Good day, and thank you for standing by. Welcome to the Rapid7 fourth quarter and full year 2021 earnings conference call. At this time, all participants are in a listen-only mode. After the speaker's presentation, there will be a question-and-answer session. To ask a question during this session, you will need to press star one on your telephone. Please be advised today's conference is being recorded. If you require any further assistance, please press star then zero. I would now like to hand the conference over to your host today, Sunil Shah, Vice President, Investor Relations. Please go ahead.
Thank you, operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's fourth quarter and full year 2021 financial and operating results, in addition to our financial outlook for the first quarter and full fiscal year 2022. With me on the call today are Corey Thomas, our CEO, and Tim Adams, our CFO. We have distributed our earnings press release over the wire, and it is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast, and following the call, an audio replay will be available at investors.rapid7.com until February 16th, 2022. During this call, we may make statements related to our business that are forward-looking under federal securities laws.
These statements are made pursuant to the Safe Harbor Provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to the company's positioning or future goals and financial guidance for the first quarter and full year 2022, and the assumptions underlying such goals and guidance. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the expectations contained in these statements due to a number of risks and uncertainties, including those contained in our most recent quarterly report on Form 10-Q and in the subsequent reports that we file with the SEC. The information provided on this conference call should be considered in light of such risks.
Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by applicable law. Our commentary today will be primarily in non-GAAP terms, and reconciliations between our historical GAAP and non-GAAP results and guidance can be found in today's earnings press release. At times, in our prepared comments or in response to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be one-time in nature, and we may or may not provide an update in the future on these metrics.
With that, I'd like to turn the call over to our CEO, Corey Thomas.
Thank you, Sunil, and good afternoon to everyone on today's call. Thank you for joining us. Rapid7 finished 2021 on a high note, delivering strong fourth quarter results on broad-based strength across our security transformation and vulnerability management solutions. Security transformation saw year-over-year organic ARR growth of over 50%, exceeding our expectations for the quarter and the year, driven by our team's strong execution and the growing need for customers to manage increasingly complex security environments. We ended the year with $599 million of ARR, growth of 38% over the prior year, and growth of over 30% on an organic basis. These growth rates highlight the compelling value proposition our Insight Platform is delivering to our customers and support our belief that 2022 will be another strong year for Rapid7.
Our commitment to executing on our growth and profitability framework is evident in today's results. We delivered nearly 100 basis points of non-GAAP operating margin expansion for the year while accelerating ARR growth and absorbing our largest ever acquisition to date. We also saw significant scale in cash flow, exceeding $50 million of operating cash flow in 2021, and delivering $35 million of free cash flow for the year, ahead of expectations. This puts us on a great trajectory to execute against our mid and long-term free cash flow targets. While Tim will share more on our operating results during his prepared remarks, these financial highlights illustrate the strength of our underlying business and our commitment to making responsible investments in growth.
We began last year with our three enduring goals in mind: to enable customers to securely transition to the cloud, to expand the capabilities and value proposition of our best-in-class Insight Platform, and to balance our dual mandate of scaling profitably while strategically investing to drive durable growth. In March, we expanded on this vision at our Investor Day, where we outlined our medium- to long-term financial goals and elaborated on a few key opportunities, including the large and expanding addressable market for our solutions, our ability to grow ARR per customer by cross-selling and upselling into our base, focusing on higher growth strategic customers to support this expansion, and an under-penetrated international market with significant room for share gains. During 2021, we executed exceedingly well across all of these opportunities. We accelerated ARR growth while expanding our addressable market beyond $30 billion.
ARR per customer grew 17% for the year, approaching $60,000 per customer. Customer growth accelerated, driven by increased demand and notable improvements in retention as we eclipsed 10,000 customers globally. We saw approximately 50% year-over-year growth in our international revenue. Moreover, the escalating cyber threat landscape we experienced throughout the year validates the durability of these opportunities as customers transform their business, cloud adoption gains pace, and the ability to manage cybersecurity risk becomes even more challenging. These issues are now a top priority for executives and boards, particularly as the labor market for security professionals tightens and regulatory scrutiny and brand risk increase. These market conditions provided a healthy secular backdrop for our strong growth in 2021 and should support durable ongoing growth in 2022. I highlight three areas that are driving our success today.
First, our Insight Platform provides customers with a broad-based integrated suite of best-in-class security operations solutions. We've invested in and expanded our capabilities over the last few years to build a leading position in the extended detection and response, cloud security, and vulnerability risk management markets. We further strengthened our customer value proposition by adding platform services, including SOAR and threat intelligence, to provide security teams with comprehensive visibility, analytics, and orchestration that they need to manage an evolving IT environment. The depth and breadth of our platform is increasingly becoming a competitive differentiator. It's driving demand with our customers, particularly as security teams look to consolidate an increasingly fragmented set of security solutions. This is demonstrated by the strong growth we saw across our Insight Platform throughout 2021, with particular strength driven by our security transformation solutions, which now represents the majority of our total ARR.
