Ladies and gentlemen, thank you for standing by, and welcome to the Q1 2020 Rapid7 earnings conference call. At this time, all participants are in the listen-only mode. After the speakers' presentation, there'll be a question -and-answer session. To ask a question during the session, you need to press star one on your telephone. Please be advised today's conference is being recorded. If you require any further assistance, please press star zero. I would now like to hand the conference over to your host for today's call, Sunil Shah, VP of Investor Relations. Sir, you may begin.
Thank you, operator. Good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's first quarter 2020 financial and operating results, in addition to our financial outlook for the second quarter and full fiscal year 2020. With me on the call today are Corey Thomas, our CEO, and Jeff Kalowski, our CFO. We have distributed our earnings press release over the wire, and it is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast, and following the call, an audio replay will be available at investors.rapid7.com until May 15, 2020. During this call, we may make statements related to our business that are forward-looking under federal securities laws.
These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to our 2020 goals; the company's positioning; our financial guidance for the second quarter and full year 2020; the assumptions underlying such guidance, including the anticipated impact of COVID-19 on our financial guidance, business, financial condition, results of operations, and renewals; and our assumptions on the timing for economic recovery in the global economy and the impact of the DivvyCloud acquisition on our future results of operations and product strategy. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us.
Actual outcomes and results may differ materially from the expectations contained in these statements due to a number of risks and uncertainties, including those contained in our most recent annual report on Form 10-K, the current report on Form 8-K we filed with the SEC on April 28, and the subsequent reports that we filed with the SEC, including our Form 10-Q for the quarter ended March 31, 2020. The information provided on this call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by applicable law.
Our commentary today will be primarily in non-GAAP terms, and reconciliations between historical GAAP and non-GAAP results can be found in today's earnings press release. At times, in our prepared remarks or in response to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be one -time in nature, and we may or may not provide an update in the future on these metrics. With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey?
Thank you, Sunil. Good afternoon, everyone. Thank you all for joining us today on our first quarter 2020 earnings call. Before we dive into results, I would like to spend a moment on the current environment. The rapidly evolving situation with COVID-19 has created uncertainty for individuals and organizations across the globe. We are no exception. As we adjust to this environment, our priorities remain the health and well-being of our employees and surrounding communities while remaining responsive to the evolving security needs of our customers and prospects. To this end, we have actively monitored guidance from public health organizations. We've quickly and successfully transitioned to a remote working model in mid-March. We currently expect to remain in this mode until at least June. We are closely tracking regional guidance and regulations as we plan ahead.
As we navigate this uncertain environment, we will do our best to remain thoughtful and transparent and share as much as we can about what we are seeing in our business. Finally, from everyone here at Rapid7, I would like to share our thanks and gratitude to all the medical professionals and first responders who have worked tirelessly to care for our communities during these extraordinary times. Now, moving on to our Q1 results. We are pleased once again that we exceeded our guidance for both revenue and non-GAAP operating loss for the quarter. Rapid7 delivered Q1 total revenue growth of 29% year-over-year, led by strong products revenue growth of 33%. Our quarter ending ARR of $351 million was up 31% over the prior year, driven by continued customer demand for our Insight Platform.
We had a solid start to Q1 as we exited 2019 with sustained momentum in IDR and mid-market demand, though we began to see modest impacts from COVID-19 related purchase delays late in the quarter. Our customer base grew 14% year-over-year in the first quarter as we experienced continued wallet share gains as ARR per customer increased to $38,900, a year-over-year increase of 15%. We have also been pleased with our strong retention rates so far this year. Even amidst uncertainty, these results reflect our long-standing commitment to innovation as we have built multiple market-leading products on an integrated platform. We remain bullish on our long-term opportunity to deliver enhanced value and outcomes to our customers, both through sustained organic innovation and via strategic additions, such as our recently announced acquisition of DivvyCloud.
I would also like to highlight that while we, along with many others in the market, face a period of uncertain economic trends in the near term, I am confident in the resilience of our Rapid7 team. Our strong balance sheet, stable subscription revenue model, and secular growth market and security position us to weather the storm. Let me now share some context on how we are engaging with our customers and how that is influencing our current views. Entering the quarter, we saw sustained growth momentum in our IDR mid-market international segments. This positive business momentum continued until late in the quarter, when we began to see a more acute shift in decision-making processes, particularly in Europe, as customers assessed the impact of the escalating COVID-19 situation.
Our diversified product strategy provides a number of unique opportunities to manage COVID-19 related risks and focus on areas that provide the best opportunities for growth. We are optimizing around customer needs and aligning our focus to the most active product areas and customer segments. We continue to have a broad industry diversification, with our largest vertical representing approximately 15% of our ARR. In terms of customer segmentation, over 50% of our ARR today comes from enterprise customers, defined as organizations with over $1 billion in revenue. When further accounting for our mid-market customers, defined as organizations with greater than $100 million in revenue, this total mix grows to approximately 80% of our ARR. This frames a high level of durability we see in our business as we navigate the current environment. We have included further detail on this in our investor deck today.
