on the high end of our operating income guidance, reporting a non-GAAP operating loss of $20 million, while investing the upside in the business to further drive long-term growth and scale. All in all, a very strong year.
Let's turn to our fourth quarter 2018 results. First, on an ASC 605 basis. Total revenue for the fourth quarter was $70.6 million, an increase of 22% year-over-year, and recurring revenue grew by 47%.
Looking at the business geographically, in Q4, North America comprised 85% of revenue, growing 21% year-over-year. Rest of world revenue increased 30% year-over-year and contributed 15% of total revenue in the fourth quarter.
Our focus on recurring revenue drove a 50% increase in our product revenue, offset by a decline in maintenance and support and services revenue. As perpetual customers migrate to the Insight platform, maintenance revenue is reclassified to product revenue.
Non-GAAP operating loss in the fourth quarter was $7.2 million, on an ASC 605 basis, an improvement compared to a loss of $7.6 million in the prior year period. Our non-GAAP operating margin improved from a loss of 13% in Q4 last year to a loss of 10% for Q4 2018. Adjusted EBITDA was a loss of $5.2 million for the fourth quarter compared to a loss of $6.3 million in the prior year period.
Now, I will discuss fourth quarter results on an ASC 606 basis. Total revenue was $68.8 million, above the high-end of our guidance. Our product revenue was once again driven by strong and broad-based ARR bookings growth across VM, IDR and application security. With a favorable shift toward ARR bookings, as expected, we experienced the slowdown in our professional services bookings.
Visibility into our revenue forecasts remains very high. Recurring revenue was 83% of total revenue and 93% of product revenue. 82% of total revenue came from deferred revenue on the balance sheet at the beginning of the quarter. The value of our annualized recurring revenue increased to $251.8 million at the end of the fourth quarter, a 53% increase year-over-year, and an acceleration from 46% growth in Q3, on top of 36% growth for the full year 2017.
Calculated billings for the fourth quarter was $94.3 million, driven by strong new ARR bookings as well as strong renewals performance. Average contract length was 16 months for total billings, down significantly from 25 months in the prior year period, and a slight decline from an average contract length of the 17 months we reported in Q3.
We once again, saw our customer shift toward one-year contracts with our move toward a subscription-based business model. As a reminder, we don't believe billings are a meaningful comparison to prior periods during this transition, as they don't capture the benefit of a higher subscription mix and growth of our annual recurring revenue.
Based on the trend over the last few quarters, we anticipate that contract lengths will remain in this range going forward.
Our customer count increased by 11% year-over-year, and we ended Q4 with more than 7,800 customers globally. Our customer growth reaccelerated, despite a decline in the number of nonrecurring services-only customers, as we saw an increase in the growth of our product customers driven by the high growth of Insight platform customers. As a result, the customer base continues to improve and in Q4, our ARR per average customer increased to over $32,000, which is up 38% year-over-year. Overall, we continue to see strong bookings from new customers, upsells and cross-sells.
Our expiring renewal rate remained at a high of 90% in the fourth quarter, and our renewal rate was 120%. This reflected the strong growth in ARR.
Turning to margins. Total non-GAAP gross margin in Q4 2018 improved sequentially, up slightly to 74%. We're benefiting from a shift toward higher-margin product revenue as well as a stabilization in our product margins as we achieve more scale on our cloud platform. Product non-GAAP gross margin was 80%, up from 79% in Q3 2018. Professional services non-GAAP gross margins decreased to 30% from 32% in Q3 2018, due to lower revenue as a result of lower services bookings with a focus on ARR and more strategic professional services.
During the fourth quarter, sales and marketing expense decreased to 45% of revenue. We've realized almost 600 basis points of leverage in sales and marketing since Q1 2018, while continuing to show meaningful growth in ARR. R&D expenses were 22% of revenue, in line with Q3. G&A expenses were 11% of revenue, higher than in Q3, reflecting higher professional fees. Our non-GAAP operating loss was $2.7 million, well ahead of our guidance of a loss of $5.5 million to $4.5 million, and our operating margin improved to negative 4% compared to a negative 4.5% in Q3 2018.