We see a long runway ahead in terms of our platform opportunity as we expand our base of multi-product platform customers. The recent Log4Shell vulnerability highlights the value of holistic visibility and monitoring our Insight Platform can provide in helping customers to drive better security outcomes. Beyond the critical importance of InsightVM in providing visibility to the risk in customers' traditional environments, customers are leveraging InsightCloudSec to identify vulnerable cloud instances, InsightIDR to monitor for attacker behavior related to Log4Shell, our application security capabilities to both monitor and block against attack attempts, and Velociraptor for forensics analysis of exploitation attempts against the vulnerability. The scope of incidents like Log4Shell demonstrates the persistent nature of the elevated threat landscape our customers are facing today, and why we expect cybersecurity will remain top of mind for organizations of all sizes as we look ahead.
The second aspect of our business I want to highlight is our market-leading incident detection and response offering. As the topic of XDR gains mindshare, many of you have asked how Rapid7 InsightIDR is delivering customer impact in this area. The answer is that we've always approached IDR from this perspective. When we began building IDR in 2013, most people were focused solely on data collection. Rapid7 took a detection-first approach, hence the name Incident Detection and Response. By combining leading data collection capabilities on our Insight Platform with detections from our analysis of attacker behavior and layering on user behavior analysis, file integrity monitoring, and compliance dashboards, we were able to build not just a market-leading SIEM, but also a market-disrupting capability to detect and respond to attacks more effectively.
We have since extended the breadth and depth of our offering, adding rich capabilities, including endpoint detection and forensics and network traffic analysis to provide more comprehensive visibility across customer environments, as well as embedding automation to drive productivity to help customers deliver better security outcomes. Our investments in natively integrating these capabilities into InsightIDR, which is why customers are choosing InsightIDR to help minimize the seams and gaps that exist in their fragmented technology environments today. We continue to invest in extending our platform capabilities, most recently via the addition of IntSights' best-in-class threat intelligence offering. We remain early on our integration efforts, but have begun to see the vision of combined internal and external attack surface monitoring resonate with our customers.
During the fourth quarter, we saw great progress on our ability to sell IntSights into our existing customer base, with nearly 40% of our new threat intelligence business driven by cross-sell. A great example of this was a six-figure competitive displacement with a well-known global food and beverage brand. The customer added Threat Command alongside our detection and response and vulnerability management solutions, in part because of the enterprise-relevant alerts and the ability to automate workflows to improve the efficiency and effectiveness of their SOC. We remain bullish on our long-term opportunity to deliver a market-leading XDR solution to our customers as we continue to integrate threat intelligence into IDR. Lastly, I'd like to take a moment to discuss the emergence of our cloud-native security platform, InsightCloudSec. Digital transformation and the accelerating customer shift to cloud-based infrastructure is disrupting security programs.
Cloud environments are more dynamic and scale at a different pace than traditional IT environments. This is why security teams are increasingly looking for solutions that are built from the ground up to manage the unique risk in their cloud environments. While the cloud security market remains in its early days, it is clear to us that success in securing the cloud relies on holistic data collection, analytics, and automation, all capabilities that are core to Rapid7's DNA. This is how we have architected InsightCloudSec, by integrating three critical areas of technology to bring together multi-cloud data for rich visibility and analysis across cloud posture management, cloud workload protection, and cloud identity and entitlement management. We continue to innovate and invest heavily in this space, given the massive opportunity ahead to help our customers migrate securely to the cloud.
Our approach is resonating with customers, as evidenced by a competitive six-figure deal with a Fortune 500 company. The customer's homegrown approach to securing and growing multi-cloud environments was struggling to scale with the pace of their cloud development. They selected InsightCloudSec for our scalable automation, seamless integration with InsightVM, and our public cloud provider coverage that few competitors can match. Our swift time to value and out-of-the-box capabilities provided tangible benefits for the customer, allowing InsightCloudSec to become, in their words, a cornerstone of their security program. As we look across all three of these areas, we expect that many of the market dynamics we experienced in 2021 will continue to intensify in 2022. The attacker landscape continues to become more hostile and the pace of innovation, particularly the move to the cloud, is accelerating and the security gap is getting wider.
It is clear that security now has a permanent seat at the table in executive and board discussions, and we expect this to fuel durable growth for our best-of-suite Insight Platform as we look ahead to 2022. These dynamics are also impacted by the increased turnover many companies are facing in today's labor market, exacerbating what has already been a tight talent environment for cybersecurity professionals. Rapid7's sustained focus on addressing the needs of resource-constrained customers by delivering best-in-class productivity and efficacy of security programs while lowering the cost of operations positions us well to drive strong customer impact through our Insight Platform in this environment. We march forward into 2022, we remain committed to executing against our three enduring goals for Rapid7, enhancing our customers' ability to securely transition to the cloud, building out an increasingly integrated best-of-suite platform experience, and drive and sustain profitability growth.