I would note that based on our segmentation, less than 10% of our ARR is exposed to SMB segments, defined as organizations with less than $10 million of revenue and less than 100 employees. Across all segments, as digital initiatives accelerate, customers continue to prioritize security. We have seen healthy pipeline growth start the year, but the timing of this pipe is increasingly uncertain as organizations adjust midstream. The result is a wider range of outcomes as we look ahead to Q2 and beyond, which is reflected in our revised guidance range, on which Jeff will provide more detail shortly. Customers and prospects have voiced the critical nature of their security programs while acknowledging they are subject to shifting budgetary constraints around them. At the same time, these customers face unprecedented security challenges.
As organizations adjust to fully remote workforces, they must contend with increased asset exposure and decreased visibility. Rapid7 is enabling our customers to adjust quickly with our new Flex program. Flex offers the ability for customers to temporarily expand their asset coverage at no charge in an effort to help maintain their security posture as they adjust to the ongoing work-from-home dynamic. I am pleased to say that customers are leveraging Flex across our Insight Platform products, helping them more effectively manage risk to deliver improved security outcomes. This enablement is a reflection of our commitment to help close the security achievement gap on behalf of our customers. As we navigate this unique period with our customers, one thing remains constant. Security professionals are challenged to keep up with the increasing complexity amidst escalating risk and more acute resource constraints.
Our vision at Rapid7 is to build a leading cloud-based SecOps platform to address this need across our core platform pillars. We do this by helping customers lower the cost of visibility and time to value and accelerate their remediation capabilities. We have maintained a leadership position in vulnerability management for some time. In Q1, we saw further validation of our vision as Rapid7 was named a leader in the Gartner Magic Quadrant for Security Information and Event Management. Rapid7 is the only full-stack VM vendor to be recognized in Gartner's recently released Magic Quadrant for Application Security Testing and was the highest-rated vendor for dynamic application security testing. These achievements are also further validation of our best-of-breed platform strategy, built through a combination of both organic and inorganic investment. Our recent acquisition of DivvyCloud fits squarely into this strategy.
As cloud accelerates, security teams must grapple with new and emerging threat vectors. Security must further account for the greater influence DevOps teams bring to the process. DivvyCloud sits at the intersection of security and DevOps, solving the security stakeholder's need to manage risk, compliance, and governance while meeting the DevOps team where they are in the cloud, allowing them to accelerate innovation securely. The acquisition of DivvyCloud will extend the cloud security capabilities of Rapid7's Insight Platform, accelerating our ability to address foundational elements of customers' cloud programs by helping them secure their cloud assets. With the combination of DivvyCloud, InsightAppSec, and tCell, Rapid7 will be positioned to offer a leading set of solutions in the fragmented cloud and Application Security space. Let's turn to some updated perspectives on our 2020 goals.
Rapid7 remains focused on delivering sustained top-line growth, optimizing customer economics, and driving leverage in our business as we look ahead. With that backdrop, I would like to take a moment to reframe our 2020 goals within the context of our business priorities today. Our first goal is to reorient our focus around customer needs tied to the cloud and a more distributed workforce. It is clear that both the near-term and long-term trends support a broader and more accelerated shift to the cloud. Our ability to address customers' needs in this area will be a key driver of our opportunity to deliver sustained top-line growth as we look forward. Our second goal is to accelerate our platform distribution engine through partner momentum and by leveraging our unique best-of-breed technology platform advantage. This will enable us to drive improving customer economics over time.
Our third goal is to rationalize around the demand environment through strong expense controls that optimize for high ROI investments, minimize near-term free cash flow loss, and deliver sustained organic leverage in the business. Our commitment to profitable growth remains top of mind, and our guidance anticipates that we will return to operating income profitability in the fourth quarter of this year after absorbing the additional expense from DivvyCloud in the third quarter. Additionally, while it remains early in our planning cycle for next year, I will note that we currently expect to deliver free cash flow positive for full year 2021. In conclusion, Rapid7 is adjusting to our customers' needs in the current environment, and we will remain well-positioned to help solve the cybersecurity challenges facing resource-constrained organizations as they accelerate into the cloud. With that, let me turn the call over to our CFO, Jeff Kalowski. Jeff?
Thanks, Corey. Good afternoon, everyone. We're pleased to report healthy performance for the first quarter of 2020, with revenue and profit results exceeding our guidance amidst a shifting economic landscape. Before I begin, a few reminders. Except for revenue, all financial results we'll discuss today are non-GAAP financial measures unless otherwise stated. Reconciliations between our GAAP and non-GAAP results can be found in today's earnings press release. As we discussed on our last call, going forward, we'll be reporting products and maintenance and support revenue together under product revenue, as we believe this is a more useful way to look at our business. Turning to results, total ARR into the first quarter of 2020 at $350.9 million. Growth of 31% year-over-year. First quarter total revenue of $94.3 million exceeded the high end of guidance, growing 29% over the prior year.
