Rapid7, Inc. (RPD) Earnings Call Transcript

All right. Good afternoon, everyone. Thank you for joining us. My name is Brian Essex. I'm a JPMorgan security software analyst. And with us today, we have Andrew Burton, Chief Operating Officer of Rapid7, and Elizabeth Chwalk from IR. You don't have to say anything, do you? No prepared remarks?

No, no. Go ahead.

All right. Great. Great. Well, thank you for joining us.

Thanks for having us.

We really appreciate it. Maybe we could start off with a brief overview of -- for those that maybe aren't intimately familiar with Rapid7, the evolution of the company, you see like pure-play VM and then you expand it into other markets. So maybe little bit of a background to lead into some of these other questions that I have for you.

Yes, no problem. So we started out largely with this key insight around the underserved or mainstream enterprise opportunity for cybersecurity people that were looking for visibility into their environment about where vulnerabilities might exist was largely been characterized as the vulnerability management segment. And in that -- those early years and largely up through the IPO back in 2015, we were largely a VM provider to this kind of mainstream enterprise buyer. And what we heard from these buyers is it was great to give them visibility where they were really easy to use, affordable kind of quickly consumable product. But that -- as we give them visibility into where they had exposures, they needed to also understand where those exposures being exploited, where they being actively breached or whether instance that could occur. And so our second chapter of the company was really expanding out what we think of as our security operations offering which was largely around the extended SOC and this idea of the SIEM being inverted to be more detection-based and we've built out a pretty substantial piece of our business that is now growing over $300 million, over 20%. And that was in this proposition of helping security teams, again, mainstream enterprise to understand what's going on in their environment and be able to monitor and detect if malicious activity is occurring or could occur, how to take proactive steps, right? And now what we're doing is largely bringing this consolidated and integrated view to security teams, again, mainstream enterprise, where we can give people visibility across their attack surface and better visibility leads to better monitoring and detection, which also then allows their security teams to achieve better outcomes. So the history of the company is from originally this VM company around understanding exposures to an integrated SecOps company around understanding exposures plus active monitoring and prevention to now a consolidator for the mainstream enterprise around really delivering better security outcomes around these problems.

Right. And what about on the cloud side of the business and how that maybe evolved as well?

Yes, it was interesting. The cloud is, I think, as folks -- hindsight is 2020, but at the time, what we saw and everyone has seen now is clearly the emergence of public cloud and cloud environments. And not one, but multiple clouds. And so these mainstream enterprise companies have -- nowadays, it's obvious. They have a multi-cloud environment, right? And so as the cloud emerged, a lot of our customers say, well, it's important for us to have the policies, controls and assessments in place for the cloud. Now at the time, there's a lot of active debate is who would own cloud security and would that be separate teams or would that be 1 of the teams we're already working with. And so the early years, we were building out dedicated cloud security capabilities and it's in a dedicated offering, right? What we have seen is really a more integrated approach that security teams, mainstream enterprise, not high end or cloud-native organizations. But when we think about mainstream enterprise I think about it as the Russell 3 or in 3/4 of the rest -- of the Fortune 5. So it's folks that have a security team but they're not the super rich or the super well funded. There are people that are often outside of financial services or maybe outside of 1 of the core tech-enabled spaces, right? And so what we saw was the security team that was being asked to cover the fuller environment, not just traditional workloads, but cloud workloads. And what we've seen is those -- as the cloud has matured, and has become really a core part now. It seems obvious now, but as we see now as the cloud is a core part of an organization's infrastructure, security now is responsible for securing the entire environment. They still have to work with IT and DevOps and cloud ops teams but they're ultimately responsible to both the Board and the CEOs and the CFOs to have a good security program. And so we have gone on this journey. We had a dedicated cloud offering, but now we have brought that into our broader SecOps and integrated SecOps software.

Got it. And you've done few acquisitions to kind of get to that point, too. I mean what have you kind of acquired versus built organically? And how has this all been assembled on the platform?

Yes, it's -- so back when -- so we had an organic effort around our traditional VM base of helping people assess their workloads. And what we saw at the time is we had an opportunity to accelerate our development efforts. So we acquired a company called Divi Cloud, which was the cloud security posture management, right? And that was -- at the time, that was the core thesis of having the policies and controls around your cloud workloads and not just 1 cloud but multiple clouds. And what became apparent and again, in hindsight 2020, is that people also wanted to assess vulnerabilities in the cloud environments. And so we augmented some organic work we were doing with also buying a company called Alcide which is an Israeli company. And our belief was that these separate cloud capabilities would combine and consolidate into a singular set of cloud security offer, right? Now it seems pretty obvious, but emergent technology often comes out in point solutions and then it evolves into being a more consolidated integrated offer. So we've seen workload assessment and workload protection, consolidate with policy management, entitlement and event management coming together. And I think now we're seeing it really expand or integrated into the broader security program. And so one of the things that we're focused on is making better security in the cloud, but also across the attack surface is more accessible to mainstream enterprise.