We believe that secular tailwinds in security and the evolving IT environment put us in a great position to execute on these goals in 2022, and we're confident that we have the right technology and people to drive another year of durable growth. Our team remains committed to delivering on our 2025 goal of becoming a $1 billion Rule of 40 company, and we see great line of sight to achieving that given our strong execution in 2021. Amidst an ever-escalating cyber threat landscape, I am tremendously grateful to all of the security professionals around the world who work tirelessly to keep our technology environment safe. The Log4Shell vulnerability strained security teams at the end of an already busy year, and I'm proud of our Rapid7 team for their commitment to supporting our customers during the ongoing remediation efforts.
We know that the threat environment will continue to escalate, impacting organizations of all sizes, and that gives us conviction in the importance of our mission to make the best in security operations achievable to all. Thank you to our team and to our customers for supporting us on this journey. Before I turn the call over to our new CFO, Tim Adams, I would like to thank Jeff Kalowski for his significant contributions over the last five years. When Jeff joined the company, we had a VM solution and an annual revenue run rate of around $150 million. Today, we have broad-based, best-in-class security operations platform generating nearly $600 million in annualized recurring revenue. Jeff was a critical player in this transformation. We wish him all of the best in retirement.
Tim, we're thrilled to have you on board as we usher in the next chapter of growth for Rapid7, and I'm excited about all the great experience you will bring to our leadership team. Thank you for joining us today. Now I will hand the call over to Tim. Tim?
Thank you, Corey. Good afternoon, everyone. Thank you for joining us on the call today. I look forward to working with all of you and hopefully meeting you face-to-face in the near future. First, let me say I'm very excited to be part of such a great company. I have known Corey and the Rapid7 team for a few years, and I am truly honored to be here. I've been on board for just over a month, and I have been impressed by the level of talent and experience across the organization. There is a strong culture of collaboration, teamwork, and customer focus.
As one of the executive leaders, I will be working across the company to ensure that we continue to align our business and finance strategies to support our overall growth and long-term financial targets. Now, before I turn to the results, a reminder that except for revenue, all financial results we will discuss today are non-GAAP financial measures unless otherwise stated. Additionally, reconciliations between our GAAP and non-GAAP results can be found in our earnings press release. Rapid7 delivered strong fourth quarter and full year 2021 results. Total ending ARR of $599 million grew 38% over the prior year, driven by growing customer demand across our portfolio of security transformation and vulnerability management solutions.
ARR growth was over 30% on an organic basis in 2021, an acceleration over the prior year, and highlights Rapid7's exceptional ability to drive durable growth as we scale our business. Full- year revenue of $535 million grew 30% over the prior year and exceeded the high end of our guidance range. Strong demand for our Insight Platform solutions drove product revenue growth of 31% over the prior year to $501 million. As Corey shared earlier, the need to manage risk across an increasingly complex IT environment fueled organic growth of over 50% in our security transformation solutions ARR in 2021. I am thrilled to share that our security transformation solutions now represent the majority of our total ARR. We continue to see a healthy mix of growth coming from both new and existing customers during the year.
In addition to experiencing strong and improving customer retention rates throughout the year, our customer base grew 18% over the prior year, ending 2021 with over 10,200 customers globally. Our expanding suite of leading security solutions and the compelling value proposition of our Insight Platform is underscored by the ARR per customer of $58,300 at year-end, which is up over 17% over the prior year. Our commitment to driving durable growth while expanding margins within our profitability framework is clear in our operating results. Rapid7 generated approximately $8 million of operating profit, a year-over-year improvement of nearly 100 basis points and $35 million of free cash flow during 2021, both of which exceeded our guidance.
We were able to achieve these results while increasing our investments in growth, absorbing our largest acquisition to date, and hiring and retaining talent in a more competitive labor environment. Now turning to our fourth quarter results. Total revenue in Q4 of $152 million was up 34% over the prior year and above the high- end of our guidance. Product revenue grew 35% year-over-year to $141 million. Our international revenue grew 59% and represented 20% of total revenue for the fourth quarter, while North America revenue grew 29% over the prior year and represented 80% of total revenue. Product gross margin was 75% in the quarter, while total gross margin for the quarter was 71%, down slightly from the prior year, but in line with our range of expectations.
As we shared previously, we continue to expect product gross margin to trend in the mid-seventies and overall gross margin in the low seventies. During the fourth quarter, we continued to invest in growth and innovation and absorbed a full quarter of expenses from our IntSights acquisition. Sales and marketing expenses grew 34% year-over-year and represented 44% of revenue as we ramped investments to position ourselves for growth in 2022. R&D investments grew 45% year-over-year and represented 22% of revenue, while G&A expenses grew 31% and represented 9% of revenue. Our ability to reinvest our top line overperformance from the second half of last year provides a strong foundation for growth in 2022, while maintaining the commitment to executing against our profitability framework. Fourth quarter operating loss of $6 million was slightly better than our guidance.
Our adjusted EBITDA loss was $2 million in the quarter, and net income per share was a loss of $0.16. Moving to our balance sheet and cash flow. We ended the year with cash equivalents and investments of $258 million compared to $310 million at the end of Q3 2021. The reduction was primarily driven by the November redemption of the remaining $45 million of our convertible senior notes due in 2023. We delivered better than expected fourth quarter and full year cash flow from operations, reflecting strong ARR growth, and we exceeded our expectations by generating $35 million of free cash flow in the year. This brings us to our guidance.