This strength was driven by solid year-over-year product revenue growth of 33%, which benefited from strong renewal trends in the quarter. Recurring revenue constituted 90% of total revenue, compared to 85% a year ago. Our quarter-end customer count of over 9,000 increased 14% year over year and was approximately flat sequentially. This sequential result was driven by continued healthy growth in our platform customer base, which grew by over 200 customers sequentially, offset by fewer Metasploit and Nexpose transactional deals, legacy NetFort end-of-life churn, and a slower pace of new customer additions late in the quarter due to impacts of COVID-19. ARR per customer increased to approximately $38,900, up 15% year over year. Looking at the business geographically, North America grew first quarter revenue by 27% year over year, representing approximately 83% of total revenue.
Rest of world saw continued strong growth of 40% year-over-year, representing approximately 17% of total revenue. Turning to margins. Recall last quarter we spoke about front-loading of certain one-time expenses in Q1, such as our global kickoff event, which will impact year-over-year comparisons for certain expense lines for the first quarter. Total non-GAAP gross margin was 73% in the quarter, down from 75% last year, driven by lower professional services margin versus the prior year period, as well as continued increase in the mix of our Insight Platform products. Sales and marketing expenses were 47% of revenue in Q1 2020, up compared to 45% in Q1 2019 as a result of increased headcount costs and allocation of previously mentioned one-time expenses. R&D expenses were 21% of revenue, within our expected range and up slightly compared to 20% in Q1 2019, also due to allocation of one-time expenses.
G&A expenses in the first quarter were 10% of revenue, consistent with the prior -year period. We reported a non-GAAP operating loss of $3.9 million in the first quarter, better than our guidance range, driven by overachievement on revenue, T&E savings, and timing of marketing program spend. Adjusted EBITDA for the first quarter was a loss of $0.8 million, and non-GAAP net loss per share was $0.09, also ahead of guidance. We ended Q1 with cash equivalents and investments of $253.6 million. This is before approximately $131 million paid at closing for the acquisition of DivvyCloud. It does not reflect net proceeds of approximately $196 million related to our convertible notes offering and cap call, which we completed last week. Taking into consideration the acquisition of DivvyCloud and the convertible offering only, our current cash levels exceed $300 million.
Average contract length for Q1 2020 was 16 months, in line with last quarter. Operating cash flow for the quarter was negative $7.2 million, an improvement over negative $13.6 million in the prior year period. Now turning to guidance. Please note that our revised guidance includes the impact of the DivvyCloud acquisition for the second quarter and full year 2020. As we shared last week, we have spent considerable time over the past month speaking with customers and working to understand COVID-19 related impacts to our business at the industry and micro -vertical level. In constructing our revised guidance, we have performed both bottom-up and top-down analyses looking at financial stress and spend durability across sub-industry segments that we are exposed to.
Our analysis leveraged both internal and third-party data to frame risk across our customer base as it relates to both new business and churn and contemplated various economic recovery scenarios. This includes a U-shaped recovery as well as L-shaped and V-shaped scenarios that account for our best estimates of the COVID-19 related impact by sub-industry. The revised guidance range reflects our best assumptions across these scenarios with a baseline U-shaped recovery at the midpoint and assumes that, one, there are no new or recurrent shocks to the global economy, two, Q2 will see the highest negative impact of economic growth, and third, it is a long and steady road to economic recovery over a 12 to 24-month period. These assumptions are based on what we are experiencing today, which we are approaching as a moderate but sustained recession through the balance of the year.
We do not control the primary set of drivers, which will be how long the economy remains closed and at what pace it recovers when it reopens. We updated our guidance on April 28th with this framework in mind. For the full year 2020, we lowered and widened our ARR guidance range and now anticipate ARR in the range of $387 million-$407 million, or 14%-20% growth. We now anticipate revenue for the full year 2020 to be in the range of $388 million to $395 million, growth of 19%-21%, and non-GAAP loss from operations to be in the range of a loss of $3 million to a loss of $1 million. This anticipates the impact of the acquisition of DivvyCloud, and note that we will be required to record a fair value adjustment to DivvyCloud's deferred revenue, which will reduce revenue recognized in 2020.
We anticipate non-GAAP net loss per share to be in the range of a loss of $0.15 per share to a loss of $0.19 per share. This is based on 51 million basic weighted average shares outstanding for the full year 2020, given our projected non-GAAP net loss. We now expect cash flow from operations for the full year 2020 to be a loss of approximately $25 million. This reduction in cash flow relative to our prior expectation of positive $10 million contemplates the lower billings associated with our reduced ARR estimates for the year, absorption of the DivvyCloud business, and slightly higher assumed base billings outstanding through the current economic environment. Our full -year guidance anticipates that our visibility in the fourth quarter is particularly low and anticipates lower renewal rate trends despite solid trends to date.
