Earnings Call: Q1 2020

May 7, 2020

Ladies and gentlemen, thank you for standing by, and welcome to the Q1 2020 Rapid7 Earnings Conference Call. At this time, all participants are in a listen only mode. After the speakers' presentation, there will be a question and answer session. Please be advised that today's conference is being recorded. I would now like to hand the conference over to your host for today's call, Sunil Shah, VP of Investor Relations. Sir, you may begin. Thank you, operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's Q1 2020 financial and operating results in addition to our financial outlook for the Q2 and full fiscal year 2020. With me on the call today are Corey Thomas, our CEO and Jeff Kalowski, our CFO. We have distributed our earnings press release over the wire and it is now posted on our website at investors. Rep7.com along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast and following the call, an audio replay will be available at investors. Rapid7.com until May 15, 2020. During this call, we may make statements related to our business that are forward looking under federal securities laws. These statements are made pursuant to the Safe Harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to our 2020 goals, the company's positioning, our financial guidance for the Q2 and full year 2020, the assumptions underlying such guidance, including the anticipated impact of COVID-nineteen on our financial guidance, business, financial condition, results of operations and renewals, and our assumptions on the timing for economic recovery in the global economy and the impact of the DBCloud acquisition on our future results of operations and product strategy. These forward looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially the expectations contained in these statements due to a number of risks and uncertainties, including those contained in our most recent Annual Report on Form 10 ks, the current report on Form 8 ks we filed with the SEC on April 28 and the subsequent reports that we filed with the SEC, including our Form 10 Q for the quarter ended March 31, 2020. The information provided on this call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward looking statements, and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by applicable law. Our commentary today will be primarily in non GAAP terms, and reconciliations between historical GAAP and non GAAP results can be found in today's earnings press release. At times, in our prepared remarks or in response to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be one time in nature and we may or may not provide an update in the future on these metrics. With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey? Thank you, Sunil, and good afternoon, everyone. Thank you all for joining us today on our Q1 2020 earnings call. Before we dive into results, I would like to spend a moment on the current environment. The rapidly evolving situation with COVID-nineteen has created uncertainty for individuals and organizations across the globe. We are no exception. As we adjust to this environment, our priorities remain the health and well-being of our employees and surrounding communities, while remaining responsive to the evolving security needs of our customers and prospects. To this end, we have actively monitored guidance from public health organizations, and we quickly and successfully transitioned to a remote working model in mid March. We currently expect to remain in this mode until at least June and are closely tracking regional guidance and regulations as we plan ahead. As we navigate this uncertain environment, we'll do our best to remain thoughtful and transparent and share as much as we can about what we're seeing in our business. Finally, from everyone here at Rapid7, I'd like to share our thanks and gratitude to all the medical professionals and first responders who have worked tirelessly to care for our communities during these extraordinary times. Now moving on to our Q1 results. We are pleased once again that we exceeded our guidance for both revenue and non GAAP operating loss for the quarter. Rapid7 delivered Q1 total revenue growth of 29% year over year, led by strong products revenue growth of 33%. Our quarter ending ARR of $351,000,000 was up 31% over the prior year, driven by continued customer demand for our Insight platform. We had a solid start to Q1 as we exited 2019 with sustained momentum in IDR and mid market demand, though we began to see modest impacts from COVID-nineteen related purchase delays late in the quarter. Our customer base grew 14% year over year in the Q1 as we experienced continued wallet share gains as ARR per customer increased to $38,900 a year over year increase of 15%. We have also been pleased with our strong retention rate so far this year. Even amidst uncertainty, these results reflect our long standing commitment to innovation as we have built multiple market leading products on an integrated platform. We remain bullish on our long term opportunity to deliver enhanced value and outcomes to our customers, both through sustained organic innovation and via strategic additions such as our recently announced acquisition of Divvy Cloud. I would also like to highlight that while we, along with many others in the market, face a period of uncertain economic trends in the near term, I am confident in the resilience of our Rapid 17. Our strong balance sheet, stable subscription revenue model and secular growth market and security position us to weather the storm. Let me now share some context on how we are engaging with our customers and how that is influencing our current views. Entering the quarter, we saw sustained growth momentum in our IDR Mid Market International segments. This positive business momentum continued into late in the quarter when we began to see a more acute shift in decision making processes, particularly in Europe, as customers assess the impact of the escalating COVID-nineteen situation. Our diversified product strategy provides a number of unique opportunities to manage COVID-nineteen related risks and focus on areas that provide the best opportunities for growth. We are optimizing around customer needs and aligning our focus to