Ladies and gentlemen, thank you for standing by and welcome to the Q2 Rapid7 Earnings Conference Call. At this time, all participants are in a listen-only mode. After the speaker presentation, there'll be a question and answer session. To ask a question during the session, you'll need to press star one on your telephone. Please be advised that today's conference is being recorded. If you require any further assistance, please press star zero. I would now like to hand the conference over to your speaker today, Sunil Shah, Vice President of Investor Relations. Please go ahead, sir.
Thank you, operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7 Q2 2020 financial and operating results, in addition to our financial outlook for the Q3 and full fiscal year 2020. With me on the call today are Corey Thomas, our CEO, and Jeff Kalowski, our CFO. We have distributed our earnings press release over the wire, and it is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast, and following the call, an audio replay will be available at investors.rapid7.com until August 13, 2020. During this call, we may make statements related to our business that are forward-looking under federal securities laws.
These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to the company's positioning, our future goals and financial guidance for the Q3 and full year 2020, the assumptions underlying such goals and guidance, including the anticipated impact of COVID-19 on our financial guidance, business, financial condition, results of operations and renewals, and our assumptions on the pace of economic recovery in the global economy on our future results of operations and product strategy. These forward-looking statements are based on current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the expectations contained in these statements due to a number of risks and uncertainties, including those contained in our most recent quarterly report on Form 10-Q and in the subsequent reports that we file with the SEC.
The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by applicable law. Our commentary today will be primarily in non-GAAP terms, and reconciliations between our historical GAAP and non-GAAP results and guidance can be found in today's earnings press release. At times, in our prepared remarks or in response to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results.
Please be advised this additional detail may be one-time in nature, and we may or may not provide an update in the future on these metrics. With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey?
Thank you, Sunil, and good afternoon, everyone. Thank you all for joining us today for our Q2 2020 earnings call. We are pleased to report solid execution during the Q2 as our team delivered results that exceeded expectations for both growth and profitability. Q2 ended ARR of $380 million, grew 31% over the prior year, demonstrating our ability to meet customers' diverse priorities with our Insight platform, while operating income of $4 million reflects underlying leverage in our business. Even amidst an uncertain landscape, our consistent first-half execution provides us the confidence to raise full-year guidance, which Jeff will cover during his remarks. Organizations continue to face a mix of economic and operational uncertainty as they navigate a rapid shift in their technology footprint.
While customers are in various states of replanning, digital transformation, and cloud migration have rocketed up the priority list as companies evolve their business in these dynamic times. During the Q2, we saw customers return to critical decision-making processes and prioritize security enablement tied to these digital strategies. Security challenges in the cloud are different. As organizations embrace cloud transformation at a faster pace, CIOs and CISOs need to quickly prioritize security analytics, automation, and cloud enablement. These priorities align directly with our security transformation solutions, IDR, AppSec, Connect, and DivvyCloud, which positions Rapid7 to capture the cloud security operations opportunity. During the Q2, we saw better-than-expected momentum led by these security transformation solutions with particular strength in IDR and InsightAppSec. Our vision for the Insight platform was driven by the belief that cloud adoption would spark the need for organizations to transform their security programs.
As companies move beyond the initial phase I response to the pandemic of operationalizing work from home, we see a fast-follow phase II emerging, where organizations increasingly look to digitize their operations over the long run. This extended wave of cloud transformation is a catalyst, and we are entering the early stages of a sustained effort by companies to transform their security operations around the world. While we don't know the pace at which this transformation will play out, the trend drives our increasing confidence in the long-term growth opportunity for our Insight products. Security teams must now accelerate secure cloud migration while navigating a more distributed workforce than ever before. For many organizations, this increase in complexity is exacerbated by tightening budgets due to pandemic-related disruptions. Amidst budget uncertainty, the need for productivity and time to value is critical as ever.
