M&A Announcement

Apr 28, 2020

Slides

Ladies and gentlemen, thank you for standing by, and welcome to the Rapid7 Incorporated Conference Call. At this time, all participants are in a listen only mode. After the speaker presentation, there will be a question and answer session. Please be advised that today's conference is being recorded. I would now like to turn the conference over to your speaker today, Camille Schaub, Vice President of Investor Relations. Please go ahead, sir. Thank you, operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's proposed acquisition of DivvyCloud. With me on the call today are Corey Thomas, our CEO and Jeff Kalowski, our CFO. We have distributed our acquisition and Q1 2020 preliminary financial results press release over the wire and it is now posted on our website at investors. Rapid7.com. This call is being broadcast live via webcast and following the call an audio replay will be available at investors. Rapid7.com until May 5, 2020. During this call, we may make statements related to our business that are forward looking under federal securities laws. These statements are made pursuant to the Safe Harbor provisions of the Private Securities Litigation Reform Act of 1995, including statements related to our preliminary results for the Q1 of 2020, our financial guidance for the Q2 and full year 2020, the assumptions underlying such guidance and the timing of global economic recovery, the anticipated closing of the DivvyCloud acquisition, the impact of the DivvyCloud acquisition on our products, strategy and future results of operations, the anticipated growth of DiviCloud revenue post acquisition, the anticipated impact of COVID-nineteen on our guidance, business, financial condition and results of operations and our assumptions on the timing for economic recovery in the global economy. These statements reflect our views only as of today and should not be construed as representing our views as of any subsequent date. We do not have plans to update these statements except as required by law. These statements are subject to a variety of risks and uncertainties that could cause actual results to differ materially from expectations. For a discussion of the material risks and other important factors that could affect our actual results, please refer to those contained in our annual report on Form 10 ks filed with the SEC on February 28, 2020, and in subsequent reports that we file with the SEC from time to time, including our Form 8 ks filed with the SEC today and our quarterly report on Form 10 Q for the quarter ended March 31, 2020, that we intend to file in the near term. Additionally, a non GAAP financial measure will be discussed on this conference call. Please refer to today's press release on the Investor Relations portion of our website for a reconciliation of this measure to its most directly comparable GAAP financial measure. These documents are available in the Investor Relations section of our website. At times, in our prepared remarks or in response to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be one time in nature and we may or may not provide an update in the future on these metrics. Nothing on this call is intended to constitute an offer to sell nor a solicitation of an offer to buy any security. With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey? Thank you, Sunil, and good afternoon, everyone, and thank you for joining us on short notice. We're excited to announce the proposed acquisition of DB Cloud today and to share with you how this furthers our mission to help customers advance securely. Hopefully, by now, you've seen our press release sharing preliminary results for the Q1 of 2020 along with our revised guidance. It is clear the economic picture remains fluid and we believe it is important to be even more transparent during these times. So I will begin with some brief commentary on our preliminary results and guidance before covering DiviCloud. So that we can focus today's time on Divvy Cloud, we intend to hold all Q and A related to Q1 results, Q2 and full year 2020 guidance and the evolving COVID-nineteen situation for our earnings call scheduled for next Thursday, May 7. I look forward to taking those questions then. Starting with the Q1, we delivered solid preliminary Q1 results with ARR growth of approximately 31% year over year and revenue and non GAAP loss from operations both exceeding the high end of our guidance provided on February 10, 2020. We ended the Q1 with more than 9,000 customers, up 14% year over year and approximately flat sequentially from December 31, 2019 to March 31, 2020. This sequential result was driven by continued healthy growth rates in our platform customer base, which grew by 33% year over year, offset by fewer non platform transactional deals for Metasploit and Nexo's legacy NetFort, end of life related churn and slower pace of net adds late in the quarter due to shifting economic conditions precipitated by the COVID-nineteen pandemic. Average ARR per customer increased 15% year over year to approximately 38,900 dollars Renewal rates ended the Q1 in line with our expectations at 106% and continue to benefit from solid expansion trends offset by slowing non platform expansion. Our revenue retention rates remain strong and were at the high end of our historical range. Moving to guidance. Given the current economic landscape, clearly, we should be anticipating a broader range of outcomes than we provided guidance earlier in February. We have reflected this by lowering and widening our ARR guidance range to 14% to 20% year over year growth for full year 2020. We have spent considerable time over the recent weeks speaking with customers and working to understand potential industry and micro vertical COVID-nineteen related impacts to our business. In constructing our revised guidance, we have considered various economic recovery scenarios and their associated impact on both new business and churn. This includes a U shaped recovery as well as L shaped and V shaped scenarios that account for our best estimates of the COVID-nineteen related impact by sub industry. The revised guidance range reflects our best assumptions across these scenarios with a baseline use rate recovery at the midpoint that assumes that, 1, there are no new or recurrent shocks to