As Corey shared earlier, and I will reiterate, with our major facilities expansion behind us and a sustained focus on driving leverage in the business as we look ahead, assuming a U-shaped recovery, we currently expect that we can deliver positive free cash flow for the full year of 2021. Moving now to quarterly guidance. As we reported on April 28th, we anticipate total revenue for the second quarter of 2020 to be in the range of $94.6 million-$96.2 million, growth of 20%-22%. We anticipate non-GAAP operating income for the second quarter to be in the range of $1 million-$2 million and non-GAAP net income per share to be in the range for loss of $0.02 to breakeven for the second quarter, which is based on an anticipated 50.7 million basic weighted average shares outstanding given our projected non-GAAP net loss.
In conclusion, Rapid7 remains focused on innovation and execution while continuing to help our customers and prospects deliver positive security outcomes through these uncertain times. With that, we appreciate your time and support and will now open the call for any questions. Operator?
As a reminder, to ask a question, you need to press star one on your telephone. To withdraw your question, please press the pound key. Please stand by while we compile the Q&A roster. Our first question comes from Michael Turits with Raymond James. Sir, you may proceed.
Hey, guys. Good evening. Corey and Jeff, first, can you perhaps parse for us the major factors behind the revenue and ARR reduction? In particular, whether it's retention, churn, reduction in ARR per customer, particular sector impacts, anything you can do to parse the biggest to the smallest factors. Maybe show us why the ARR reduction, which is more of a leading indicator, is so much steeper than revenue.
Yeah. I think you're right. First, Michael, thank you. You're right, it is a leading indicator. The first thing I'll highlight is that to reiterate the results, our results in Q1 were fairly strong. I think Jeff and I both indicated that retention was at the upper end of the range, which, as you remember, is 88%-90%.
We had a very strong start to the quarter, and we saw some limited impact of COVID-19 late in the quarter. The second thing I'd also say is that our April is off to a very solid start. It's still very early in the overall year. To get to your core question is with those factors, why sort of the reduction, it's driven by a couple factors. The first is that if you think about the macro environment, we anticipate the economy severely impacted in both Q2 and Q3. Even if you just take out of the impacted both regions and the impacted industries, you just see a slowdown in spending that typically occurs when there's uncertainty about the overall macroeconomic environment.
What you find is that we anticipate more impact in both Q2 and Q3, and we expect more visibility, therefore things picking up in the Q4 timeline. That affects the overall environment, every aspect of our customer base, even the ones that are healthy, by the way, because people are trying to figure out what's going on. We hear that from even our healthy customers that, by the way, are buying and have bought. They're, I would say, buying with some anxiety and trepidation because they're trying to figure out how it impacts their business overall.
The second thing that we actually factored in is Jeff's team did a very detailed, I would say, micro -segment and micro -vertical analysis that went through both all of the segments of the economy by size, then not just verticals but actually micro -verticals, where instead of looking at healthcare, you looked at large hospitals, different than smaller hospitals, and you looked at that different than providers, and you looked at that different than distributors in the healthcare ecosystem. We looked at the players that were likely to be impacted and not impacted along that. We compared that to our pipe, and we made some adjustments to our expectations based on where we think where spend was likely to happen in the year.
The other thing that I'd say is that when it comes to when you think about our overall expected renewal rates or retention, again, we start off the year fairly strong. We see strong intentions from our customers. It just did not feel like the right decision or responsible for us to reflect the strength that we've seen in the renewal base all the way throughout the rest of the year. We did put in a factor of expecting the churn to increase as the economy washed through. That just seemed like a reasonable thing to do based on the total macro environment that was happening.
The last thing I'd actually just say is that there are areas that we actually factored in core strength because we do see areas of strength in the overall business, specifically when you think about monitoring a distributed workforce and a more complex environment. When you think about cloud and application security overall, those are areas that we saw strength in, and we reflected that in our model. That was the primary driver. Sorry, that was a long-winded answer, Michael, but I want to make sure I covered all of it.
Yeah, Michael.
Hey, Jeff.
Two points on your question on the revenue: If you compare the midpoint of guidance on ARR versus where we were at the beginning of the year, excluding the DivvyCloud acquisition, it was about a $36 million drop. The reason the revenue does not drop as significantly is because of the ratable model, because that will come in later, and we have to take it over the course of one year. That's why you're seeing a bigger drop in ARR than revenue.
Then, I'm sorry, in case I missed it, did you quantify your exposure to what people might consider to be the impacted verticals by COVID, travel, etc.?