Rapid7 is addressing this challenge and closing the security achievement gap for our customers in a way that only we can, through an integrated Insight platform that delivers sophisticated security operations while prioritizing ROI. Forrester consultants shared independent validation of this in a recently commissioned study revealing that organizations that deploy InsightIDR can recognize a 445% ROI over three years. The study found that Rapid7's cloud-native solutions provides 79% faster time to value and delivers improved efficiency through a 38% reduction in incident management efforts. During the Q2, we saw an existing healthcare customer choose IDR and Connect to solve their growing SecOps challenges because of these solutions' superior outcomes and value. Leveraging our single endpoint agent, InsightIDR was able to quickly address the customer's need for visibility during proof of concept by identifying threats in their environment that the competing solutions missed.
The customer purchased InsightConnect at the same time to unlock automated response capability across InsightIDR and InsightVM. This is a great example of how customers are leveraging our security transformation solutions together to deliver better security outcomes through advanced analytics and automation. Rapid7's platform strategy positions us to meet customers where they are in their SecOps journey, whatever their immediate priorities are, and allows them to expand seamlessly over time. Vulnerability management, incident detection response, automation, and increasingly cloud and application security. As the pace of technology change accelerates, we see growing customer adoption across our platform. Our security transformation solutions, InsightIDR, InsightAppSec, InsightConnect, and DivvyCloud, continue to gain momentum, and for the first time represent over 50% of new business in the quarter as customers prioritize security analytics, automation, and cloud enablement.
These solutions now collectively represent over one-third of our total ARR, growing at over 40% year-over-year. This is all the while we continue to gain share in the vulnerability management market, delivering solid year-to-date ARR and revenue growth in excess of 20%. We continue to see a balanced mix of new business coming from new and existing customers, with a bias towards existing customers in the Q2 as we expected. With multiple avenues to land, we saw healthy year-over-year growth in new customers, but are also focusing on expanding existing relationships in this environment as we help our customers transform their security programs. As a result, we experienced solid expansion in our ARR per customer ended the quarter at approximately $41,600, growth of 20% year-over-year.
Our success in expanding customer adoption across our Insight platform is rooted in Rapid7's long-standing commitment to technology investment and innovation. Let me briefly touch on some of the key achievements from our innovation pipeline in the quarter. During the Q2, we delivered a very successful launch of our enhanced network traffic analysis module for InsightIDR. NTA gives customers greater visibility to the attack surface by leveraging user and device activity across the network, effectively shining a light on even the darkest parts of their network. To date, NTA has been successful in driving not only cross-sell deals, but also influencing IDR competitive wins in the quarter. To further enable our customers as they shift to work from home, we introduced a new customizable dashboard within InsightVM to better track remote workforce and external-facing assets.
With this new dashboard, customers can identify and monitor remote assets in their changing environment and leverage information around vulnerability exposure. We continue to extend the operational reach of InsightConnect ended the Q2 with over 400 pre-built plugins and workflows. We opened our extension library, allowing customers to create and share their own workflows, facilitating deeper customer engagement while empowering security professionals to benefit from the wisdom of their peers. Turning to a brief update on DivvyCloud, we could not be more pleased with the early integration efforts. DivvyCloud met our expectations in the quarter, and we are even more optimistic about our long-term growth opportunity in cloud security. As the pandemic effect sparks the need for enterprises to move faster to the cloud, CISOs are recognizing a different set of security challenges tied to scale and pace of change.
DivvyCloud provides our customers with the visibility and automation necessary to manage their risk exposure while enabling better teaming experiences with DevOps. This differentiated value was evident in Q2 as DivvyCloud drove one of our top 10 largest deals in the quarter, a cross-sell to an existing Rapid7 customer. Like many organizations, this manufacturing customer is embracing the public cloud to drive efficiency and innovation, but was concerned about maintaining continuous security and compliance. Additionally, without the right automation, they worried that a growing cloud footprint meant growing risk. This customer chose DivvyCloud because of its real-time detection and strength managing multiple cloud environments. Coupled with the right product adaptability for their sophisticated approach to security operations. Shifting now to an update on our goals for 2020.