Got it. And I guess if we think about some of the peers in your space, a few of them originated from some of the same kind of vulnerability management focus and they branched into certain different directions compared to where Rapid7 has gone, how do we think about the way peers have evolved versus the way that you evolved? And how would you characterize your business in terms of a point of differentiation with regard to maybe some of the 2 VM peers that people will naturally compare you to?

It's a great question. I'd say one of the most kind of most significant distinctions was our belief that you would need to be actively monitoring and detecting things in the environment. That's in addition to telling you is there risky -- are you exposed? Or do you have risky exposures, right? So when we -- largely the SIEM market, when we created a -- I think, we've got the first, one of the first to build a cloud-based SIEM. But we built it to do detections at its core, right? And so the original VM players all took different paths, but our probably, we were unique in that we said, "Hey, you know what, it's really going to be important is that these environments are going to continue to expand they're going to become more dynamic and they're going to become more diverse, and you will need a detection first or detection-based security program at the core, right?" And so we built that out. And I think we've had quite a bit of success doing that. But that was probably one of the first and probably one of the biggest distinctions. Now we still believe visibility is important, assessing your environment, understanding what your security posture is, where ones are. We still believe that's very important, but it's part of a broader proposition. And so I think there's been debates between the different VM companies about is visibility and assessment in and of itself, the market or is it part of a bigger proposition. And we have argued that it's important, but it's part of a bigger proposition.

How do you think about some of the larger vendors getting into VM? I mean you have some of these larger platform vendors and they'll say, "Well, we look at some vulnerabilities management and cloud or whatever?"

Yes, Elizabeth and I were discussing this earlier. So you see like 2 notable names, right? Microsoft and CrowdStrike are talking about vulnerabilities -- vulnerability management, it's been part of their security offerings. And I think this largely validates 2 things. One, it's hard to do, right? This is not something anybody can do. I mean CrowdStrike and Microsoft are quite significant security players. They have a massive amount of resources, and it requires expertise. But two is, it isn't something in and of itself that is a stand-alone business, right? I think when you look at what the vendors, including us ourselves are saying is, if you look at Microsoft and it's visibility across your attack surface is important, right? And understanding potential vulnerabilities or misconfigurations is the first step. And I think it actually validates our strategy to say, this is important, but it's part of a broader proposition. So if I would worry as if no one -- if people were saying it wasn't important, right? So the fact that you have multiple vendors saying it's important, I think, recognize. Now the question is, how does it fit into a broader strategy, right? And I think our point of view is that visibility leads to better monitoring and better detection. And so it's the entree or the first step into a better security program. But we are very clear. It's a step. It's an entree. It's not the main event.

Got it. And then maybe taking a step back and looking at recent events with company performance. You recently changed your posture around investing in growth, shifting focus towards margins and the cash flow, announcing a reduction in force last year? And maybe if you could frame out the thought process behind that shift and how it's evolved since?

Yes. Yes, I'll frame it as a couple of steps, right? So last summer, we looked at our business, and we felt like we had really done a nice job around our MDR or Managed Detection Response business of consolidating multiple capabilities. We had log analytics. We had endpoint protection, we had network detection, we had UBA. We consolidate a lot of capabilities into a singular integrated offering. And that is, as I say, is a very healthy piece of our business, right? And when we looked at that, we said, look, this is a really a strategic bet for us. And we looked at how the company was set up, how it was -- where the investments were occurring. And we found that we needed to make some structural changes to the business to help us better align to where we were building things how we were going to market and we really decided to introduce a couple of things. One, integrated consolidation offerings, right? So similar to our MDR, we said, look, we're going to offer and capture more ARR per customer. So we wanted to build out our offerings in a way that they were integrated but could offer customers more value for their dollar, right? And the macro had changed at this point and people began to really think about how to maximize their security investments because security is still #1 in the spend of IT spend, but it's not immune to these macro environments, right? So we looked at it and said, "Look, we've got to take advantage of more offshore development. We're going to take advantage of aligning our investments and our people to the strategy." And so we did do a reduction and a restructure, right? Now that set us up for an efficient growth model. The balance between free cash flow and growth. And so we said we would double free cash flow from $80 million to $160 million and we now have a $160 million number that's out there for this year, right, and we feel very good about. But it began to really set up efficient growth. So the first step was, are you organized for success and do you have the strategy to execute. That's why I think about last summer. Then we had been piloting these consolidation offerings. And our MDR offering, again, growing quite well, having quite a bit of success. We continue to really focus our go-to-market efforts and our sales and product efforts around that. As we entered this year, the visibility side of the equation, the ability to consolidate integrated visibility across the attack surface, what we call CRC was our traditional VM business in our cloud security business. And we said, look, we're going to integrate this as well. And when we set guidance last quarter, one of the things that we had assumed was that the rate so we saw an uplift of security and some cloud security and BM spend in Q4. And we assume that, that would continue this year. And what we saw was actually the depth of integration needed -- was going to be planned for this summer and that we needed to introduce, there was some price dislocation in the market. And so we felt like this to drive CRC, we needed to make these changes, but the rate of purchasing and the rate of spend around vulnerability management and our cloud offerings, went down as we were working on this new offering. And there's a couple of reasons why, but that's what led us to take a step back and basically say, "Hey, we want to reset our outlooks." Still have free cash flow, right? So our profit and free cash flow is unchanged. But we said, "Look, we want to adjust our guide, so we can do this investment in building this new consolidated offering." And we have shared or provided an outlook that has basically has very minimal contribution of our CRC offering, and we continue to really expect no change in the macro, but our MDR/MTC offering will continue to maintain its current healthy pace.