Adjusted EBITDA for the fourth quarter was a loss of $0.7 million. Non-GAAP net loss per share was $0.05 in Q4 2018, also well ahead of our guidance.
In 2018, we strengthened the balance sheet with a follow-on offering, and then a convertible notes offering. These proceeds will enable us to continue to make strategic investments to extend our growth opportunity such as the tCell acquisition, for which we paid $14.5 million in Q4 2018. We ended Q4 with cash, cash equivalents and investments of $303.7 million. This compares to $311.1 million as of Q3 2018. Our Q4 cash flow from operations was $11.9 million, which reflected strong cash collections.
Now I will summarize full year 2018 results under ASC 606. Total revenue was $244.1 million, non-GAAP operating loss was $20.4 million and non-GAAP EPS was a loss of $0.41, all beating the high-end of our most recent guidance. Adjusted EBITDA was a loss of $13.4 million.
Cash provided by operating activities was $6.1 million for the full year 2018 compared to $13.3 million in 2017. Cash flow from operations for the year was impacted by our rapid shift to subscription revenue and shorter contract lengths and a decrease in professional services bookings. However, the speed at which we transitioned to a subscription model is a strong positive for the long-term growth and profitability of our business.
Now moving onto the guidance. As you might recall during our Analyst Day at the end of 2017, we set ARR growth expectations to be 30% CAGR through 2020. We're happy to say, we achieved ARR growth of 53% in 2018 and again, expect to be growing ARR by over 30% in 2019.
For Q1 2019, we anticipate total revenue to be in the range of $68.9 million to $70.5 million. We anticipate non-GAAP operating loss to be in the range of $5.5 million to $4.5 million. We anticipate non-GAAP net loss per share for Q1 to be in the range of $0.10 to $0.08, which is based on an anticipated $47.9 million weighted average shares outstanding.
For the full year of 2019, we anticipate total revenue to be the range of $304 million to $312 million, which is 26% growth at the midpoint. We expect non-GAAP operating income to be breakeven in 2019, which is a meaningful improvement from the $20 million loss in 2018. As Corey mentioned, we'll continue to make additional investments, and we expect to invest any upside back into the business. We believe these investments will support a much larger business, delivering improved scale and sustainable levels of profitability in 2020 and beyond.
We anticipate non-GAAP net income per share to be $0.05, which is based on an anticipated 51.9 million diluted weighted average shares outstanding. The weighted average shares outstanding for the first quarter of 2019 represent basic shares outstanding given our projected non-GAAP net loss. The weighted average shares outstanding for the full year 2019 represent the diluted shares outstanding given our projected non-GAAP net income.
Non-GAAP net income for full year 2019, largely represents interest income on projected cash and investments. On a GAAP basis, we expect the full year net loss for 2019. We expect cash flow from operations to again be positive in 2019. As a reminder, removing our global headquarters and consolidating facilities this year and hence, our free cash flow will be negative as a result of significant capital improvements in 2019, but these expenditures will decline substantially in 2020.
In conclusion, this was another strong quarter and year for Rapid7 driven by significant ARR growth, shift toward the cloud and subscription revenue and realized leverage in the business.
With that, we appreciate your time and support, and we'll open the call for any questions. Operator?
Questions and Answers:
Operator
Thank you. (Operator Instructions) Our first question comes from Rob Owens of KeyBanc Capital Markets. Your line is now open.
Elizabeth Wymond Verity -- KeyBanc Capital Markets, Inc. -- Analyst
Hi. This is Liz on for Rob. Thanks for taking the question. Really nice to hear the strength in IDR this quarter. Would love to expand on what percentage of new -- the new ARR deals include multiple products versus starting with VM and expanding there? Thanks.