As the near and long-term trends reflect a broader shift to both the cloud and a more distributed workforce, our ability to address customers' needs in these areas remains a key driver of our opportunity. Our first goal is to be a leader in enabling customers to transform and upgrade their security operations practices around the cloud. We are experiencing an enduring shift in how work is done, which will drive ongoing prioritization of security analytics, automation, and cloud enablement. Rapid7's ability to solve customers' challenges across these areas with our best-of-breed Insight platform was a key driver of our success in the Q2.
Building upon our recent recognition as a leader in the Gartner Magic Quadrant for Security Information and Event Management, Gartner announced in July that Rapid7 was named a Gartner Peer Insights Customers' Choice for SIEM, with customers highlighting InsightIDR's ease of use, integrations, and alert accuracy. This, coupled with our long-standing leadership position in vulnerability management and our recent recognition in May as the only challenger in the Gartner Magic Quadrant for application security testing, reflects our ongoing commitment to delivering a leading cloud-enabled SecOps platform that empowers our customers' success in the cloud. Our second goal is to accelerate our platform distribution engine. With an expanding set of market-leading solutions on our Insight platform, we see growing interest from customers to acquire multiple Insight products together. This is in part reflected by our Q2 strength in average ARR per customer, which accelerated to 20% year-over-year growth.
We remain focused on reducing friction around both our sales and customer purchase motions in a way that drives the same growth in this metric. Over the course of the next three to six months, we expect to pilot various Insight product bundles as we work to maximize customer adoption and drive improved sales leverage over the long run. Our third goal is to drive long-term operating leverage improvement in our business while investing for growth. Our Q2 results were a clear demonstration of both inherent underlying leverage in our business and strong expense controls. We remain committed to investing behind profitable growth over time and now expect to deliver positive non-GAAP operating profit for the current fiscal year.
In addition, assuming a sustained recovery path in the next year, we expect that we will return to the balanced growth and profitability framework that we shared earlier this year for the full year 2021. Finally, before I hand over the call to Jeff, I would like to take a moment to welcome our newest board member. As we shared in our earnings press release today, we are privileged to have Reeny Sondhi, who serves as Chief Security Officer at Autodesk, join Rapid7's board of directors. Reeny is an accomplished technology leader with deep expertise across cloud and security, and she brings the perspective of our customers to the boardroom. In closing, we continue to execute on our mission to make the best in security operations achievable to all. I want to thank our Rapid7 team for their commitment to helping solve customers' challenges during these uncertain times.
With that, I will turn the call over to our CFO, Jeff Kalowski. Jeff?
Thanks, Corey. Good afternoon, everyone. Before I begin, a brief reminder that except for revenue, all financial results we will discuss today are non-GAAP financial measures, unless otherwise stated, and reconciliations between our GAAP and non-GAAP results can be found in today's earnings press release. We're pleased to report solid performance during the Q2 of 2020, with results that exceeded our guidance on all metrics. Top-line strength was driven by demand for our security transformation solutions, coupled with continued growth in vulnerability management, while underlying leverage and strong expense controls drove upside to profitability. Total ARR ended the Q2 at $379.9 million, growth of 31% over the prior year, as customers turn to our Insight platform to help facilitate more secure shift to the cloud. Q2 total revenue of $98.9 million was above the high end of our guidance and grew 25% year-over-year.
This was driven by better than expected year-over-year products revenue growth of 27% to $92.4 million. Recurring revenue represented 91% of total revenue in the Q2, compared with 87% in the prior year period. Looking at the business geographically, North America revenue grew by 25% year-over-year and comprised 83% of total revenue in the Q2, while rest of world grew by 29%, representing 17% of total revenue. We continue to grow our customer base and ended the Q2 serving over 9,100 customers globally, growth of 9% over the prior year period. At the same time, we are focusing on expanding relationships with existing customers who are turning to Rapid7 to help transform their security programs as they work to advance securely into the cloud.