the most active product areas and customer segments. We continue to have a broad industry diversification with our largest vertical representing approximately 15% of our ARR. In terms of customer segmentation, over 50% of our ARR today comes from enterprise customers, defined as organizations with over $1,000,000,000 in revenue. When further accounting for our mid market customers, defined as organizations with greater than $100,000,000 in revenue, this total mix grows to approximately 80% of our ARR. This frames a high level of durability we see in our business as we navigate the current environment. We have included further detail on this in our investor deck today, but I would note that based on our segmentation, less than 10% of our ARR is exposed to SMB segment, defined as organizations with less than $10,000,000 of revenue and less than 100 employees. Across all segments, as digital initiatives accelerate, customers continue to prioritize security. We have seen healthy pipeline growth start the year, but the timing of this pipe is increasingly uncertain as organizations adjust midstream. The result is a wider range of outcomes as we look ahead to Q2 and beyond, which is reflected in our revised guidance range on which Jeff will provide more detail shortly. Customers and prospects have voiced the critical nature of their security programs, while acknowledging they are subject to shifting budgetary constraints around them. At the same time, these customers face unprecedented security challenges. As organizations adjust to fully remote workforces, they must contend with increased asset exposure and decreased visibility. Rapid7 is enabling our customers to adjust quickly with our new Flex program. Flex offers the ability for customers to temporarily expand their asset coverage at no charge in an effort to help maintain their security posture as they adjust to the ongoing work from home dynamic. I am pleased to say that customers are leveraging Flex across our Insight platform products, helping them more effectively manage risk to deliver improved security outcomes. This enablement is a reflection of our commitment to help close the security achievement gap on behalf of our customers. As we navigate this unique period with our customers, one thing remains constant. Security professionals are challenged to keep up with the increasing complexity of mis escalating risk and more acute resource constraints. Our vision at Rapid7 is to build a leading cloud based SecOps platform to address this need across our core platform pillars. We do this by helping customers lower the cost of visibility and time to value and accelerate their remediation capabilities. We have maintained a leadership position in vulnerability management for some time. And in Q1, we saw further validation of our vision as Rapid7 was named a leader in the Gartner Magic Quadrant for security information and event management. Moreover, Rapid7 is the only full stack VM vendor to be recognized in Gartner's recently released Magic Quadrant for application security testing and was the highest rated vendor for dynamic application security testing. These achievements are also further validation of our best of breed platform strategy built through a combination of both organic and inorganic investment. Our recent acquisition of Divi Cloud fits squarely into this strategy. As cloud accelerates, security teams must grapple with new and emerging threat vectors. Security must further account for the greater influence DevOps teams bring to the process. DBCloud sits at the intersection of security and DevOps, solving the security stakeholders' need to manage risk, compliance and governance, while meeting the DevOps team where they are in the cloud, allowing them to accelerate innovation securely. The acquisition of DiviCloud will extend the cloud security capabilities of Rapid7 Insight Platform, accelerating our ability to address foundational elements of customers' cloud programs by helping them secure their cloud assets. With the combination of DiviCloud, InsightAppSec and T Cell, Rapid7 will be positioned to offer a leading set of solutions in the fragmented cloud and application security space. Now let's turn to some updated perspective on our 2020 goals. Rapid7 remains focused on delivering sustained top line growth, optimizing customer economics and driving leverage in our business as we look ahead. With that backdrop, I would like to take a moment to reframe our 2020 goals within the context of our business priorities today. Our first goal is to reorient our focus around customer needs tied to the cloud and a more distributed workforce. It is clear that both the near term and long term trends support a broader and more accelerated shift to the cloud. Our ability to address customers' needs in this area will be a key driver of our opportunity to deliver sustained top line growth as we look forward. Our second goal is to accelerate our platform distribution engine through partner momentum and by leveraging our unique best of breed technology platform advantage. This will enable us to drive improving customer economics over time. Our third goal is to rationalize around the demand environment through strong expense controls that optimize for high ROI investments, minimize near term free cash flow loss and deliver sustained organic leverage in the business. Our commitment to profitable growth remains top of mind and our guidance anticipates that we will return to operating income profitability in the Q4 of this year after absorbing the additional expense of DiviCloud in the 3rd quarter. Additionally, while it remains early in our planning cycle for next year, I will note that we currently expect to deliver free cash flow positive for full year 2021. In conclusion, Rapid7 is adjusting to our customers' needs in the current environment, and we will remain well positioned to help solve the cybersecurity challenges facing resource constrained organizations as they accelerate into the cloud. With that, let me turn the call over to our CFO, Jeff Kalowski. Jeff? Thanks, Corey, and good afternoon, everyone. We're pleased to report healthy performance for the Q1 of 2020 with revenue and profit results exceeding our guidance amidst a shifting