The strong results we achieved in 2021 highlight the large and growing opportunity we have to deliver our best-of-suite IntSights solutions to customers as they face an increasingly complex risk environment. Our demonstrated success across the three areas that Corey elaborated on, the breadth and depth of our Insight Platform as customers look to consolidate down to strategic security vendors, our unique approach to delivering a market-leading extended detection and response solution, and our early traction in helping customers migrate securely into the cloud, provide a solid foundation for our outlook into 2022. With that in mind, for the full year 2022, we expect an ending total ARR of $740 million-$750 million, which represents growth of 24%-25%. We plan to share relevant ARR guidance updates likely in the second half of the year.
We expect total revenue for the full year to be in the range of $682 million-$690 million, representing growth of 27%-29%. On profitability measures, we anticipate non-GAAP operating income to be in the range of $17 million-$24 million for the full year, with non-GAAP net income per share in the range of $0.05-$0.16. This is based on an estimated 60.9 million diluted weighted average shares outstanding. For full year 2022, we expect to generate strong growth and operating cash flow, which when coupled with slightly higher CapEx infrastructure investments to support our growth, should drive healthy overall growth and free cash flow to a range of $40 million-$45 million for the year.
The operating margin expansion we expect in 2022 reflects our growth outlook and is consistent with the profitability framework we have previously outlined. Moving to quarterly guidance. For the first quarter of 2022, we expect total revenue in the range of $153 million-$155 million, representing year-over-year growth of 30%-32%. We expect a non-GAAP operating loss for the first quarter in the range of $7 million-$5 million, driven in part by early year investments and some annual Q1 events such as kickoff. We expect a non-GAAP net loss of $0.18-$0.15 per share for the quarter, which is based on 58.3 million basic weighted average shares outstanding.
In conclusion, we remain committed to driving durable growth and margin expansion within our profitability framework as we continue on our path to becoming an over $1 billion Rule of 40 company. Thank you for joining us on the call today. With that, we will open the call for questions. Operator?
Thank you. If you have a question at this time, please press star then one on your telephone. If your question has been answered or you wish to remove yourself from the queue, please press the pound key. Our first question comes from the line of Rob Owens with Piper Sandler. Your line is open. Please go ahead.
Yeah, good afternoon. Thanks for taking my question. Obviously a strong quarter punctuated by acceleration and looking at that organic ARR number, it's clear the environment's as good as it's ever been. Corey, with the vulnerabilities out there, with all the attacks, do you have any sense, is there a pull in of demand that we're seeing right now? Curious how sales cycles are trending and how sustainable are these levels? I do note that it does look like you're gonna hit your midterm goal of $750 million in ARR one year early, just based on your guidance alone.
Rob, it's a great question. One, I would say the demand environment overall is quite healthy. We started highlighting that at the tail end of last year. I think it's driven partially by some of the big name, the vulnerabilities or compromises. I do think that it's actually moved to a level where this is on the permanent agenda now of both CEOs and boards. We think that's a very good backdrop for our business and our organization overall. Now I think part of the thing that has allowed us to capitalize on that well, is I think that our team has a great story and great delivery on the ability to give customers the productivity they want and the efficacy they want. Lots of organizations are looking for both of those.
Just because it's in demand, they still want efficiency and productivity. I think that's really the story that transcends. To answer your core question is we think that that is durable. We don't tend to chase sort of like the latest fad or the latest breach or the latest compromise. We tend to focus on like what's the long-term outlook and prospect, and we are seeing a high level of focus by customers, and we do think that we actually have durability of opportunity ahead of us.
Great. Thank you.
Thank you.
Thank you. Our next question comes from the line of Saket Kalia with Barclays. Your line is open. Please go ahead.
Okay, great. Hey guys, it's Saket Kalia at Barclays. Thanks for taking my questions here and welcome, Tim.
Thank you.
Corey, maybe for you, I was wondering if we could talk a little bit about the cross-selling success this year. You know, to your point, nearly $60,000 in ARR per customer with just the biggest, best, and sweetest, as you noted. How do you sort of think about the cross-sell effort going into 2022 with, as that list of products kinda continues to expand?
We thought of, you know, as we've expanded our product portfolio over the last few years, and our focus first and foremost was making sure that we're making the right products that customers wanna adopt. I think hands down, we nailed the formula for how do you actually deliver like highly effective, sophisticated
Products that are also adaptable and consumable and accessible by a wide range of customers. We feel we actually got that right. For that part of the equation it was incredibly important not just to actually cross-sell the package, but to make sure that each of those offerings could stand on their own. We've proven that out over the last several years. Over the last year or so, you've heard me start to talk about packaging and pricing. I wanna say that now that we've actually proven that we have this quote-unquote best of suite, and really what that means is customers aren't making trade-offs in quality in order to actually get the benefits of a platform, a platform leverage.