As a result, ARR per customer saw strong year-over-year growth of 20% in the quarter to approximately $41,600. Turning to margins, total gross margin for the Q2 was 74%, an improvement from 73% in Q1 and down slightly from 75% a year ago, primarily due to lower professional services gross margin and continued growth of our cloud-based offerings. Sales and marketing expenses improved to 41% of revenue, compared to 45% of revenue in Q2 2019, and benefited from reduced T&E spend, as well as timing of some marketing spend that shifted into the second half. R&D expenses for the quarter were 20% of revenue, consistent with the prior year period, and included a partial quarter of DivvyCloud expense. G&A expenses in the Q2 were 9% of revenue, down from 10% in the prior year, driven by reduced T&E and natural leverage in the business.
For the Q2, we reported an operating profit of $4.3 million, ahead of our guidance range, driven by overachievement on revenue and solid expense controls. Adjusted EBITDA for the Q2 was $7.6 million, and net income per share was $0.05, also ahead of our guidance. Shifting to our balance sheet and cash flows, we ended Q2 with cash equivalents, and investments of $321 million, compared to $253.6 million as of Q1 2020. The increase from Q1 predominantly reflects the net proceeds for approximately $196 million related to our convertible notes offering and cap call transaction, offset by cash outflow of approximately $126 million related to our acquisition of DivvyCloud. We experienced healthy collections activity in the quarter and ended Q2 with operating cash flow of $0.4 million, down modestly compared to $2.5 million from the year ago period. Turning now to guidance.
Rapid7 strategic offerings and product leadership position us to capture the expanding cloud SecOps opportunity as organizations leverage security analytics, automation, and cloud enablement to empower secured digital transformation. During the quarter, we saw this play out as customers returned to decision-making, prioritizing security enablement through our Insight platform products. As we look ahead, our revised 2020 guidance is now framed around two fundamental drivers. Overall demand for our strategic security solutions remains robust. During the Q2, we experienced healthy activity and engagement as customers look to Rapid7 for their transformation initiatives. Customers continue to face an unprecedented period of economic uncertainty, clouding budgets and impacting near-term visibility around the second half trajectory. Let me share some brief context on how we are balancing optimism around the long-term opportunity with near-term visibility challenges.
We continue to analyze financial stress and durability across our customer base at a micro vertical level to frame a range of outcomes for new business and churn. While Q2's better-than-anticipated demand mitigates our prior downside expectation, we continue to anticipate a wide range of economic scenarios for the second half. The high end of our revised guidance range now contemplates the continuation of Q2 trends, reflecting a jagged but steady economic recovery trajectory. At the low end, our guidance range assumes some additional risk tied to potential broad regional or systemic shutdowns as a result of sustained pandemic resurgence that would drive deterioration from Q2 trends. The result is that we are raising and modestly tightening our ARR guidance range entering the second half, while still maintaining a wider-than-usual range to account for the variability in economic outcomes as a result of the ongoing pandemic.
For the full year 2020, we now anticipate ARR to be in the range of $404 million-$420 million, an increase of $15 million at the midpoint, or growth of 19%-24%. We're raising full-year revenue guidance and now anticipate revenue to be in the range of $399 million-$403 million, or growth of 22%-23%. We continue to invest while focusing on driving sustained long-term leverage in our business through strong expense controls that prioritize high ROI investment. To that end, and building off our strong performance in Q2, we now anticipate returning to a non-GAAP operating profit for the full year within the range of breakeven to $2 million. As a result, we are raising our expectations for full-year non-GAAP loss per share to be in the range of a loss of $0.14-$0.10.
This is based on 51 million basic weighted average shares outstanding for the full year 2020. We expect cash flow from operations for the full year to be a loss of approximately $15 million. This improvement relative to our prior expectation of a loss of $25 million is a function of improved full-year billing expectations associated with our revised ARR estimates, coupled with strong expense controls in the business. Additionally, while it remains early in our FY 2021 budgeting process, I will reiterate Corey's earlier comment that assuming a sustained recovery path going forward, we currently expect to return to our previously communicated balanced growth and profitability framework for 2021. Moving now to quarterly guidance. We anticipate total revenue for the Q3 of 2020 to be in the range of $100.7 million-$102.3 million, growth of 21%-23%.