economic landscape. Before I begin, a few reminders. Except for revenue, all financial results we'll discuss today are non GAAP financial measures unless otherwise stated. Reconciliations between our GAAP and non GAAP results can be found in today's earnings press release. Also, as we discussed on our last call, going forward, we will be reporting products and maintenance and support revenue together under products revenue as we believe this is a more useful way to look at our business. Turning to results, total ARR ended the Q1 of 2020 at $350,900,000 growth of 31% year over year. 1st quarter total revenue of $94,300,000 exceeded the high end of guidance, growing 29% over the prior year. This strength was driven by solid year over year products revenue growth of 33%, which benefited from strong renewal trends in the quarter. Recurring revenue constituted 90% of total revenue compared to 85% a year ago. Our quarter end customer count of over 9,000 increased 14% year over year and was approximately flat sequentially. This sequential result is driven by continued healthy growth in our platform customer base, which grew by over 200 customers sequentially, offset by fewer Metasploit and Nexpose transactional deals, legacy NetFort end of life churn and a slower pace of new customer additions late in the quarter due to impacts of COVID-nineteen. ARR per customer increased to approximately 38,900, up 15% year over year. Looking at the business geographically, North America grew 1st quarter revenue by 27% year over year, representing approximately 83% of total revenue. Rest of World saw continued strong growth of 40% year over year, representing approximately 17% of total revenue. Turning to margins. Recall last quarter, we spoke about front loading of certain one time expenses in Q1, such as our global kickoff event, which will impact year over year comparisons for certain expense lines for the Q1. Total non GAAP gross margin was 73% in the quarter, down from 75% last year, driven by lower professional services margin versus the prior year period, as well as continued increase in the mix of our Insight platform products. Sales and marketing expenses were 47% of revenue in Q1 2020, up compared to 45% in Q1 2019 as a result of increased headcount costs and allocation of previously mentioned one time expenses. R and D expenses were 21% of revenue within our expected range and up slightly compared to 20% in Q1 2019, also due to allocation of one time expenses. G and A expenses in the Q1 were 10% of revenue consistent with the prior year period. We reported a non GAAP operating loss of $3,900,000 in the Q1, better than our guidance range, driven by overachievement on revenue, T and E savings and timing of marketing program spend. Adjusted EBITDA for the Q1 was a loss of $800,000 and non GAAP net loss per share was $0.09 also ahead of guidance. We ended Q1 with cash, cash equivalents and investments of $253,600,000 This is before approximately 131 $1,000,000 paid at closing for the acquisition of DiviCloud, does not reflect net proceeds of approximately $196,000,000 related to our convertible notes offering and CapCall, which we completed last week. Taking into consideration the acquisition of DivvyCloud and the convertible offering only, our current cash levels exceed $300,000,000 Average contract length for Q1 2020 was 16 months, in line with last quarter. Operating cash flow for the quarter was negative $7,200,000 an improvement over negative $13,600,000 in the prior year period. Now turning to guidance. Please note that our revised guidance includes the impact of the Divi Cloud acquisition for the Q2 and full year 2020. As we shared last week, we have spent considerable time over the past month speaking with customers and working to understand COVID-nineteen related impacts to our business at the industry and micro vertical level. In constructing our revised guidance, we have performed both bottom up and top down analyses looking at financial stress and spend durability across sub industry segments that we are exposed to. Our analysis leverage both internal and third party data to frame risk across our customer base as it relates to both new business and churn and contemplated various economic recovery scenarios. This includes a U shaped recovery as well as L shaped and V shaped scenarios that account for assumptions across these scenarios with a baseline U shaped recovery at the midpoint and assumes that, 1, there are no new or recurrent shocks to the global economy 2, Q2 will see the highest negative impact of economic growth. And third, it is a long and steady road to economic recovery over a 12 to 24 month period. These assumptions are based on what we are experiencing today, which we are approaching as a moderate, but sustained recession through the balance of the year. We do not control the primary set of drivers, which will be how long the economy remains closed and at what pace it recovers when it reopens. We updated our guidance on April 28 with this framework in mind. For the full year 2020, we lowered and widened our ARR guidance range and now anticipate ARR in the range of $387,000,000 to $407,000,000 or 14% to 20% growth. We now anticipate revenue for the full year 2020 to be in the range of $388,000,000 to $395,000,000 growth of 19% to 21% and non GAAP loss from operations to be in the range of a loss of $3,000,000 to a loss of $1,000,000 This anticipates the impact of the acquisition of DiviCloud and note that we will be required to record a fair value adjustment to DiviCloud's deferred revenue, which will reduce revenue recognized in 2020. We anticipate non GAAP net loss per share to be in the range of a loss of $0.15 per share to a loss of $0.19 per share. This is based on 51,000,000 basic weighted average shares outstanding for the full year 2020 given our projected non GAAP net loss. We now expect cash flow from operations for the full year 2020 to be a loss of approximately $25,000,000 This reduction in cash flow relative to our prior expectation of positive $10,000,000 contemplates the lower billings associated with our reduced ARR estimate for the year, absorption of the Divi Cloud business and slightly higher assumed base billings outstanding due to current economic environment. Our