Yes, we did. We looked at our pipeline. We did an analysis of all the verticals and sub-verticals that were under financial stress. We looked at our pipeline as well as our renewal base, and that's all been baked into our guidance.
Yeah.
Right. Could you share with us.
Roughly, the rough approximation of that when you look at, especially at the highly impacted areas of hospitality, transportation, and retail, that impact is roughly 10%.
Right.
10% exposure.
Of the base.
Yeah.
Of the exposure. Yeah, of the exposure. Again, we still see both deals and activity happening in those areas, but that will be the highly exposed environment.
Great. Thanks, guys.
Thank you very much, Michael.
Our next question comes from Matt Hedberg with RBC Capital. Sir, you may ask your-
Hey, guys. Yeah, thanks, guys. Thanks for taking my questions. Corey, first of all, thanks for the color on the 200 sequential Insight customer adds. That was a helpful disclosure. I'm curious now; you noted April's off to a strong start. I wonder if you could dig into that a little bit more. Is it that once customers got comfortable in a work-from-home setting, they were just more comfortable making purchases? I'm just sort of curious if you could maybe give a little insight on why April is trending better.
Well, one, I think I characterized it as a solid start. We feel good. It's still very early in the quarter. I don't want us to get too far ahead. We feel good about April, and we felt like we should disclose that because of everything that's happening, we are biased towards a little bit more transparency now. My observation right now for what's actually happening is I think you see a couple different things happening. First and foremost, security is a priority. One of the things that I find interesting is even areas that are impacted, whether you look at education or hospitals or other areas, when I go out and I talk to those people, they're prioritizing security higher because of their increasing reliance on technology, which I find interesting overall.
What that means is that they're less likely to churn existing investments in security. Again, I think you have to assume that some businesses are going to be under severe duress, bankruptcy, other things, so you have to factor it in some level. It seems like when businesses have the choice, they're prioritizing the existing investments. The second thing that I'm seeing is that when it comes to projects that are both funded and have the staffing around that, by and large, for security, we're even seeing those projects move forward there. The ones where we're seeing more slowdown, oddly enough, is not related to security. What I'm seeing as I'm talking to customers, it's the ones where they actually have significant staffing associated with that. It's both having to spend money on our platform and our technology, as well as having to go hire a team.
I think companies are trying to rationalize how much headcount they're adding and the priority there, and that's where you see a little bit of the pressure and the slowdown.
That's helpful. Then maybe as a follow-up regarding your ARR guide, I think the midpoint on an organic basis is close to the mid-teens. I'm just curious if you can remind us how quickly you think the VM market is growing and if, in fact, you're outpacing that growth would be helpful.
Yeah. I'll make a comment. This is just based on the data we've reviewed so far: that one, I think in Q1, we continue to take share in the overall market, and we've grown well. The second thing I'll say is that we see VM as still a durable growth driver as we go forward. Now, in this pandemic environment, I think all growth, for most things, is less. If we looked at VM as the mid-teens growth, sort of like before, in this current environment, again, we do believe that we'll get out of the environment at some point; our expectation is that that comes down to the 5%-10% range. I would say also, we have the benefit, and we think that in that environment, we're still growing faster than the overall vulnerability management market, and we're still taking share on an apples-to-apples basis.
The other benefit that we do have is an ability to actually make our sales force efficient in this environment because we do have areas that are in high demand. We think that that's a net benefit to our ability to navigate the current environment.
Super helpful. Thanks, guys.
Thank you very much.
Our next question comes from Saket Kalia with Barclays. You may proceed.
Okay, great. Hey, guys. Thanks for taking my questions here. How are you?
Doing well. Thank you so much.
Hey, Corey, maybe first for you. Can you just dig a little bit into how you're handling the NetFort sort of customer base right now, both as a standalone base, just as importantly, as part of InsightIDR? What I mean by that is, I guess, how much did that end of life there sort of impact the customer count this quarter? Somewhat strategically, how is this going to sort of enhance the value for your InsightIDR base, if you will? Does that make sense?
Yeah, absolutely. I'll remind people that a little over roughly a year ago, we acquired NetFort to provide network visibility, which was a core detection capability that allowed us to actually move more into the enterprise market. What I would say is that first and foremost, you've seen that we actually got moved to the leader in the Gartner Magic Quadrant earlier in the year. We see great demand. IDR and especially our first data collection mechanism in IDR are an area that's providing solid demand even in this environment because we are one of the few solutions that natively out of the box collect endpoint data, no matter where people are staffed in the world that allows people to get visibility. We have the network data collection.
In this case, what you have with the NetFort technology is it feeds into our network detection capability that allows us to actually, one, get an additional data feed into the overall environment and, most importantly, do a higher level of forensics for our customers. This is especially important as our teams move more and more into the enterprise space. I'll tell you, we just launched it. So far, the interest that we've seen from the initial customers has been very good. The beta customers, or our teams, are starting to actually sell it. We're very optimistic about it, but it's a key part of our strategy to continue to grow and expand in the SIEM category, and we're seeing great demand there.