We anticipate non-GAAP operating income for the Q3 to be in the range of a loss of $500,000 to +$500,000 . Recall that Q3 includes a full quarter of DivvyCloud expenses as compared to a partial quarter in Q2. Non-GAAP net loss per share is anticipated to be in the range of a loss of $0.06 to a loss of $0.04, which is based on our anticipated 51.3 million basic weighted average shares outstanding given our projected non-GAAP net loss. In conclusion, as demand accelerates for cloud deployments, Rapid7 is focused on helping make the best security operations achievable for our customers through best-of-breed security solutions on our Insight platform. With that, we appreciate your time and support. We will now open the call for any questions. Operator?
Thank you. As a reminder, to ask a question, you will need to press star one on your telephone. To withdraw your question, press the pound key. Please stand by while we compile a Q&A roster. Our first question comes from Saket Kalia with Barclays. You may proceed with your question.
Okay, great. Hey, guys. Thanks for taking my questions here. How are y'all?
Pretty good. Glad to have you.
Hey. Awesome. Corey, maybe just to start with you. Helpful commentary on that ARR breakout in terms of a third of ARR coming from non-VM products, let's call it. I really want to zero in on the InsightIDR or the SIEM part of that equation. I think we're all seeing sort of the increased prioritization of VM in these times, but I'm curious, how are your customers approaching SIEM in a post-COVID-19 world?
Yeah, no, your observation is spot on. VM was clearly much stronger than we originally anticipated and communicated, which is sort of the backbone of how we think about raising. I would say in that context, SIEM was even stronger. We saw strong both priority and demand for cloud-based SIEM, and really have a few different things that actually go to that strength, is first and foremost, people recognize the need of modern SIEM for these modern times. As you have work from home, as you actually have more cloud-based applications, you actually have a different environment that you're monitoring. We saw our SIEM demand even stronger than the VM demand, which was strong itself.
That's great. Jeff, maybe for my follow-up for you, can you just remind us what the Net Revenue Retention was this quarter, and maybe just go a little deeper into it, what you're seeing in terms of gross retention versus upsell, cross-sell? Any more of the Net Revenue Retention would be helpful.
Sure. First off, on the gross retention, it was good and consistently has been in our historical range. No different this quarter in Q2. On the NRR, we declined a little bit from 106% to 105%. I just want to remind everyone that we anticipated that decline, that came in line with what we were forecasting. Both upsells and cross-sells were up year-over-year. In particular, the cross-sells were up. We had strong cross-sells, that really showed in the growth of ARR per customer, which increased by 20% year-over-year. I also want to point out that we don't really manage to this metric, but we manage the ARR growth, which is our key metric, which we're guiding to over 20% at the midpoint of our ARR guidance.
Yeah, no, absolutely. Definitely saw it. Thanks very much, guys. I'll get back in queue.
Thank you.
Thanks, Saket.
Thank you. Our next question comes from Matt Hedberg with RBC Capital Markets. You may proceed with your question.
Hey, guys. Thanks for taking my questions. Congrats on some really strong results. These are certainly uncertain times. Well done on that front. Corey, in your prepared remarks, you noted COVID really changes the conversations with CIOs and really pushes them faster to the cloud than maybe previously they would have moved. I guess at a high level, can you talk about the urgency of CIO's desire for this migration and which of your emerging products, which did well this quarter, you think could see the strongest long-term benefit from really this sort of this paradigm shift?
Yeah. It's a great question, Matt, thank you for joining today. I would say if you think about what's driving, it's really two fundamental issues. It's one, CIOs can no longer wait to actually digitize their operations. You said what's driving to the cloud is that digital commerce has to be front and center. Not just digital commerce, digital engagement and digital operations. People will no longer assume that you can actually stand by and do a slow transformation. If you want no better example of that, just look at what's happened in the healthcare industry, where something that was supposed to take 10 years overnight changed to telehealth. You see that same type of urgency across most industries, where there's an urgency to say, how do we actually make sure that we can engage our customers and our partners digitally?