full year guidance anticipates that our visibility in the 4th quarter is particularly low and anticipates lower renewal rate trends despite solid trends to date. As Corey shared earlier and I will reiterate, with our major facilities expansion behind us and a sustained focus on driving leverage in the business as we look ahead, assuming a U shaped recovery, we currently expect that we can deliver positive free cash flow for the full year 2021. Moving now to quarterly guidance. As we reported on April 28, we anticipate total revenue for the Q2 of 2020 to be in the range of $94,600,000 to $96,200,000 growth of 20% to 22 We anticipate non GAAP operating income for the 2nd quarter to be in the range of $1,000,000 to $2,000,000 and non GAAP net income per share to be in the range for loss of $0.02 to breakeven for the 2nd quarter, which is based on an anticipated 50,700,000 basic weighted average shares outstanding given our projected non GAAP net loss. In conclusion, Rapid7 remains focused on innovation and execution while continuing to help our customers and prospects deliver positive security outcomes through these uncertain times. With that, we appreciate your time and support. We will now open the call for any questions. Operator? First question comes from Michael Turits with Raymond James. Sir, you may proceed. Hey, guys. Good evening. So, Corey and Jeff, first, can you perhaps parse for us the major factors behind the revenue and ARR reduction? And in particular, whether it's retention, churn, reduction in ARR per customer, sector particular sector impacts, anything you can do to parse the biggest to smallest factors? And maybe tell us show us why the ARR reduction, which is more of a leading indicator, is so much steeper than revenue? Yes. You're right. First, Michael, thank you. And you're right, it is a leading indicator. So the first thing I'll highlight is that the to reiterate the results, our results in Q1 were fairly strong. I think Jeff and I both indicated that retention was at the upper end of the range, which as you remember is 88% to 90%. And we had a very strong start in the quarter and we saw some limited impact of COVID-nineteen late in the quarter. The second thing I'd also say is that our April is off to a very solid start, It's still very early in the overall year. Now to get to your core question with those factors, why sort of the reduction there are? It's driven by a couple of factors. The first is that if you think about the macro environment, we anticipate sort of like economy severely impacted in both Q2 and Q3. And so even if you just take out of the impacted both regions and the impacted industries, you just see a slowdown in spending that typically occurs when there's uncertainty about the overall macroeconomic environment. And so what you find is that we anticipate sort of more impact in both Q2 and Q3 and we intact sort of like more visibility, so therefore things picking up in the Q4 time line. And that affects sort of the overall environment, every aspect of our customer base, even the ones that are healthy by the way, because people are trying to figure out what's going on. And we hear that from even our healthy customers that by the way are buying and have bought. They're, I would say, buying with some anxiety and trepidation because they're trying to figure out how it impacts their business overall. The second thing that we actually factored in is Jeff's team did a deep, very detailed, I would say, micro segment and micro vertical analysis that went through both, all of the segments of the economy by size. And then not just verticals, but actually micro verticals where instead of looking at healthcare, you look at large hospitals different than smaller hospitals and you look at that different than providers. You look at that different than distributors in the healthcare ecosystem. And we look at the players that were likely to be impacted and not impacted along that. We compare that to our pipe, and we made some adjustments to our expectations based on where we think where spend was likely to happen in the year. The other thing that I'd say, is that when it comes to when you think about our overall expected renewal rates of retention, again, we start off the year fairly strong. We see strong intentions from our customers. It just did not feel like the right decision responsible for us to reflect the strength that we've seen in the renewal base all the way throughout the rest of the year. So we did put in a factor of expecting the churn to increase as the economy washed through. And that was just seemed like a reasonable thing to do based on the total macro environment that was happening. The last thing I'll actually just say is that there were areas that we actually factored in core strength, because we do see areas of strength in the overall business, specifically when you think about monitoring a distributed workforce in a more complex environment, when you think about cloud and application security overall, those are areas that we saw strength in and we reflected that in our model. But that was the primary driver. Sorry, that was a long winded answer, Michael, but I want to make sure I covered all. Yes. Michael, I'll just add 2 points on your question on the revenue. If you compare the midpoint of our guidance on ARR versus where we were at the beginning of the year, excluding the GIPV acquisition, it was about a $36,000,000 drop. The reason the revenue does not drop as significantly is because of the ratable model, because that will come in later and we have to take it over the course of 1 year. So that's why you're seeing a bigger drop in ARR than revenue. And then I'm sorry, just in case I missed it, did you quantify your exposure to what people might consider to be the impacted verticals within by COVID, travel, etcetera? Yes. We looked at our pipeline. We did an analysis of all the verticals and sub verticals that were under financial stress. And so we looked at our pipeline as well as our renewal base and that's all been baked into our guidance. Right. Can you share it with us? Roughly the rough approximation of that when you look at especially at the highly impacted areas of hospitality, transportation and retail, that impact is roughly 10%, right? 