As far as the impact on customers, it was expected. I would say it was a modest impact. It was all expected because, again, we acquired NetFort not for the customer base that they actually had. We acquired them to actually be an extension of our core Insight Platform. That's what we're just starting the journey on.
Got it. That makes a lot of sense.
Thanks.
Yeah, sure. Maybe for my follow-up for you, Jeff. On that net revenue retention, feels like you've got a couple sort of puts and takes. I think we talked about an 80% number in terms of the ARR that's coming from the larger sort of non-SMB base. We also talked about sort of a prudent assumption of maybe increased churn through the rest of the year. Of course, the other variable in there is cross-sell, up-sell. Can you just sort of talk kind of qualitatively about how you're thinking about that net revenue retention number and how that could trend in the coming quarters?
Yeah. In Q1, it was 106%. We had a little headwind from our non-platform customers this quarter. If you look at our platform customers, it was higher than 106%. We expect it to go down in our estimates based on the higher churn rates and less cross-sell and up-sell and less renewals from that portion of the base. We expect it to go down over the course of the year.
Got it. Very helpful. Thanks, guys.
Thank you.
Our next question comes from Rob Owens with Piper Sandler. You may proceed.
Great. Thanks for taking my question. Good afternoon, guys. Corey, could you talk a little bit about InsightIDR, the strength you're seeing there? I guess as priorities have shifted at this point in time, help us understand why this has highlighted this environment, number one, and number two, just what a typical implementation looks like, how hands-on it has to be, and what a cycle might be there. Thanks.
Thank you, Rob. It's a great question. The strength I think that we're seeing in InsightIDR is really, I think, centered on two factors. One, as people rely more on technology, if you think about what COVID's doing in many ways, is if you were contemplating a digital strategy, that's accelerating. In a world where you know hackers aren't furloughed, you have to actually take security into account. For InsightIDR, what people are typically looking for is a how do I make sure that I'm protecting my technology environment to a higher monitor?" Part of the reason that we think that InsightIDR got more favorable, from a competitive position in this environment, is that people now are acutely sensitive to the need to integrate data from distributed endpoints all over the world of which that's a native capability of InsightIDR.
The second thing, I think, Rob, is your question about what does a typical deployment looks like. Look, it varies based on the size and scale and complexity of the technology environment. What I would say first and foremost is we're one of the few leading cloud-based SIEMs for detection response in the category. What that means is that people have to spend a lot less time doing the core infrastructure of getting it up and running. In this environment where people can't go in the office, having a cloud-based SIEM is a huge advantage. From my perspective, the fact that it's a cloud-based SIEM, the fact that it actually has native agents built into the core platform out of the box that communicate directly to the cloud all give a time to value and productivity for sophisticated environments.
That's sort of has me highly optimistic, and we actually see the momentum overall. The last thing that I'd say is that we're being a little bit more transparent. The timeframe is this is an area that we do see the opportunity to continue to grow at that hypergrowth rate above 40% as we go forward throughout the rest of the year.
Great. Then second, you mentioned it in your prepared remarks, but could you expand a little bit on your Flex program, how many customers actually took advantage of that, and does that lend to a backlog as you kind of look down the road as they might start monetizing those incremental assets that are being monitored?
Yeah, it's a great question. It's too early for the count, and frankly, I just don't have it in front of me right now. We are having good customer uptake. Not just discussions, the customer actually applying it. Rob, we did the program to actually make sure that we were there for our customers when we needed it. That was the primary focus of the program overall. What I would actually say is that the goodwill that it's actually generated and the feedback that we're hearing from customers does actually give us some optimism that as our customers make it through this process, their preference for Rapid7 is increasing. That's the hope and the aspiration. We're definitely seeing that from some of our customers, but that's not the primary reason that we actually put these programs in place.
All right. Thank you.
Thank you very much.
Our next question comes from Gur Talpaz with Stifel. You may proceed.
Okay, great. Thanks for taking my questions. Corey, I wanted to ask first what you're seeing in terms of your conversations around AppSec. It's something you're clearly investing in, especially here with DivvyCloud. I think more importantly, you touched on this in the prepared remarks, but as customers are migrating more workloads to the cloud, it seems like this would be a pretty important area. Maybe you could give us some color around what you're seeing out there these days.
Specifically to the cloud, Gur? I just want to make sure I got the question right.
To cloud and to broader AppSec.
Okay, AppSec in general. Yeah, it's interesting. One, I would say, look, over time, and this is part of the reason we are very, not just optimistic, we have a high belief in the core strategy around the visibility, analytics, and action-based automation is because people's desire to actually get a handle and scale their management of their technology from a cybersecurity perspective is increasing, and that's going to continue to increase. What I would say is that for the period that we're in right now, and the acute period that we're in right now, and by the way, I think this is independent of function. In security too, everyone's asking the question is, what's most essential, and what must I do right now, and where do I need to expand my focus? Where do I need to expand the coverage?