At the same time, we think one of the great benefits is that CIOs and even boards are no longer under the illusion that you can actually just shift to digital operations primarily down to the cloud and ignore security. Security's now part of the conversation and part of the narrative. This is going to be an extensive transformation for most operations that's starting now, but it's going to be a multi-year effort as people actually really upgrade their core, both business operations and technology for the digital age, and it'll be primarily done in the cloud. As we think about why that's such a big driver, and that way we framed it as our security transformation solutions, and why that's such a big driver there is there's really a couple key things.
One, everyone knows that those environments and those digital environments are going to be under attack. People have to protect their modern environment. We see a massive demand driver for InsightIDR. In fact, we saw that for this quarter. If you look at the other part of our security transformation solution is just like DevOps stuff, more with less through automating much of the environment. We see strong going forward demand for InsightConnect, and we actually saw good healthy demand and execution this quarter, and we expect that to be durable also. Of course, last and probably most importantly if you think about the cloud, is that people have to manage security differently in the cloud.
That was a big part of the thesis around the DivvyCloud acquisition, is that security management will be absolutely essential in the cloud, and we believe that we acquired the best platform for that with DivvyCloud in that acquisition. Those are the core linchpins. It's cloud and applications, because remember, people have built the cloud applications to do this. Detection and response and automation we see as the core tenets to a cloud-enabled digital transformation.
Super helpful. Thanks, Corey. Thanks, everybody.
Thank you.
Thank you. Our next question comes from Gur Talpaz with Stifel. You may proceed with your question.
Okay, great. Thanks for taking my questions, and congrats on the quarter, guys. Corey, you talked about phase II of broader security spend. I was hoping you could elaborate a bit on that. How does that correlate the performance in the quarter? By that I mean, did you see trends improve as the quarter progressed?
Yeah. As you recall from last quarter, we expected things to actually slow down. By the way, we still believe in general that the overall both security spend and digital spend is tied to the economy, but it's not as tightly tied as we expected. What's quite clear is that people were not as paralyzed around security spend as we expected them to be. When you really think about the phase II, we knew that we were in a moment of this work from home, and what's the spend of work from home? What was positive that we didn't expect is people fairly quickly moved from the work from home, which lots of people got working quickly, and they started thinking about, what is this whole environment that we're likely to sustain through really mean for our operations?
People started continuing efforts that were aligned with their long-term technology strategy and the security strategy to support that. Efforts that were around improving and enhancing cybersecurity for a modern technology environment, lots of those initiatives continued at a pace much faster. I would also say that a surprising number of new initiatives got started in that same vein. If you think about how we look at the business, both what's happening and also the pipe that we actually see building, it was definitely much better than we expected when we had this discussion last quarter.
That's super helpful. Then Jeff, maybe one for you. The acceleration in ARR per customer was really interesting. Maybe you could elaborate a bit on what drove that. Is it growth in VM workloads which sounded better, growth in new solutions, or is it also a reflection of customer sizes perhaps getting bigger here as well? Thank you.
Yeah, I think it's across the platform, particularly cross-sells, IDR cross-sells. It's really all across the broad platform. Not no one specific item, Gur.
Okay, thank you.
Thank you, Gur.
Thank you. Our next question comes from Brian Essex with Goldman Sachs. You may proceed with your question.
Hi, guys. This is Arindam on here for Brian Essex. Congratulations on the quarter. Corey, first, starting with you, if I could. Last quarter you mentioned the introduction of your Flex program that kind of enables customers to temporarily expand their asset coverage at no extra charge. Just wondering if you could provide some color regarding any increase in overall monetizable asset base per customer because of the program. Have customers started deploying more seat-based deployments for VM solutions going forward? Some color on that would be really helpful. Maybe a follow-up for Jeff.
Yeah. First and foremost, by the way, thank you so much for the question. As we mentioned sort of last quarter in the framing is that it was primarily done to actually drive customer satisfaction and loyalty, and we did see a good, healthy uptake. Now, it is leading to increased pipeline, which we think is positive, but our goal was not monetization. Our goal was to really support our customers. That said, we do expect it to be a positive contribution over time to the business. I would not say that was a primary driver in this specific quarter in and of itself, because we launched in the quarter, and people were responding in the quarter.