10% exposure. Yes, of the exposure, yes, of the exposure. I mean, again, you'll still and we still see, both deals and, activity happening in those areas, but that will be the highly, highly exposed environment. Great. Thanks guys. Thank you very much, Mike. And our next question comes from Matt Hedberg with RBC Capital. Hey, guys. Thanks for taking my questions. Corey, first of all, thanks for the color on the 200 sequential insight customer adds. That was a helpful disclosure. I'm curious now, you noted April is off to a strong start. I wonder if you could dig into that a little bit more. Is it that once customers got comfortable in a work from home setting, they were just more comfortable making purchases? Just sort of curious if you could maybe give a little insight on why April is trending better? Well, I think I'd characterize it as a solid start. We feel good. It's still very early in the quarter, So I don't want us to get too far ahead. We feel good about April and we felt like we should disclose that because of everything that's happening, we are biased towards a little bit more transparently now. My observation right now from what's actually happening is I think you see a couple of different things happening. 1st and foremost, security is a priority. One of the things that I find interesting is even areas that are impacted when you look at education or hospitals or other areas, When I go out and I talk to those people, they're prioritizing security higher because of their increasing reliance on technology, which I find interesting overall. And what that means is that they're less likely to turn existing investments in security. Again, I think you have to assume that some business are going to be under severe duress, bankruptcy, other things. So you have to factor in some level. But it seems like when business have the choice, they're prioritizing the existing investments. The second thing that I'm seeing is that when it comes to projects that are both funded and have a staffing around that, by and large for security, we're seeing those projects move forward there. The ones where we're seeing more slowdown oddly enough is not related to security. What I'm seeing is I'm talking to customers. It's the ones where they actually have significant staffing associated with that. So it's both having to spend money on our platform and our technology as well as having to go hire a team. I think companies are trying to rationalize how much headcount they're adding and the priority there. And that's where you see a little bit of the pressure and the slowdown. That's helpful. And then maybe as a follow-up regarding your ARR guide, I think the midpoint on an organic basis is close to the mid teens. I'm just curious if you can remind us how quickly you think the VM market is growing and if, in fact, you're outpacing that growth, would be helpful. Yes, I'll make a comment. Again, this is just based on the data we review so far. That one, I think in Q1, we continue to take share in the overall market and we've grown well. The second thing I'll say, listen, we see PM as still a durable growth driver as we go forward. Now, in this pandemic environment, I think all growth for most things is less. And so if we looked at BM as the mid teens growth sort of like before, In this current environment, again, we do believe that we'll look at our environment at some point. Our expectation is that, that comes down to the 5% to 10% range. I would say also we have the benefit and we think that in that environment, we're still growing faster than the overall vulnerability management market and we're still taking share on an apples to apples basis. The other benefit that we do have is an ability to actually make our sales force efficient in this environment, because we do have areas that are in high demand. And we think that that's a net benefit to our ability to navigate the current environment. Super helpful. Thanks guys. Thank you very much. And our next question comes from Saket Kalia with Barclays. You may proceed. Okay, great. Hey guys, thanks for taking my questions here. How are you? Doing well, thank you so much. Hey Corey, maybe first for you. Can you just dig a little bit into how you're handling the NetFort sort of customer base right now, both as a standalone base and just as importantly as part of InsightIDR? And what I mean by that is, I guess, how much did that end of life there sort of impact the customer count this quarter? And somewhat strategically, how is this going to sort of enhance the value for your inside IDR base, if you will? Does that make sense? Yes, absolutely. And I'll remind people that, a little over roughly a year ago, we acquired NetFort, to provide network visibility, which was a core detection capability that allowed us to actually move more into the enterprise market. And what I would say is that 1st and foremost, you've seen that we actually got moved to the leader in the Gartner Magic Quadrant earlier in the year. We see great demand. IDR and especially our diverse data collection mechanism in IDR are the areas that's providing solid demand even in this environment because we are one of the few solutions that natively out of the box collect endpoint data no matter where people are staffed in the world that allows people to get visibility. We have the network data collection. So in this case, what you have with the NetFort technology is it feeds into our network detection capability that allows us to actually, 1, get an additional data feed into the overall environment and most importantly, do a higher level of forensics for our customers. And this is especially important as our teams move more and more into the enterprise space. Now I'll say we just launched it. So far the interest that we've seen from the initial customers has been very good. The beta customers or our teams are starting to actually sell it. We're very optimistic about it. But it's a key part of our strategy to continue to grow and expand in the SIM category, and we're seeing great demand there. As far as the impact on customers, it was expected to address. So I would say it was modest impact, but it was all expected because again we acquired NetFort not for the customer base that they actually