How do we then actually turn that into something that we can use to actually reduce friction in how customers adopt, and frankly, reduce our costs about how we actually engage with customers? This is where cross-selling, I think, becomes quite strategic over time. What I would say is that in our pilots over the last few years, we've seen the evidence, we've seen the attractiveness to customers, and we've seen the adoption. What I said is we've seen the proof points, and now from here, we're continuing to scale those proof points, as we go forward. It'll be like it won't be one big thing overnight, but what we'll do is we'll get better and better at actually finding the optimum mix of adoption for customers that works for customers and works for us.
Now, the one thing I'd say to keep in mind, Saket, is that when we think about adoption, we're really focused on customer adoption, not Rapid7 sales. What that really means is we wanna actually deliver technologies and sell technology to customers at the pace that they can adopt those technologies, because we think that that's what leads to the most enduring success and frankly, the best long-term customer economics. That's how we approach it. I think we made good progress. I still think we got lots of upside in front of us, but we're on the road that we wanna be on.
Got it. That makes a lot of sense. Tim, maybe for my follow-up for you, since this is our first call all together, I was wondering if you'd just talk a little bit to us about, you know, what attracted you to the opportunity at Rapid7, and understanding that it's only been a month , at the company. Anything you want us to know just about your process or rigor when thinking about the guidance, just the overall guidance philosophy?
Yeah, Saket, thanks. First let me reemphasize I'm thrilled to be here. I guess I've known Corey for about five years or so now, and Jeff Kalowski, and they're first-class people. They've built a great company, which I think all of you will agree with, and so I'm really thrilled to be here. It's a very strong team, and in the 30+ days that I've been here, I've had the chance to meet a lot of folks face-to-face, and you can tell they are very smart, very hardworking, very engaged, very passionate and really focused on the customer, which I think is critically important. Corey talks a lot about the culture of a company, and I think that is very important.
That really does matter to me, how we operate and behave and work with each other, and I think it's all very important, and it's very mission-driven. You know, there are a lot of bad actors out there that are creating a lot of havoc to the world as we know it, and I think we're out there really trying to get in front of that and prevent a lot of that. So I'm thrilled to be here, and I look forward to working with everyone over the next several years. In terms of the guidance, we feel very good about the guidance that we put out. We think it's showing very strong growth year over year with the top-line ARR range that we shared. I will tell you, I think this team does an outstanding job.
They are very thoughtful, they are very thorough, and it's a collaborative approach, not just of the finance team, but we reach out to the sales leaders, our COO, Andrew Burton, is very strong and very engaged with us. It really is a very thoughtful process, and I feel very comfortable with how it's come together, and we feel very good about the guidance that we've shared with you today.
Very helpful, guys. Thanks very much.
Thank you.
Thank you. Our next question comes from the line of Matt Hedberg with RBC Capital Markets. Your line is open. Please go ahead.
Great. Thanks for taking my question, guys. I'll offer my welcome to Tim as well, looking forward to working with you. Corey, security transformation products are clearly driving a lot of your growth, and I think it's a huge focus of TAM expansion. Obviously you still have a pretty healthy VM business. I'm wondering if you could comment on, as we think towards next year, you know, maybe the relative health of that business, versus maybe some historic trends.
I'll talk about both of those. Let me start by saying that I think that as we go forward, it becomes less important, mostly because of the way that we actually sell and operate to actually break out security transformation and VM. As we actually continue to drive the cross-selling, the packaging, and the adoption strategy, we're focused much more about how to drive productive usage and consumption for our customers than anything else. I just wanted to give that intro. Then to address your other questions, yes, we actually are seeing great growth on security transformation, and we're seeing durable growth on the vulnerability management. We feel very good about all the aspects of our business. As you know, we're fairly rigorous about how we think about it.
Security transformation, we saw extraordinary growth last year, and we see durable growth this year. You know, we've used the 40% number for a couple years now, and that really bodes to the durability, and we see that same durability as we actually go forward into the future. When we think about vulnerability management, we see visibility as a persistent backdrop that drives not just vulnerability management, but it's also a big driver of our cloud solutions also.
To get to your core question is that when we look at our complete portfolio, we see extraordinary opportunity across the entire portfolio, and most importantly, we see the opportunity to actually meet customers wherever they are on their journey. One of the things that I think our sales team is really operationalizing, with the help of Andrew and a bunch of other people, is this mindset that we can go in and figure out what customers' most pressing issues are and address those issues wherever they are. Then from there, we can actually expand their success with adopting other solutions.
That's great. Thanks, Corey. Maybe just a really quick follow-up, and it sort of touches on sort of something you mentioned in your script. You know, did Log4j have any impact on your Q4 growth rates? How do you think about that as a potential demand generator sort of benefit to 2022?
Yeah, it's a great question. We treat all of these things as healthy backdrops. Keep in mind, we don't go in and sell into any type of breach or crisis. Like, we're very focused on how do we help customers with their long-term security program. What we think that these things do is it reminds customers about why security is important. That's what we actually sell into, is how you actually build great security programs and the importance of security. We work very hard with our sales team to focus on the long-term aspects, and not just sort of like using really painful incidents that happen for our customers as the reason that we go in and sell. Yet still, they provide incredibly healthy backdrops for customers to understand why security is incredibly important.