Corey E. Thomas -- President and Chief Executive Officer
Yes. This is Corey, so one, thank you for joining us and Jeff and I can tag team it. We didn't give a detailed breakdown of the call. I think one of the key underlying questions that I think you're getting to is that are we growing the business outside of VM? And the answer is absolutely yes, we are. One of the statistics I shared on the call is that if you look at new ARR, almost 40% of our new ARR in Q4 came outside of vulnerability management. In a quarter, by the way, where we have very healthy growth with inside of vulnerability management itself. And so from our perspective, if you think about our IDR business is being the largest driver of that business, even though all the different crock (ph) areas are performing well, we have a very, very healthy business both with VM and outside of VM.
Jeff Kalowski -- Chief Financial Officer
Yes, I'll just point out that, our platform customers grew again this quarter. And the products for customer -- for platform customers, are higher than our average, which is 1.5. Also, we have free drivers of growth. We have new customers, cross-sell and up-sell, and all three segments grew nicely this quarter and also evidenced by our 120% overall rate, renewal rate.
Elizabeth Wymond Verity -- KeyBanc Capital Markets, Inc. -- Analyst
Great. Thanks. And then just quickly would love an update on how the tCell acquisition is being incorporated? And maybe how that factors into expectations for 2020? Thanks.
Corey E. Thomas -- President and Chief Executive Officer
Yes. So when we have a great traction overall in application security with our DAS solution. As you point out, we acquired tCell at the end of last year to really position us as one of the leading cloud AppSec companies where we're actually looking at both application security testing, monitoring and in-app protection. tCell is in its incubation and inclusion to our platform stage right now. We have not built in significant contribution to our overall model for this year, as per our habit, as we actually build out new product offerings, we really focus on now and the customer use case, building a strong value proposition and demand. So you'll see that come in subsequent years, but it's not back in heavily into our expectations for this year.
Elizabeth Wymond Verity -- KeyBanc Capital Markets, Inc. -- Analyst
Great. Thanks.
Corey E. Thomas -- President and Chief Executive Officer
Thank you so much.
Operator
Thank you. Our next question comes from Saket Kalia of Barclays. Your line is now open.
Saket Kalia -- Barclays -- Analyst
Hi guys, thanks for taking my questions here. And nice finish to the year.
Corey E. Thomas -- President and Chief Executive Officer
Thank you.
Saket Kalia -- Barclays -- Analyst
Corey, maybe starting with you. It's a question I asked last quarter, but it's interesting to look at it again. Obviously, a lot to talk about, but one item that was nice to see was another quarter of 90% expiring renewal rate. And so two consecutive quarters with the nine handled renewal rate, Can you just talk about whether you think that's sustainable? And what are the drivers of that slightly improved renewal rate in your view?
Corey E. Thomas -- President and Chief Executive Officer
Yes. So I think there's a couple of drivers. So the first thing is that, we fully expect -- when you look at the underlying products line and product offerings, each and every last one of them will continue to improve their renewal rate for the foreseeable future, in my mind. And we've seen consistent performance there. Now to get your question about what the drivers are -- there's a couple of drivers. The first and I think the most important, is what's the renewal rate of each of the individual product lines? The second one is what's the mix shifts? As you can imagine, more established products have a much higher renewal rate than a product that would've just come out last year. So what's the mix shift based on maturity of product offerings. And the last one is what's the tail from our historical perpetual customers that had three-year deals into the mix there. When you look at the most important thing, which is the underlying renewal rate, we're highly confident that it is going to continue to improve. When you get to the other two, which are about really mixed related, those are things that we sort of like pay attention to after the fact, but they are not really fundamental drivers. We want all of our businesses to grow quite well, and so if one is growing at 30% and another is at 50%, we're still happy because we are actually growing and taking share in the market, but that can have slight impact on our overall renewal rate. So we really focus on the fundamental rate. And so to answer your question, the fundamental renewal rate of our products, as they come up for renewal, we see continued opportunity to improve that. The overall renewal rate is clearly going to have a lot to do with mix shift.