had. We acquired them to actually be an extension of our core Insight platform, and that's what we're just starting the journey on. Got it. That makes a lot of sense. Maybe for my follow-up for you, Jeff. On that net revenue retention, it feels like you've got a couple sort of puts and takes. I think we talked about an 80% number in terms of the ARR that's coming from the larger sort of non SMB base, but then we also talked about sort of a prudent assumption of maybe increased churn through the rest of the year. And of course, the other variable there in there is cross sell, up sell. Can you just sort of talk kind of qualitatively about how you're thinking about that net revenue retention number and how that could trend in the coming quarters? Yes. So in Q1, it was 106%. We had a little headwind from our non platform customers this quarter. If you look at our platform customers, it was higher than the 106%. We expect it to go down in our estimates based on the higher churn rates in lower less cross sell and up sell and less renewals from those that portion of the base, we expect it to go down over the course of the year. Got it. Very helpful. Thanks guys. Thank you. And our next question comes from Rob Owens with Piper Sandler. You may proceed. Great. Thanks for taking my question. Good afternoon, guys. Corey, could you talk a little bit about InsightIDR, the strength you're seeing there? I guess, as priorities have shifted at this point in time, help us understand why this is highlighted in this environment, number 1. And number 2, just what a typical implementation looks like, how hands on it has to be and what a cycle might be there? Thanks. Yes. Thank you, Rob. It's a great question. So the strength I think that we're seeing inside IDR is really I think considered on 2 factors. 1, as people rely more on technology, if you think about what COVID is doing in many ways is if you are contemplating a digital strategy that's accelerating. And in a world where you know hackers aren't furloughed, you have to actually take security into account. And so for InsightIDR, what people are typically looking for is, how do I make sure that I'm protecting my technology environment in high end monitoring? Now part of the reason that we think that InsightIDR got more favorable from a competitive position in this environment is that people now are acutely sensitive to the need to integrate data from distributed endpoints all over the world, of which that's a native capability of InsightIDR. The second thing, I think, Rob, your question about like what does the typical deployment looks like. Look, it varies based on the size and skill complexity of the technology environment. But what I would say 1st and foremost is we're one of the few leading cloud based SIEMs for detection and response in the category. And what that means is that people have to spend a lot less time doing the core infrastructure of getting it up and running. In this environment where people can't go in the office, having a cloud based SIEM is a huge, huge advantage. And so from my perspective, the fact that it's a cloud based SIEM, the fact that it actually has native agents built into the core platform out of the box that communicate directly to the cloud, all give a time to value and productivity for sophisticated environments. And that's sort of like as we're highly optimistic and we actually see the momentum overall. The last thing that I'd say is that if you think about the expectations of a little bit more transparent in the timeframe is this is an area that we do see the opportunity to continue to grow at that hyper growth rate above 40% as we go forward throughout the rest of the year. Great. And then second, you mentioned it in your prepared remarks, but could you expand a little bit on your Flex program? How many customers took advantage of that? And does that lend to a backlog as you kind of look down the road as they might start monetizing those incremental assets that are being monitored? Yes, it's a great question. It's too early for the count and frankly I just don't have it in front of me right now. But we are having a good customer uptake and not just discussions, customer actually applying it. You know, Rob, we did the program to actually make sure that we were there for our customers when we needed it. That was the primary focus of the program overall. What I would actually say is that the goodwill that is actually generated and the feedback that we hear from customers does actually give us some optimism that as our customers make through this process, their preference for Rapid7 is increasing. So that's the hope and aspiration. We're definitely seeing that from some of our customers, but that's not the primary reason that we actually put these programs to All right. Thank you. Thank you very much. And our next question comes from Gur Talphet with Stifel. You may proceed. Hey, great. Thanks for taking my questions. Corey, I wanted to ask first what you're seeing in terms of your conversations around AppSec. It's something you're clearly investing in, especially here with DiviCloud. And I think more importantly, you touched on this in the prepared remarks, but as customers are migrating more workloads to the cloud, it seems like this would be a pretty important area. So maybe you could give us some color on what you're seeing out there these days? So, specifically to the cloud, I just want to make sure I got the question right. To cloud, it's a broader AppSec. Okay. It's assets in general. Yes, so it's interesting. So one, I would say, look, over time, and this is probably the way that we are very, not just optimistic, we have a high belief in the core strategy around the visibility, analytics and action based automation is because people's desire to actually get a handle and scale their management of their technology from a cybersecurity perspective is increasing. And that's going to continue to increase. What I would say is that for the period that we're in right now and the acute period that we're in right now, almost every and by the way, I think this is independent of function. But in security too, everyone's asking the question is, what's most essential and what must I do right now and where do I need to