Thanks, Corey.
Thank you.
Thank you. Our next question comes from the line of Brian Essex with Goldman Sachs. Your line is open. Please go ahead.
Hey, good afternoon. Thank you for taking the question. First of all, Tim, congrats on the new role. Looking forward to working with you again.
Thank you, Brian.
Corey, maybe if we could talk a little bit about, you know, how the algorithm for growth throughout the year. You had really balanced , land and expand, between customer growth and expansion within existing customers. Are we looking at the same algorithm in 2022? Maybe on the back of that, could you talk about investments you've made in sales and marketing, the sales force and pricing configuration that might either drive that consistency or trend it one way or another away from the historical trend?
No, it's a great question. I'll remind you when I think about sort of like the drivers of growth, and you really alluded to the two of them, you know, we either land the new customers or we're driving ARR per customer. And we have a big focus on both. With the opportunity and the TAM in front of us, it's an incredible opportunity on the ARR per customer, which is a heavy focus. What we said on our analyst day, I think still holds today. We expect ARR per customer to actually be, over the medium and longer term, a higher growth contributor than adding new customers. It's not because adding new customers is not good. We love to add new customers.
It's just that we also have so much opportunity to actually provide great service to our existing customers. That's a heavy part of the focus. The other thing I'll remind you is that, while we occasionally provide sort of like spiffs, we actually don't provide structural incentives that are about how our sales teams have to actually grow. The reason that's important is that you would actually expect sales teams to actually focus a lot of their time and attention on customer growth, especially when we have so much potential per customer. So if you ask me, I'll go back to the original outlook that I gave at the Analyst Day last year, is that, listen, we think that we can actually grow ARR per customer and consistently drive that forward.
We actually think that we can grow also new customers, but it won't be at the same pace over the medium term as the ARR per customer growth. That said, last year, we were quite happy with the dynamics. If the dynamics flip around this year, we're fine with that too. It's not something that we're managing. We're really managing the quality of our customer adoption.
Got it. Super helpful. Maybe just to follow up, I guess jump ball on this one, given that Tim's only been there a short time. On the TAM, how do you think about the way that your customers are thinking about cloud security spend? I know some of your peers have talked about, 5%-6% of, you know, total cloud IT spend should be the number, but it's still an evolving market, and I think pricing still has to be worked out. Any kind of reconciliation there in terms of, you know, where there might be upside, downside to your TAM estimates and how you kind of thought about addressing the opportunity there?
Yeah, I'll start. We tend to be pretty pragmatic with the TAM estimates, and we revise them over time. I think we revised it again in this deck if you look at some of the materials. The way that we actually think about it is it's really based on what we think the realistic potential is, for customers, and we revise those over time. As you said, cloud, it's still early in general. I mean, we're still early in the overall cloud adoption cycle, for customers. We're still early in the types of services that customers are adopting, and yet still we're seeing both good success and it's something that we're incredibly excited about.
I think cloud is one that you could absolutely have revisions in the future, but it's premature to do that, sort of today, because again, we want this actually to be durable with customers. I would say that our cloud estimates that we just updated are very good and we feel great about today. The cloud market's evolving, so you can expect that to be, as it evolves, something that, as it makes sense, we'll revise that in the future.
Right.
Yeah, go ahead. Sorry.
Let me just add to a comment Corey made earlier, is that you're really capturing the mind share now of the C-level suite and at the board level, and certainly at audit committee levels of this broader framework of cybersecurity and what are we doing and how do we feel about our environment is top of mind, you know, right at the level where you wanna be. My experience has been over the past couple of years, you see folks really willing to invest more because the downside of having an event. Far outweighs the additional investment that they wanna put to work.
Got it. That's super helpful. Thank you very much.
Thank you.
Thank you. Our next question comes from the line of Fatima Boolani with Citi. Your line is open. Please go ahead.
Good afternoon. Thank you for taking my questions, and Tim, very nice to telephonically meet you. Corey, I have one for you and one for Tim, I'll start with you. You alluded to the international performance in your prepared remarks, so I just wanted to peel that onion back a little bit. You've now seen four straight quarters of accelerating growth in your rest of world execution. I'm curious if you can take a step back and share with us any notable drivers or any patterns of observable strengths, whether that is concentrated in certain countries or certain geos, or any particular products that are really driving the bus on some of your international performance and the acceleration in international business. My follow-up for Tim.
Absolutely, Fatima. It's a great question. I would highlight probably two things. It's less specific geographic. We're seeing fairly broad-based adoption. I do think one of the drivers, though, is sort of like two factors. One is the demand factor, is that I think cybersecurity, and specifically the willingness to actually invest in cybersecurity programs, is growing. If you go back a couple years, I used to talk about the fact that in general, this is sort of a generalization, the global organizations did not have the same priority on cybersecurity as you sometimes found in the U.S. I actually think that gap has closed with hindsight. I think you have a basic driver that's there.