Saket Kalia -- Barclays -- Analyst
Got it. That's really helpful. Maybe for my follow-up for you, Jeff. Clearly, we've outperformed our expectations that we laid out here in 2018. And based on the guide that you're putting up for 2019, it seems like we're going a little bit faster as well. And so I want to bring it back to the original framework that we put out for the long-term model out to '20, open-ended question, how do we think about that framework now that we've put a bow on 2018 and put up a better-than-expected guide out for '19?
Jeff Kalowski -- Chief Financial Officer
Yes. So, Saket, yes, we are exceeding our 2020 goals. At Analyst Day, I think we laid out a $350 million ARR growth, which was a 30% CAGR and revenue at $350 million. So it's clear that those numbers have to go up and will be exceeded. Rather than give a specific number, our feeling is that we want to do is get through 2019, get more visibility and update those numbers in the second half of the year rather than giving anything specific right now. But you are correct that those numbers have to go up.
Saket Kalia -- Barclays -- Analyst
Got it. Very helpful. Congrats again, guys.
Corey E. Thomas -- President and Chief Executive Officer
Thank you.
Operator
Thank our. Oext question comes from Gur Talpaz with Stifel. Your line is now open.
Gur Talpaz -- Stifel Financial Corp. -- Analyst
Okay. Thanks for taking my question. And Corey and Jeff congrats on the quarter. First question here, really, really great ARR number, 53% growth this quarter. My question is if you look at the next year, you're striking the confidence tone here calling for 30%-plus growth again in 2019, so what gives you the confidence, as of today to kind of sort of say that, especially after kind of delivering a very, very strong into the 2018 number?
Corey E. Thomas -- President and Chief Executive Officer
So I think the first and most important thing is we actually have strong and healthy end markets. It's much easier if you have really, really strong and healthy end markets, actually for your team's performance that's actually make a difference, and we are in very, very strong end markets, and I'll say that includes every aspect of what we're doing. The second thing is that we actually have established clear customer demand. So in those stronger end markets, we actually have clear customer demand, and we're seeing increasing customer preference. And so that gives us the ability to look out and say, how do we think about our pipeline, how do we think about the opportunities that we're seeing, and how do we think about the future. And I think the third key thing (ph) and this goes to the previous question is that we've built a strong business last year, and we're seeing great health in our overall customer environment and that allows us actually have a great foundation to grow our overall customer economic as we go forward.
Gur Talpaz -- Stifel Financial Corp. -- Analyst
That's helpful. And, Corey, another one for you. You talked a bit about InsightConnect on the call itself but something you said kind of picked my interest. How do you view InsightConnect as a pull-through if you will for additional solution adoption, meaning for VM customers that may adopt InsightConnect. Is it easier for them now to go and adopt IDR and AppSec, and how do you think that as a mechanism for upsell to products outside of both Connect and VM?
Corey E. Thomas -- President and Chief Executive Officer
Yes, if you think about what our general message is around SecOps, it has several pillars, but one of them is bringing together different constituencies in the IT environment. So the IT people, the security people that DevOps people, what you're finding in most modern IT shops is it's moving from these big multi-year projects to this ongoing evolution and improvement, and we think the value of what InsightConnect's brings to the table is it delivers immediate productivity value, but it then allows people to organically expand and solve additional problems. And so if you think about the combination of InsightConnect and what we're investing in our core systems and platform to make it easier to cross-sell and up-sell, we expect problem solving to be more organic and economical for our customer, and that's the way that DevOps customers behave, that's the way application security customers behave. That's a lot of the way that customers customers increasingly want to do with, like I want to solve my problem at my pace and when I want to solve it. And InsightConnect and some of the enhancements that we're making allow that to be the case. And so yes, we do expect that as we go forward, not just this year, but more importantly, over the next several years, we'll see increasing ability for our customers to adopt multiple of our solutions and for our solutions to work tighter together and frankly for us to actually integrate with other solutions in their environment, and again, our whole purpose is how do we draw productivity for our customers and make it easier for them to do their jobs.