It definitely actually helped with actually creating a strong relationship with our customers, which if you think about what really sets Rapid7 up for the sustained growth and profitability that we're pursuing, it's actually customers expanding their ARR per customer, which is one of our primary goals.
That's really helpful. Thank you. For Jeff, for you maybe, if you could provide some color on the average contract length that you witnessed this quarter. In general, have you seen kind of a shortening of the contract length, especially as we saw customers kind of constricting their budgets and trying to conserve cash in this period of economic uncertainty? Any color around that would be really helpful. Thank you.
Sure. Let me start off by saying, overall, the contract lengths did not meaningfully impact billings this quarter. Having said that, in the bookings, we actually saw them a little longer, with more payments annually. Since we're focused on ARR, contract lengths really aren't meaningful as they don't really relate to billings and cash flow. We're not really collecting the money. In other words, if we have a contract length that was 24 months, since we've converted to SaaS, we're not really getting two years' payments upfront. You really have to look at ARR as the key metric right now. Contract lengths don't correlate to cash anymore. That's really the net of it right now. It used to under the perpetual model, because then when we sold multi-years, we were paid all upfront. Again, I'll just reiterate that ARR is the key metric.
That makes sense. Thank you.
Thank you.
Thank you. Our next question comes from Rob Owens with Piper Sandler. You may proceed with your question.
Hey, guys. This is Justin on for Rob. I was just hoping to ask, maybe relative to the market landscape, what portion of opportunities in VM and the rest of the platform would you characterize as greenfield opportunities versus competitive wins? I know, Corey, you talked a little bit about the competitive wins in the quarter. If you could maybe just elaborate a little more on that.
Yeah. I would say that I have not heard of a big delta from our team. As you can imagine, is that we had strong growth in the cross-sell motion, and we're continuing to add net new customers. I have not heard from our team that we saw a material difference in our greenfield versus the competitive wins there.
All right, great. Just for Jeff, real quick, I know you mentioned 10% exposure to the heavily impacted verticals in the last quarter, if you could dive us back into that, relative to what you're seeing trends-wise. Are budgets freer than you expected or still pretty tight there?
Yeah. We don't see any change in that exposure. I will point out that we, again, when we provide our guidance, we did look at our verticals and sub-verticals, and we explained in our prepared comments what drove the high end of our guidance and the low end of our guidance. No change in the overall composition of our customer base relative to our guidance.
That said, I would say that we saw stronger than expected performance across most of the verticals, and that's both on the security transformation, which includes sort of the things that are helping people transform to the digital enterprise, and on the VM side, too. Much so that if you think about why we have confidence in our forward sort of outlook and being back on the model as we actually go into 2021, it's that we see our security transformation portfolio growing over 40% this year. We actually, in the VM side, we see that sustaining growth. Earlier in the comments, I talked about VM growing over 20% this quarter, which was great. Prior, I talked about VM growing in the 5% ARR range.
We actually think that that's over 10% ARR, and from a revenue perspective, we actually think that's in the mid to high teens. We feel pretty good about what we're seeing from an overall demand. That said, there's companies going bankrupt, there's going to be issues as people respond to COVID, we are seeing a higher level of fundamental demand.
That's great. Thanks.
Thanks.
Thank you. Our next question comes from Keith Weiss with Morgan Stanley. You may proceed with your question.
Excellent. Thank you, guys, and thank you. A nice quarter. Corey, I want to dig in a little bit in terms of sort of the changes that you're seeing in the industry. We talked about sort of digital transformation pushing more people to the cloud, that increase in certainty, increasing the priority of security analytics in general. Another big part of the story is getting your customers to buy more broadly across the portfolio. Are you seeing any change in that sort of that traditional kind of security mindset of we buy just only best-of-breed solutions to guys more willing to say, listen, there's real value add in having this all on one platform to be able to sort of garner the insights across multiple products. Is that starting to resonate more with your end customer?
Yes. Keith, that's a great question, and I would say that, keep in mind, our core thesis was that people would only buy an integrated solution if it was best in class. If you remember, our core aspiration is to actually be top ranked in everything that we do, be one of the top two solutions in every category that we participate in. We think that we're tracking well on that goal. Being in that space and demonstrating that we're a leader in VM, we're a leader in IDR, and we're leading in our emerging categories now positions us to be a space where customers are responding quite positively on our overall platform packaging bundle distribution model.