I think the regulatory environment helps that, but also I just think you have an environment where people are actually paying attention to cybersecurity. I think that's a healthy demand backdrop. The second part is probably a little bit more particular to us, is that, you know, we've done lots of innovation, but when we do innovation and we launch new offerings, like I gave the stat on the call earlier when I was talking about Jeff, is that we introduce a platform with new offerings available, we have new services. By and large, those new offerings and services tend to actually start their distribution in the U.S., and they tend to start in our cloud U.S. instances.
What's happened is, over the last couple years, we've actually got those technologies distributed around the world to more cloud instances, which has been lots of great work by our core infrastructure and platform teams. That's kind of important in a world where, like, data sovereignty is more and more important. That's a helpful unlocking of potential. Then we've also invested a lot in our partner ecosystems and our global sales team, global service team, global support team to actually support those customers around the world. It's that combination of things that allows us to unlock the potential to meet the demand, and we're leveraging all the great stuff that we've actually invested in along the way.
I appreciate that, Corey. Tim, really quickly for you. I appreciate it's been but 30 days in the seat. But just with respect to some of your commentary around gross margins, you know, I can see that you're still operating within your disclosed envelope. But just wondering if there are any one-time items in the compression we saw this quarter, and really how we should think about the shape of gross margins working through calendar 2022, especially as some of the cloud portfolio and in-cloud security solutions start hitting escape velocity. That's it for me. Thank you.
All right. No, it's a very good question, and just to remind everyone of the framework that we shared at the Investor Day about a year ago, is that we expect our product gross margins to stay in the mid-70s, with total gross margin in the low 70s. If you go back and look at previous quarters, you will see some variability quarter-over-quarter, which we really attribute to product mix. We go back and we take a hard look at that. It's important to note, and Corey and I both mentioned this earlier, that we have outstanding growth this past year in the security transformation solutions growing over 50% on an ARR basis, and it now makes up the majority of that ARR.
These products are earlier in the maturity curve, and we have programs in place that will drive scale and drive additional efficiency. Again, we think it's all, you know, contained within the guidance that we've given for 2022, and we stay within that framework that we outlined about a year ago.
I appreciate that. Thank you.
Thank you.
Thank you, everyone. Just a reminder to try to get to as many questions as we can if we could keep it down to one question. Thank you.
Thank you. Our next question comes from the line of Jonathan Ho with William Blair. Your line is open. Please go ahead.
Hi, let me echo my congratulations. Just with the strong ARR per customer growth, is there a way for you to maybe parse this out a little bit more between perhaps larger platform lands, expansion in your existing assets or, you know, maybe new product additions? I just wanna get a little bit more granularity on how to think about, sort of the sources of that strong ARR per customer growth. Thank you.
It's a great question. Unfortunately, like, there's not a simple parsing that actually gets you the answer you're looking for, because it actually was, you know, with multiple contributors. We continue to execute well across customer segments, both big and small. As we talked about earlier, we talk about sometimes our different products do have different ASP. You could say on average, security transformation solutions have slightly higher ASPs than VM. Again, that depends on sort of like segment and mix. You also have different trends internationally, and then you have distribution. What I would say in general to actually get to sort of like the larger trends that you can actually just think about is ultimately over time, there'll be two big contributors to the ARR per customer.
One is obvious cross-sell, which we talked a little bit about earlier. The second is upsell, which is about sort of like what's the usage and adoption on a per customer overall. Those are gonna be like the biggest things that are actually gonna drive the dynamic. What we're seeing is some combination of all of that, combined with the fact that especially if you look at cloud and IDR, they do have higher ASPs. As we continue to have success there, that actually matters.
Thank you.
Thank you. Appreciate it.
Thank you. Our next question comes from the line of Michael Turits with KeyBanc. Your line is open. Please go ahead.
Hey. Hey, everybody. Congrats on the quarter. Tim, welcome. I wanna come back to the cross-sell question that Saket had started with. Corey, at Analyst Day, you said 22% of your customers had multi-platform sales. Is there an update on that and where it's going? Importantly, can you talk about what are the specific products that most often are sold together, and how are you going about packaging multiple products together in order to get those multiple product sales?
Yeah. It has continued to actually improve. I don't have an update to give at this moment, and we'll give it episodically. It has continued to improve. Really what you're seeing right now are clusters that in some ways align with how we've actually done some of our early packaging pilots and some of the things that resonate. You definitely see a cluster around IDR, where you actually see, you know, IDR and SOAR and the enhanced endpoint delivery and other things going on. You see things like that, and that's become part of the modern SOC normal selling motion. We're seeing the emergence of the idea of the cloud front door, where people are sort of like cloud-first users, and then they're thinking about their vulnerability management.
Eventually we're seeing some early tea leaves as they're thinking about detection through the lens of how they actually think about cloud. Again, you know, those are early indicators. Then there's some customers that are just interested in visibility. They actually think about both their cloud and their vulnerability management as sort of like the visibility platform. What our sales team is actually doing right now is really working to actually operationalize the motions that they see. Again, the thing I would emphasize is that it's we wanna be able to respond to how the customer thinks about it. Now, of course, we'll always have some guidance about what we see across customers, but our goal is to actually respond to our customers. If customers wanna focus on visibility, that's great.