expand my focus, where do I need to expand the coverage. And so I would say in general people are trying to actually get a better understanding of their technology environment in general. But right now people are acutely aware about like what are the risk areas that I have to manage more. And what we see as the core assets that people are focused in on in this period of time is really cloud based assets and managing a more distributed environment. Again, I think that that will change and that will go back to the steady pace that people were on where they were trying to in general expand their visibility and their understanding about the assets and the risk and the exposures in the overall environment on a more general basis. But for right now, I think they are highly, highly focused on the things that represent the most risk to the business for them. That's helpful. And then Jeff, maybe one for you. Corey touched on this in the prepared remarks, With the notion of being free cash flow positive in 2021, maybe you could walk us through the inputs and where the confidence threshold for that sort of initial outlook comes from? Yes. First off, I'll say that we have strong expense controls and we can manage our expenses in light of changing revenue conditions. Well, I don't want to give any specific guidance on 2021 ARR revenue targets. I think if you look at our implied growth rates in ARR towards the 4th quarter, you could look at that as an idea of how we would lever off of that. But it's still too early to really give you any specifics on what the ARR growth rates would be and the revenue growth rates would be for 2021. And I'll preface this by also saying that it would be based on a U shaped recession and looking at the Q4 exit rates as we come out of it. That's helpful. Thank you. Thank you. And our next question comes from Brian Essex with Goldman Sachs. You may proceed. Hi, good afternoon and thank you for taking the question. I guess, Jeff, maybe we can start with you a little bit. As I look at the guidance and where you've progressed so far in 1Q in terms of profitability, when we look at kind of where we need to get and where you're guiding Q2, it seems as though that implies kind of breakeven performance for the last few quarters or the back half of the year. I guess, what how do you think about spending in that over the course of those few quarters? What levers do you have for better profitability? And how do you balance spending for growth versus profitability? Just kind of getting it trying to get an understanding of changes you might make in this macro environment while still maintaining your focus on growth? Right. You're correct in that. We still we are going to show a profit in the Q4. So you're right about the layering through the second half of the year with a profit in Q2. We are increasing expenses each quarter nominally. We've adjusted our discretionary spending like T and E. We are still hiring and making high ROI investments in critical areas where we need to hire people. But we've adjusted the overall expenses in line with our ARR and revenue reduction. And I think the only thing I would actually add to that, if you look at how we manage it, one, is we tend to take the mid to long term view. And so I think as Jeff said that we're going to exit the year in a positive mode. The second thing is I would just keep in mind is that we have curtailed expenses, but Divvy, which is strategic and has high demand, as we see around it, does put us into a loss for the Q3. And so you just kind of factor that in. So this quarter, you're dealing with the environment. Next quarter, we're sort of like addressing Divvy. In the Q4, things turn around and go positive. I think that's a reasonable track record and that also gives us confidence as we go into a model next year, both profitability and free cash flow. Got it. That's super helpful. And maybe just a follow-up, I guess, for either Corey or Jeff is, have you spent on sales and marketing? Obviously, that spend has accelerated over the past 12 months or so. What is sales productivity like? What position is the sales force in to become fully productive? And how do you think about spend there as we kind of walk through the choppy environment, keeping in mind that it seems as though last year you're more focused on logo ads this year and perhaps more kind of expansion within customers? Yes. I think the high level view of just how we're approaching it more than anything else, which probably is in the comments, is that the approach that we actually have is that really, it has to be sustainable. So what I mean by that is we really focus on the sales productivity as we exit Q4 and expected productivity as we go into Q1. So when Jeff talks about the good expense control that we actually have in place, we will ensure that we actually match the expenses with the sort of like the incoming ARR, but we're going to actually make that determination really based on the exit rate of this year and as we go into next year, not based on the massive uncertainty now. And the reason for that again is that we've had some things be more positive than we would have expected. So if we have made a knee jerk reaction, it would have been an over response. So we're being very thoughtful and calculated in the near term and we're really optimizing our model around both the exit rate and most importantly what that implies for both next year and as we enter next year. Got it. Very helpful. Thank you. Thank you. And our next question comes from Sarah Hindlian with Macquarie. You may proceed. Hi, everyone. Good afternoon. This is Calvin on for Sarah. Thank you for taking our questions. I was wondering if you could kind of comment a little bit on seasonality and potential upshift and what areas you would see that as we start to open back up and as employees start to return back into the office? Yes. I mean, so that's one that probably I'm not going to comment because I don't have any special knowledge there is that look, we our model is going to U shaped recovery in the 12 to 24 month timeframe. And the one thing that we actually just don't know is sort of like is, is it going to immediately sort of like open up some time this quarter as people move in? Is that going to