Gur Talpaz -- Stifel Financial Corp. -- Analyst
Very helpful. Thank you.
Operator
Thank you. And our next question comes from Matt Hedberg of RBC Capital Markets. Your line is now open.
Matthew Hedberg -- RBC Capital Markets -- Analyst
Great. Thanks, guys, and congrats on the strong quarter to end the year. Corey, you talked about strong expectation for VM or growth in 2019, that's great. I'm wondering could you help us understand and so it's hard to generalize, but just roughly speaking, what percentage of your customers network are being scanned right now? Is there sort of a ballpark figure kind of that you guys kind of seeing in an average customer?
Corey E. Thomas -- President and Chief Executive Officer
Yes. So it's tricky because we're doing a very good job of actually adding new customers, which as you think about new customers actually come in at a lower number of assets under management. And so the way to add those fluctuates. What I would say is that we've seen a steady increase. Right now, our rough estimates, it is above estimates have it on average at roughly 30% of assets under management. So we're currently being managed in our customer environment, but that's a mix of some very mature customers. And frankly, we've done tremendous -- our team has done a tremendous job of continuing to add new customers in.
Matthew Hedberg -- RBC Capital Markets -- Analyst
That's great, that's fantastic to hear. Seems like there's a lot of upside to that. And then I guess, as a follow-up, we continue to hear really good things in the channel about AppSec. I mean, obviously, IDR has been doing great, but I think AppSec continues to resonate with some of the partners that we talked to. Can you talk a little bit more about what's driving that strength? Are there higher attach rates in certain customers or maybe just a little bit more detail on kind of what you guys are seeing from AppSec?
Corey E. Thomas -- President and Chief Executive Officer
Yes, I mean, one of the things that we just love about AppSec, and there's many things that we love about is, but the most important thing is underlying fundamentals are great. People are just adding applications at an extraordinary pace and extraordinary rate. The second thing is it is -- has lagged historically, the awareness curve, which you actually have to secure those applications, but the awareness curve is catching up fast. So you have lots of applications that's been added, people increasingly aware that they need to secure those applications and we're steadily building out our application security portfolio. That's a great combination and mix. And we're actually started from a space where we have one of the best ranked DAS platform and that's the application security testing platform in the world. So we're starting from a place of strength and we're continuing to add great capabilities over time. And I think that's where you see lots of this demand and the momentum come from. The last thing I'd say is that we actually think we're very well positioned to actually become a strong leader in the overall cloud application security space, which where people are deploying apps in the future, and that's a big part of the reason why we bought tCell and making lots of investments in that general area.
Matthew Hedberg -- RBC Capital Markets -- Analyst
Super helpful. Thanks, guys. Congrats again.
Corey E. Thomas -- President and Chief Executive Officer
Thank you.
Operator
Thank you. And our next question comes from Michael Turits of Raymond James. Your line is now open.
Michael Turits -- Raymond James -- Analyst
Hey, guys. Good evening, of course, very strong performance you've got. First of all, can you drill down a little bit more on InsightIDR in terms of who you're competing with, who you see and where you're winning? And I would assume that you're growing faster your percentage with new ARR than the rest of the business, I just wanted to check?
Corey E. Thomas -- President and Chief Executive Officer
Yes, so Jeff and I will tag team it. So I'll talk about the qualitative and Jeff can talk about some of the growth dynamics are there. Qualitatively, we did a big innovation with InsightIDR, and our overall goal was to disrupt the sim market by making it much more easy, much more approachable and really drop productivity and efficacy of the ability to detect and respond to attacks. The obvious first place, if you look back a couple of years for that value proposition resonated was, of course, in the midsize enterprise, and we've actually continue to have great traction there. What we're seeing is that like as happened with VM and as happened in our broader market is that steadily consistently expanded and now, we're actually managing quite a number of actually, very large and complex customers. And so we expect future growth to happen both in the midsize enterprise space and the large enterprise space, and we're seeing a significant evidence of that, especially if you look at the last quarter and the last year that we actually have, which has been a steady increase in that area.