If they wanna actually update and modernize their SOC, that's absolutely amazing. If they wanna actually operationalize everything around the cloud, then we'll package over time and deliver the experience. I just gave you the three that are the most common that I actually see the most often tracks around.
Great, Corey. Thanks.
Thank you very much.
Thank you. Our next question comes from the line of Jonathan Ruykhaver with Baird. Your line is open. Please go ahead.
Hey, Jonathan, you might be on mute.
Sorry about that. Yeah, here I am.
Oh, there you go.
Got it. Yeah, Corey, would love to hear your thoughts on the competitive landscape for XDR, you know, specifically who you view is delivering on true enterprise-grade detection and response capabilities. That's just your thoughts as the market evolves with these endpoint vendors also introducing more VM capabilities, how do you think that shakes up the space over time?
Yeah. I'll talk about the attributes of it in broad categories, just 'cause we don't talk specifically about specific competitors necessarily. The attributes of how I think about the winners in XDR, and there are some, I think Rapid7 is a leader, but there are some definitely other players, is one, you actually have to be able to actually bring data in natively, and it has to actually be a broad set of data. It has to be endpoint data, network data, log data, and you have to be able to bring that in, contextualize it, and then allow people to actually do two things with it. To actually be able to do high-quality detections against that heterogeneous data set and actually very, very fast automated investigations.
We think that is sort of like the key to an essential, and we've had this thesis for a long time. There's multiple players in the market that are actually trying to build in that direction. I think Rapid7 is well positioned in that market well. The second question that you addressed is the endpoint players. I'll ignore the branding of XDR because, again, we come from different places. I'll remind them, I'll remind the rest of you, so I know you know this, is that XDR is really the combination of two things. One, it's a broad-based trend to say we can't have these gaps and these seams in terms of visibility and how we actually process information.
That's true whether you look at how we've approached it from an enterprise data perspective. That's also true for the endpoint players about how they approach it from an endpoint perspective. That's also true for network players. You know, in some ways, everyone has to have the X in XDR because customers are not being successful with a highly fragmented technology and a highly fragmented security environment. That's a natural customer-driven trend, is how do you actually reduce the gaps and the seams and visibility that allow you to operationalize? Now, when it comes to the idea of how do we think about how these things intersect across, and keep in mind many of these are our partners also, is that yes, you'll actually see a lot more blending and overlap.
You will actually see some of the endpoint players that actually have some storage services or some data services that can take in log data. By the way, we actually have endpoint data that actually takes in that. You're still gonna end up with a pretty sizable, not like a small one, a sizable gap between endpoint players' ability to actually take in all types of enterprise data at that scale, process it, organize it, and do the compliance and the investigation and the enterprise-wide detection that we actually do. Likewise, by the way, we have some of the best-in-class endpoint forensics technology with Velociraptor, with large companies and governments all over the world that use the technology. But that's not the same as actually having a comprehensive enterprise endpoint platform.
What I would say is that it gets confusing because we may use the same language, but the center of mass is different. Rapid7 is when we talk about XDR, we are an enterprise data platform that's allowing you to collect all the relevant data across your platform, be able to actually search that, organize that, do high-quality detections on that, and then do high-quality investigations on that, consuming both the internal data sources and the external data sources, and then automate all those SOC workloads. That is extraordinarily different than what the enterprise players are offering in the market today. That just gives you a little bit of flavor about what the difference is, but also what are the similar trends that we're all adapting.
Yeah. Oh, that's great. Thanks, Corey.
Thank you very much.
Thank you. Our next question comes from the line of Brad Reback with Stifel. Your line is open. Please go ahead.
Great. Thanks very much. Just real quick, Corey, are your customers seeing any issues with employment levels being able to deploy your solutions?
Yes. I mean, not to give you a one-word answer. It's something that we're actually tracking. That is an area of concern is that, again, we're very focused that when we sell, we measure ourselves on what we call the customer value realization. Did the customer get the promise? One of the most frequent challenges is staffing capacity. It's one of the things that I probably spend the most amount of time on. You know, I think it was asked earlier, and I forgot to answer this one, like, how we think about some of our investments.
I would say lots of our investments are going to actually how do we accelerate some of the investments that we're making, not just in our sales investments, but also heavily in our partner ecosystem, so that we can actually have an ecosystem that if customers can't find the resource they need, they can still get the security that they need overall. Yes, that is a big concern of mine and our team, because customers do need talent and they're having higher turnover. It's taking them a longer time to actually fill those gaps. What we're doing is we're working with our partner ecosystem to actually find ways that allow us to actually still build out their security programs as they're actually building their teams. That's been quite well received by our customers.
That's great. Thanks very much.
Thank you.
Thank you. This is going to conclude our Q&A session for today's conference. I would like to turn the conference back over to Corey Thomas for any further remarks.
Well, thank you, operator. Thank you all so much for joining us today. We enjoyed it, and we appreciate your questions, and we look forward to the next one.
This concludes today's conference call. Thank you for participating. You may now disconnect.