In fact, we're going to be actually bundling more platform selling strategies with our sales force over the course of this year and next year because we're seeing real customer intent and demand. That's because our customers get the sense, and they actually feel that they're not having to make a substantive trade-off. They're getting the benefits of platform economics. They're getting sort of deploy technology once and manage it, so they don't have to put a whole bunch of different collectors in their environment, get tighter integration, which delivers more productivity, but do that all with best-in-class performance on each individual category. That's what's so unique about what we're presenting at Rapid7.
It's best in class in every category, an integrated experience that lowers the cost of operations and gives people platform economics, which is especially important in this time as people really focus on total cost of operations.
Got it. If I can sneak one more in, just on the margin side of the equation. Really nice progress on the profitability side of the equation this year, but I feel like calendar 2020 comes with an asterisk because the expense dynamic is so different, especially with T&E and nobody's traveling, and your events change a lot. When you guys are talking about going back to the balance of growth and profitability in calendar 2021, is there an explicit step-up that we should be thinking about in terms of expenses when that T&E comes back in or sort of when these events come back in? Is it possible to sort of quantify it as, listen, because our guys aren't flying all around, we were able to save five, ten, $15 million this quarter or anything of that ilk?
Hey, no, it's a good question. We definitely benefited from T&E. I think one thing to keep in mind, Keith, is that we have, and always have had, a heavy inside sales model, we did not have the same.
Right
Growth T&E level as many companies. It was a benefit, but not as big a benefit as some of the other players in the market.
Right
As you actually see there. The second thing is that we actually focus internal on how do we actually drive our own operating leverage. We actually, when we look at things internally, we actually look at sort of like stripping it out, which is one way to think about that when Jeff and I talk about being back on our model, if you think about sort of like the three-year model where we're looking at, how we actually continue to grow at the same growth but continue to expand margin each and every year, we're factoring that in that says, like, listen, is the margin expansion has to be in place when the T&E benefit goes away. That allows us to actually think thoughtfully about how do we actually make investments in the near term.
The goal is when those T&E benefits go away and things return to more normal, we're still exiting with the same margin strategy that we have laid out. Now frankly, it's a year delayed with the whole COVID environment on the margin side.
Right.
Yet still, we're looking at how we actually improve the core underlying operating margin, and that's the primary thing that Jeff and I measure our team on.
Perfect. Excellent. A really nice quarter, guys.
Thank you so much, Keith.
Thank you. Our next question comes from Joshua Tilton with Berenberg Capital. You may proceed with your question.
Hi, guys. This is Andrew Smith on for Josh. Could you just remind us what you've experienced in the past when a customer would lay off employees? How long is the lag until it impacts Rapid7's business being as you price per asset or app and not necessarily per user? Thanks.
Well, I think it's not something that we look at heavily, to be clear, because we don't have that many, I would say, employee pricing models. What we find is that the underlying assets that companies have tend to grow at a faster rate than the employee base, and that's always been true. I would say that, secondly, it's probably even more true in this digital cloud era that we're actually in, where the cloud technology assets are likely to actually grow at a faster rate than any decline in the employee base. If you think about what we get paid at an underlying level, it's the technology infrastructure that's actually there. We try to make that simple and predictable for our customers, but it's still getting paid for the technology infrastructure, whether that's infrastructure in the cloud or whether that's assets that's in the traditional environment.
Great. Makes sense. Thanks.
Thank you.
Thank you. I'm not showing any further questions at this time. I would now like to turn the call back over to Corey Thomas for any further remarks.
Well, thank you all for joining us today. I also want to thank our team and our customers. This has been a difficult environment for everyone, but our team and our customers, and we're all working well together to actually make sure that we are delivering the technology that helps people really thrive in these times. Thank you all for joining us.
Thank you, ladies and gentlemen. This concludes today's conference call. Thank you for participating. You may now disconnect.