Jeff Kalowski -- Chief Financial Officer
Yes. So Michael, we have reported IDR growth as being triple-digit in the past, and it continued to grow triple digits on ARR year-over-year.
Michael Turits -- Raymond James -- Analyst
And then, if I can just get a follow-up on that on the investment side. You're going to be breakeven, you say for next year. Can you talk about where -- prioritize where the incremental investments are that keep you at that level high right now?
Corey E. Thomas -- President and Chief Executive Officer
Yes. So I mean, to take a step back, the primary data we're actually focused on is we've come to the hard parts of the cloud SaaS migration. We think we have the opportunity to be a high-growth and profitable cloud SaaS security company. And so where we really focus our investments on are continuing to actually focus on the customer experience, which will actually make our customer economics better and better, which will drive profitability over time. So simply there are three areas that we're focused on. The first one is systems investments that allow us to more seamlessly have customers' cross-sell and up-sell. We want them to get our technology when they want it and when they need it. And the real benefit of this is that it provides more flexibility for the customer, giving them a better experience, and it will lower our overall costs of sale into the future, that's a great overall investment that actually drives growth and profitability in the future. Similarly, we actually are investing in the overall customer engagement and customer management. The way to think about that is that makes it easier for customers to achieve outcomes and be successful. And by focusing on systems and processes around that, it allows us to address a much larger customer base and have better outcomes in that customer base at a lower cost that we've experienced in the past. And then the last thing we're focusing on is the pricing and packaging ecosystem at the systems level. We're continuing to grow geographically around the world, we're continuing to grow through the channel, both specific channel partners and the range and types of channel partners and we're just selling lots of products to customers. What we want to enable is every customers can get the product that they want, at the time they wanted, at a price point that's compelling for them to expand and grow in the business. We look at those overall investments is really maximizing our customer economics and our ARR per customer and our customer lifetime value that allow us to maintain the momentum that we have of actually growing quite well by continuing to improve profitability.
Michael Turits -- Raymond James -- Analyst
Thank you so much.
Operator
Thank you. Our next question comes from Jonathan Ho of William Blair. Your line is now open.
Jonathan Ho -- William Blair & Company -- Analyst
Hi, good afternoon. I just wanted to start with sort of the non-VM products and whether or not you're just trying to see them as serve as entry points to win new customers, or is this primarily still sort of add-on to existing VM customers as part of that cross-sell and up-sell motion?
Corey E. Thomas -- President and Chief Executive Officer
It's a great question. What I'll say is IDR has always been a entry point. Early on, even IDR was sort of like half entry point to the new customers and half of them installed base. I would say, right now, all of our products actually effectively serve with entry points into new customers, at a slightly different rates, but all of our products whether there's is AppSec, security orchestration automation, which we recently introduced SGA or IDR, they all service, many have so actually acquiring new customers. And the nice thing is that we're starting to see momentum where we're going with the IDR customer and add VM or we'll go in with an AppSec customer and add VM or IDR. And so it's a very, very effective overall customer adoption strategy for us, which is why we have lots of visibility and confidence in our model to actually continue to expand ARR per customer.
Jonathan Ho -- William Blair & Company -- Analyst
Got it. And just given some of the uncertainty out there in the global macro, whether it's from the fed or from various regions like Brexit, I mean, are you as concerned at all about any of that noise maybe filtering down to either security spend or your areas of the market?
Corey E. Thomas -- President and Chief Executive Officer
I mean, you all will be much more experts on the globe. I can tell you what we see and we pay attention to it tightly because we know how economics work and that's being scareful (ph) to down at the time. What we see right now is a recognition that there is broad demand for security, and for the SecOps offerings that we actually have. So all customers, we're going to have budget today or whether they're trying to get budget, recognize that there's a strong need out there. And the second thing that we see is that right now, people are actually funding or finding ways to actually fund that need. So it's a fairly healthy environment now. What I would say is that we are lucky to be in a space where people see this as a need. So even for organizations that may be budget constrained, they're saying, how do I get to this over time, which is exactly -- I've been doing this for a while, that's exactly the kind of space you want to be in is what people are finding ways to actually fund your solutions over time because they had value.