I would say, in general, people are trying to actually get a better understanding of their technology environment in general. Right now, people are acutely aware about, like, what are the risk areas that I have to manage more? What we see as the core assets that people are focused in on in this period of time is really cloud-based assets and managing a more distributed environment. I think that that will change, and that will go back to the steady pace that people were on when they were trying to, in general, expand their visibility and their understanding about the assets and the risk and the exposures in the overall environment on a more general basis. For right now, I think they are highly focused on the things that represent the most risk to the business form.
That's helpful. Then Jeff, maybe one for you. Corey touched on this in the prepared remarks, with the notion of being free cash flow positive in 2021. Maybe you could walk us through the inputs and where the confidence threshold for that sort of initial outlook comes from.
Yeah. First off, I'll say that we have strong expense controls, and we can manage our expenses in light of changing revenue conditions. While I don't want to give any specific guidance on 2021 ARR revenue targets, I think if you look at our implied growth rates in ARR towards the fourth quarter, you could look at that as an idea of how we would lever off of that, but it's still too early to really give you any specifics on what the ARR growth rates would be and the revenue growth rates would be for 2021. I'll preface this by also saying that it would be based on a U-shaped recession and looking at the Q4 exit rates as we come out of it.
That's helpful. Thank you.
Thank you.
Our next question comes from Brian Essex with Goldman Sachs. You may proceed.
Hi. Good afternoon, and thank you for taking the question. I guess, Jeff, maybe we can start with you a little bit. As I look at the guidance and where you've progressed so far in 1Q in terms of profitability, when we look at kind of where we need to get and where you're guiding for Q2, it seems as though that implies kind of breakeven performance for the last few quarters of the back half of the year. I guess how do you think about spending in that over the course of those few quarters? What levers do you have for better profitability, and how do you balance spending for growth versus profitability? Just kind of trying to get an understanding of changes you might make in this macro environment while still maintaining your focus on growth.
Right. You're correct in that we are going to show a profit in the fourth quarter, so you're right about the layering through the second half of the year with a profit in Q2. We are increasing expenses each quarter nominally. We've adjusted our discretionary spending, like T&E. We are still hiring and making high ROI investments in critical areas where we need to hire people. We've adjusted the overall expenses in line with our ARR and revenue reduction.
Yeah. I think the only thing I would actually add to that, if you look at how we manage it, one is we just take the mid- to long-term view. I think, as Jeff said, that we're going to exit the year in a positive mode. The second thing is I would just keep in mind is that we have curtailed expenses, but Divvy, which is strategic and has high demand as we see around it, does put us into a loss for the third quarter.
Just kind of factor that in, so that this quarter, you're dealing with the environment; next quarter, we're sort of addressing Divvy, in the fourth quarter, things turn around in the positive. I think that's a reasonable track record, and that also gives us confidence as we go into a model next year, both in profitability and free cash flow.
Got it. That's super helpful. Maybe just to follow up, I guess this is for either Corey or Jeff, is if you spend on sales and marketing, obviously, that spend has accelerated over the past 12 months or so. What is sales productivity like? What position is the sales force in to become fully productive, and how do you think about spend there as we kind of walk through the choppy environment, keeping in mind that it seems as though last year you were more focused on logo ads, this year, perhaps, more kind of expansion within customers?
Yeah. I'll give the high-level view of just how we're approaching it more than anything else, which probably explains the comments, is that the approach that we actually have is that, really, it has to be sustainable. What I mean by that is we're really focused on the sales productivity as we exit Q4 and expected productivity as we go into Q1. When Jeff talks about the good expense controls that we actually have in place, we will ensure that we actually match the expenses with the incoming ARR, but we're going to actually make that determination really based on the exit rate of this year and as we go into next year, not based on the massive uncertainty now. The reason for that, again, is that we've had some things be more positive than we would've expected.
If we had made a knee-jerk reaction, it would've been an overresponse. We're being very thoughtful and calculated in the near term, and we're really optimizing our model around both the exit rate and, most importantly, what that implies for both next year and as we enter next year.
Got it. Very helpful. Thank you.
Thank you.
Our next question comes from Sarah Hindlian with Macquarie. You may proceed.
Hi, everyone. Good afternoon. This is Calvin on for Sarah. Thank you for taking our questions.
Sure.
I was wondering if you could kind of comment a little bit on seasonality and potential upshifts and what areas you would see that as we start to open back up and as employees start to return back into the office.