How do we think about that kind of like dip in CRC adoption?

Yes. I think it was a couple fold. I think 1 in the mainstream enterprise, if you were born in the cloud, or a cloud-dominant organization, cloud security has been very important, right? Our buyer is this mainstream enterprise where it's a hybrid environment. They have a mix environments. And so what we're seeing is they're largely being locked out of participating because it's a premium purchase. And so what we've heard from a lot of CISOs is, look, I need to protect my environment, but I can't narrow that coverage. So if you charge me more in one part of the environment and my budgets are fixed, which they largely are constrained, I have to narrow my coverage. And we feel like that's a false choice. And so what we've seen is the need to lower the price points on cloud security and have more of an integrated offering requires us to both lower the price point on the cloud security capabilities, but then also expand coverage, so you can do 100% coverage. The thing I would share is we did this once before with D&R, where people used to charge for data. They're like, "Oh, you just want -- and security teams are like, "Well, I can't pay for all the data, so I'm going to constrain what I collect," and that was a false choice. And so we see that once again in the attack surface side of the equation where people are saying, well, if I pay these market rates on cloud or I pay a lower rate in year 1 and someone tries to charge me more in year 2, that's forcing me to narrow my coverage. And what we want to do is lower the price points to participate in cloud security, but then also expand coverage to provide integrated visibility across the attack surface. And so the CRC repackage or relaunch is going to include both integrated capability with a lower effective price point that's offset with broader coverage, if that makes sense. And that's really what I think that will unlock, I think 1 of 2 things, the existing VM customer who wants to expand that coverage, that's a win and the ability for more people to participate in covering their full attack surface, if that makes sense.

Yes. Yes, it does. And so when do you anticipate you'll be able to have there, like fully integrated CRC in the market? And what do you do in the interim?

So we still have some nominal participation of the customers. It's the consolidated offering that we're really focusing on. So there are 2 things. We've told -- we've communicated that it will be this summer. We'll have the new integrated offering, what we call V2. And to be clear, it's an acceleration strategy versus something new because we have this first version that was well received people just say, "I need 2 things. I need them be more accessible to me at my budgets, and I need some -- an integrated approach I call an integrated attack -- we call an integrated attack path mapping, which is a fancy way of saying, I need the map laterally across the environment just within a given silo.

Okay. Got it. And as you mentioned, you gave I guess, cash flow guidance, I think $160 million this year, it's doubling over last year. How do you manage throttling investment in growth versus profitability? And as you prioritize one versus the other, what are the levers that you'll pull to invest more in growth?

Yes. So one, I think we've got this question today, actually quite a bit around how do you feel about your sales and marketing investments for growth. And I'd say we feel very good and we have -- we feel like we have capacity available to continue. Part of the reason we took down our guide was to create space for us to deliver the integrated offering and to do the repackaging and repricing, right? And so I think we feel like we have a lot of -- we have a ton of confidence in the $160 million of free cash flow. We have capacity in our go-to-market engine, right? And our investments are being actually directed at driving the core foundational work of pricing, packaging and some of the integrated work, right? So I don't think of it as a throttling perspective. I think it is have we invested the right level to basically drive efficient growth and do we have that balance between growth and profitability. And the macro, our assumption, by the way, we've gotten this question as well today is the macro. We do not believe it changes. We believe it continues to be a constrained environment, and that's something that's been going on for several quarters and we've talked about that as such. So deal inspection is high level of CEO, CFO board-level involvement is quite high. Large deal cycles are taking some time, but that's just something that we've been managing in the last couple of quarters.

So you don't feel as though your focus on margins and cash flows constraining your growth all it's more of a demand issue?