Jonathan Ho -- William Blair & Company -- Analyst
Excellent. Congrats on the strong quarter.
Corey E. Thomas -- President and Chief Executive Officer
Thank you very much.
Operator
Thank you. Our next question comes from Alex Henderson of Needham and Company. Your line is now open.
Daniel J. Park -- Needham & Company -- Analyst
Hey, guys. Good afternoon. This is actually Dan Park on for Alex. Thanks for taking my question. So I know it's still early innings, but could you maybe provide an update on the automation and orchestration features, implementing within inside VM and IDR, and if this is starting to drive some additional customer interest?
Jonathan Ho -- William Blair & Company -- Analyst
Yes. So the -- for those of you who may recall, our InsightConnect, which is the evolution of demand, really had two primary strategic benefits for us. One is actually establishing a new market that was a value add. The second benefit was a differentiated, significantly our existing solutions, specifically inside VM and InsightIDR. And third, it actually made our products a lot more sticky for customers. I mean, those are three really big things. So I'll talk about each of those in turn. And so one, we have launched Insight -- we have launched InsightConnect, and we're seeing good momentum pipeline, via adoptions early, but we're seeing healthy ASPs and good adoption, and we're very optimistic about the future even though it's still in a very, very early innings. The second, it has been a clear differentiator for both InsightVM and InsightIDR because these are two areas where people are just under-resourced and under-constrained. We've had many conversations with customers about how can I go beyond 30% of my environment for assets under management with VM, but I don't have the resources or the capability to manage the vulnerabilities and the threats I actually have today. What it turns out, that you can actually automate more of that, the customer is happy and then they actually take on the next stuff in the environment and that can move to 40% or 50%. The value proposition is resonating quite well overall. Likewise, with InsightIDR, the whole focus that we continue to evolve and continue to add capability to is how do I make it fast just to investigate things, and how do I make it faster to respond and immediate things. We're seeing very, very strong demand in the InsightIDR space, and it is a meaningful differentiator, increasingly of why we win. The nice thing that we expect, and it's still early just because when we released it, is that for each of these capabilities, for the customers that we've seen will deploy these capabilities, it actually is extraordinarily sticky in their environment, far better it used to reflect in the fact that our platform customers have a much higher renewal rate, but we make that our platform increasingly is a much, much more sticky proposition than the offerings that existing with sim VM market a couple of years ago.
Daniel J. Park -- Needham & Company -- Analyst
Okay, great. Thanks so much for the color.
Corey E. Thomas -- President and Chief Executive Officer
Thank you.
Operator
Thank you. (Operator Instructions) Our next question comes from Lisa Franchi of Morgan Stanley. Your line is now open.
Melissa Franchi -- Morgan Stanley -- Analyst
Great. Thank you for taking my question. Corey, you talked about being underpenetrated into your customer base. I'm wondering to what extent you're starting to see customers extend vulnerability management or InsightVM into maybe more what's called modern ITF, it's like IoT OT? And do you feel like you have the technology today to well address those use cases?
Corey E. Thomas -- President and Chief Executive Officer
Yes. So one, we actually have a wide deviation customers who come in. We do a great job of adding new customers. So customers who come in, come in with a lower rate. What we also find is that customers expand and can expand to a very high rate. So we're seeing high levels of penetration in customers that have been with us for a while and of course, customers coming lower. We also see great adoption across the landscape. So customers priorities is we actually see them are, their core network data center assets, their end points, their applications, then the rest of their environment and that includes the IoT environment. We're actually excessively focused on actually operating in a way that actually customer see. So what we see adoption today in and where we have great products that deliver on today is that, one, we feel the way the strongest solution for actually covering core infrastructure. Two, we actually feel that we have the strongest solution, we're actually covering cloud environments, and we see great uptick and greater adoption in overall cloud environments. Three, applications are where the gain is in the future, it's strategic, it's important, is what we were exposed. We have of the traditional VM competitors, the most mature and advanced operating and application security, and we're there. And in the IoT space, we have coverage today, and we're actually in the process of having -- and the process of continuing to expand our efforts to look at IOT and OT.