Yeah. I mean, so that's one that probably I'm not going to comment on because I don't have any special knowledge there, is that, look, our model assumes a U-shaped recovery in the 12 to 24-month timeframe. The one thing that we actually just don't know is sort of like, is it going to immediately sort of open up sometime this quarter as people move in? Is that going to be Q3? I would say if you look at the midpoint of our model, we do assume sort of like at the midpoint, but that's why we give a wider range, a bottoming out sometimes at the end of the Q3 and things starting to pick back up at Q4. Again, that is something that we just don't know. That's much more sort of like a macroeconomic and a health question.
What we're looking at is sort of like how do we actually manage through an environment where we don't control either the health or the macroeconomics, and how do we actually match the ARR and the expenses, and how do we exit the year the right way and set up well for the next year? That's why we actually gave the ranges that we did.
Right. Thank you. Thank you for that. As a follow-up, we were kind of wondering, what do you really see as kind of the largest driver, just thinking larger term and longer term strategically from getting—you're close to 40K per customer and kind of going beyond that into the 45, 50 range? Is it this customer shift into the large enterprise, or do you think there's a part of the portfolio that's really going to drive that?
It's a good question. I'm going to look at it in two different lenses. The first is if you step back and just take it at a macro lens: one, we're accelerating both digital transformation, the cloud, but mostly we're becoming a more technology-dependent world. That's the first context. The second context is that we're becoming a more technology-dependent world in a world where security is a priority. That's the second thing. The third thing is that we have successfully built what I think about as a leading best-of-breed platform for managing security operations end-to-end. That puts us in a good long-term dynamic. You don't find many platforms where you not just have sort of leading products in one category and a bunch of mediocre products. We have leading products across multiple categories.
We're on a trend to actually be one of the top players in every category that we participate in. That combination, plus the macro trends, is the thing that actually still has our team, if you talk to our sales team and other folks, excited about what the long-term future holds outside of this post-COVID world.
Perfect. Thank you so much.
Thank you.
Our next question comes from Jonathan Ho with William Blair. Please proceed, sir.
Hi, this is John Weidemoyer for Jonathan. Thanks for taking our question. You talked about controlling costs and headcount and such. I'm wondering from the perspective of comparing this COVID environment to the pre-COVID world, from the perspective of new product introductions and international expansion, do you anticipate that it'll be essentially at the same pace? Or how would you characterize those two elements if COVID were to be an extended environment, like the next several months up to a year or more, comparing that to what you had been doing prior to that? Obviously, DivvyCloud is an element of augmenting your product suite, but that probably had been in your pipeline probably pre-COVID or right as COVID was occurring. Could you talk about, in general, new product development and international expansion in a COVID world?
Yeah, absolutely. Of course, I won't go into specifics into new unannounced technologies. What I would say is that first and foremost, the pillars that we have are the pillars that we are actually still committed to. That hasn't actually changed. If you think about our core product strategy, that hasn't changed. The second thing that I'd actually point out is that, look, when the world changes, you have to make adjustments, and you have to be thoughtful, but you have to make adjustments quickly under uncertainty, and then you have to respond to the feedback that you're actually getting in the market. Because of that, we are prioritizing our spend and our investments in certain ways. The way I would say it, we're putting specific emphasis where we're reallocating dollars and investments.
At a higher level, if you think about where our core focus is, it is helping people manage distributed complex environments from a technological perspective. That impacts all of our products, but all of our products are also focused on managing that challenge and simplifying that challenge for our customers. It's focused on helping people accelerate to the cloud, because people actually are having to move to the cloud and deliver new platforms and new services faster, and it's focused on helping our customers augment and improve their operational efficiency. All of these were things that were sort of like in the hopper before, but we're putting specific emphasis on those areas because those are the areas that are the most meaningful to our customers. If we act quickly and decisively and provide value to our customers, then we actually think that sets up the best long-term dynamic.
Okay, that's helpful. Thank you. Similarly, in the area of IoT and OT, that's still a very nascent arena. Has that been pushed off further into the background by customers, prospects, and such because of the current environment? Could IoT and such, with the remote elements that are involved there and/or being more remote, could that create more of an opportunity in the medium term and kind of move that a little forward as a result of the current environment?
I've said before, we will focus at some point in time and deliver on the IoT/OT. I would say that it is not an urgent priority for customers right now. If you look at almost any survey where we talk to customers, their urgent priority is around managing a complex distributed workforce and about how do they accelerate to the cloud. There's lots of areas that customers are not focused on right now. That does not mean won't do it at some point. It's just they are focused right now on pressing items that are strategic and critical to their existing business.
Excellent. Thank you very much for the time. Appreciate it.
Ladies and gentlemen, this concludes our Q&A portion of today's conference. I would now like to turn the call back over to you, Corey Thomas, CEO.
Thank you all so much. I wish you all health and safety during this time. Thank you again.
Ladies and gentlemen, this concludes today's conference call. Thank you for participating. You may now disconnect. Everyone have a great day.