be Q3? I would say if you look at the midpoint of our model, we do assume sort of like at the midpoint, but that's why we give a wider range, a bottoming out sometimes at the end of the Q3 and then start to pick back up in Q4. But again, that is something that we just don't know. That's much more sort of like a macroeconomic and a health question. And so what we are looking at is sort of like how do we actually manage through an environment where we don't control either the health or the macroeconomic and how do we actually match the ARR and the expenses and how do we exit the year at the right way instead of well for the next year. And that's what we actually gave the ranges that we did. All right. Thank you. Thank you for that. As a follow-up, I was we were kind of wondering what do you really see as kind of the largest driver just thinking larger term and longer term strategically from getting you're close to $40,000 per customer and kind of going beyond that into the $45,000,000 $50,000,000 range? Is it this customer shift into the large enterprise? Or do you think there's a part of the portfolio that's really going to drive that? It's a good question. So I'm going to look at it in 2 different lenses. The first is if you step back and just think at a macro lens, 1, we're accelerating both digital transformation, the cloud, but mostly we're becoming a more technology dependent world. So that's the first context. The second context is that we're becoming a more technology dependent world in a world where security is a priority. So that's the second thing. And the third thing is that we have successfully built what I think about as a leading best of breed platform for managing security operations end to end. And that puts us in a good long term dynamic. You don't find many platforms where you not just have sort of leading products that we participate in. And that combination plus the macro trends is the thing that actually still has our team, if you talk to our sales team and other folks excited about what the long term future holds outside of this post COVID world. Perfect. Thank you so much. Thank you. And our next question comes from Jonathan Ho with William Blair. Please proceed, sir. Hi. This is John Wallenberg for Jonathan. Thanks for taking my question. You talked about controlling costs and headcount and such. I'm wondering from the perspective of comparing this COVID environment to the pre COVID world, from the perspective of new product introductions and international expansion, do you anticipate that it will be essentially at the same pace? Or do you think that would be how would you characterize those two elements if COVID were to be an extended environment like the next several months up to a year more, would compare that to what you had been doing prior to that? I mean, obviously, DiviCloud is an element of augmenting your product suite, but that probably had been in your pipeline probably pre COVID or late as COVID was occurring. Could you talk about in general new product development and international expansion in the COVID world? Yes, absolutely. I won't go ahead. Of course, I won't go into specific into like new unannounced biopharmaceuticals. What I'd say is that 1st and foremost, the pillars that we have are the pillars that we're actually still committed to. That hasn't actually changed. If you think about our core product strategy, that hasn't changed. The second thing that I'd actually point out is that look, when the world changes, you have to make adjustments. And you have to be thoughtful, but you have to make adjustments quickly under uncertainty. And then you have to respond to the feedback that you're actually getting in the market. Because of that, we are prioritizing our spend and our investments in certain ways and in certain. I don't think that there's the way I would say, we will put a specific emphasis. We're reallocating dollars and investment. So at a higher level, if you think about where our core focus is, it is helping people manage distributed complex environments from a technological perspective. That impacts all of our products, but all of our products are also focused on managing that challenge and simplifying that challenge for our customers. It's focused on how people accelerate to the cloud because people actually are having to move to the cloud and deliver new platform and new services faster and it's helping our customers augment and improve their operational efficiency. All of these were things that were sort of like in the hopper before, but we're putting specific emphasis on those areas because those are the areas that are the most meaningful to our customers. And if we act quickly and decisively and provide value to our customers, then we actually think that sets up the best long term dynamic. Okay, that's helpful. Thank you. And similarly, in the area of IoT and that's still a very nascent arena. Could has that been pushed off into further into the background by customers, prospects and such because of the current environment? Or could IoT and such with the remote elements that are involved there and are being more remote, could that create more of an opportunity in the medium term and kind of move that a little forward as a result of the current environment? Shah:] So you know I sit for it. We will focus at some point in time and deliver on the IoT OT. I would say that it is not an urgent priority for customers right now. If you think about like if you look at almost any survey where we talk to customers, our urgent priority is around managing a complex distributed workforce and about how do they accelerate to the cloud. It's not that there's lots of areas that customers are not focused on right now. It does not mean won't do it at this point. It's just they're focused right now on pressing items that are strategic and critical to their existing initiatives. Ladies and gentlemen, this concludes our Q and A portion of today's conference. I would now like to turn the call back over to Corey Thomas, CEO. Thank you all so much, and I wish you all health and safety during this time. Thank you again. Ladies and gentlemen, this concludes today's conference call. Thank you for participating. You may now disconnect. Everyone have a great day.