Melissa Franchi -- Morgan Stanley -- Analyst
Okay, got it. That's helpful. And then just as a follow-up, you've talked about you're focusing on resource constrained enterprises, but it seems like you're also having some traction in large enterprises as well. Can you maybe talk about what sort of adoption you're seeing in larger enterprises? And to what extent are you investing in that opportunity versus this -- that opportunities are coming to you?
Corey E. Thomas -- President and Chief Executive Officer
Yes. So first and foremost, we're actually seeing a significant traction. We still have roughly 40% of the Fortune 100. We have some great brands that actually have enterprisewide coverage, that a large enterprise across all sectors, frankly, whether you look at sort of like the finance sector, the technology sector, where we have an amazing footprint, the oil and gas industry. So we actually have the track that and has been growing steadily over time. The marquee in that segment, which is continue to get more and more enterprise adoption and of course, our InsightVM solution, and we're seeing rapid adoption right now with the InsightIDR. And oddly enough, InsightConnect is actually started in different parts of market. And in the last area is our application security offering, which frankly, started off with a heavier enterprise bias than any of our other offering. So we actually have traction and momentum across the enterprise segment. To your question about the sort of the focus, from a products perspective, we have been and we are always focused on actually ensuring that all of our customers are successful, and we'll continue to make sure that we're meeting the needs and exceeding the needs of the large enterprise as well as the midsize enterprise customers. Now when we introduce new offerings, we always, just like anyone who's actually really good at something like building our product up, is just start with the target customer, we get successful with recurring customer and then you expand. And we're extraordinarily disciplined about that because that what allows you to build a sustainable long-term business. We're at the stage now with InsightIDR where we have a great core customer and now we're rapidly expanding that customer and we're adding capability, and that's working out quite well.
Melissa Franchi -- Morgan Stanley -- Analyst
Helpful. Thank you very much.
Corey E. Thomas -- President and Chief Executive Officer
Thank you.
Operator
Thank you. And Ladies and gentlemen, this does conclude our question-and-answer session. Thank you for participating in today's conference. This concludes today's program. You may all disconnect. Everyone, have a great day.
Duration: 53 minutes
Call participants:
Neeraj Mahajan -- Vice President, Investor Relations
Corey E. Thomas -- President and Chief Executive Officer
Jeff Kalowski -- Chief Financial Officer
Elizabeth Wymond Verity -- KeyBanc Capital Markets, Inc. -- Analyst
Saket Kalia -- Barclays -- Analyst
Gur Talpaz -- Stifel Financial Corp. -- Analyst
Matthew Hedberg -- RBC Capital Markets -- Analyst
Michael Turits -- Raymond James -- Analyst
Jonathan Ho -- William Blair & Company -- Analyst
Daniel J. Park -- Needham & Company -- Analyst
Melissa Franchi -- Morgan Stanley -- Analyst
Transcript powered by AlphaStreet
This article is a transcript of this conference call produced for The Motley Fool. While we strive for our Foolish Best, there may be errors, omissions, or inaccuracies in this transcript. As with all our articles, The Motley Fool does not assume any responsibility for your use of this content, and we strongly encourage you to do your own research, including listening to the call yourself and reading the company's SEC filings. Please see our Terms and Conditions for additional details, including our Obligatory Capitalized Disclaimers of Liability.
More From The Motley Fool
Motley Fool Transcribers has no position in any of the stocks mentioned. The Motley Fool has no position in any of the stocks mentioned. The Motley Fool has a disclosure policy.