the global economy 2, that Q2 will see the highest negative impact to economic growth and 3, it is a long and steady road to economic recovery over a 12 to 24 month period. These assumptions are based on what we are experiencing today, which we are approaching as a moderate but sustained recession through the balance of the year. We do not control the primary set of drivers, which will be how long the economy remains closed and at what pace it recovers when it reopens. Our guidance anticipates that our visibility in the 4th quarter is particularly low and that renewal rates maintain a lower trend line despite solid trends to date. Our revised guidance includes the impact of the Divvy Cloud acquisition for the Q2 and full year 2020, resulting in a modest non GAAP operating loss for the full year 2020 as a result of the acquisition. As a result of purchase accounting, we anticipate a fair value adjustment to Divvy Cloud's deferred revenue, which will reduce revenue recognized in 2020 by approximately $2,000,000 This reduction is roughly equal to the midpoint of our non GAAP operating loss for the full year 2020. Now shifting focus to DiviCloud. As digital transformation initiatives accelerate, cloud adoption across every industry, customers are grappling with new and emerging threat vectors. Security teams are challenged with managing an explosion of cloud workloads to enable agility and innovation while still managing risk and compliance. Forrester estimates that 57% of security decision makers are concerned about the risk that public cloud technologies introduced to their firm. As companies migrate to the cloud, they must also think about security differently. The influence of DevOps is critical in the process. DiviCloud sits at the intersection of security and DevOps, solving the security stakeholders need to manage risk and compliance while meeting the DevOps team where they are in the cloud, allowing them to innovate securely. DBcloud offers a cloud security posture management platform that enables visibility, automation and continuous security governance across multiple environments, including AWS, Azure, GCP and Alibaba. Their platform provides a unified view of a customer's cloud estate, enabling them to analyze and remediate and protect their estate against misconfigurations, policy violations, internal and external threats and identity and access management challenges. The acquisition of DBCloud will extend the cloud security capabilities of Rapid7's Insight platform, helping security and DevOps teams understand and manage governance, risk and security in their growing cloud environments. A great example of the platform's customer value proposition comes from a large media and entertainment company that has an active presence across AWS, GCP and Azure, With a mandate to assure risk and compliance of the overall enterprise, this customer chose DiviCloud because of its ability to automate governance, offer flexibility and enable better insight and control across all three clouds at the same time. Rapid7 is focused on providing our customers market leading solutions that address foundational elements of their security program. The acquisition of Divvy Cloud accelerates our ability to deliver these solutions in the fragmented cloud security space. Helping customers secure their cloud assets has been a critical goal and priority at Rapid7 and DiviCloud brings both the right technology and the right team help us deliver on this objective. With the addition of DiviCloud, Rapid7 will be able to offer leading products across each of our 4 major pillars: vulnerability management, detection and response, cloud and application security and security orchestration and automation. We view DBCloud Technology as a natural extension of our existing value proposition for customers, enabling us to provide a more holistic picture of risk across infrastructure, applications and now cloud workloads. In fact, this combined ability to provide a deeper and more comprehensive deal of risk to our customers is one of the key reasons the Divvy Cloud team chose to align with Rapid7. Both of our management teams see a great mission driven and cultural fit between the teams, which has always been critical to our success with companies we've acquired. We believe the Divvy Cloud team has built a truly innovative and customer centric business and we are thrilled to welcome them to and its customers to Rapid7 Family. We will continue to sell DiviCloud as a standalone offering, while also integrating it with our Insight platform products over time. I'm sure some of you might be asking, why is now the right time to do this? Let me take a moment to address that. 1st and foremost, we are doing this from a position of stress, both financially and operationally. We entered this period with a robust balance sheet, a compelling long term growth opportunity and security and a durable subscription business model, all of which empower us to make the right long term decisions for our business. We have further demonstrated over time our ability to deliver sustained growth while managing our expense structure and remain focused on strong expense controls as we continue to invest in the business. 2nd, I believe it is critical, particularly during periods of challenge that we not slow down or interrupt our pace of innovation. In the midst of all the recent changes, Rapid7 is taking action and moving forward on behalf of our customers because that is what they must do as well. As our customers increasingly pursue digital strategies that demand security, they have been asking us to deliver a best of breed solution in this area. Divvy Cloud delivers on this customer need addressing their growing preference for solutions that offer high levels of productivity, are cloud relevant and deliver a high ROI. At no time has it been more abundantly clear that the business transformation to cloud is happening. Attackers don't get furloughed and the current pandemic crisis is accelerating the need for us to help secure our customers' expanded position in the cloud. We believe acquiring DiviCloud will empower us to do this. Turning now to financials. I will cover a brief overview of the terms and impact of the transaction before opening it up for questions. Under the terms of the agreement, Rapid7 has agreed to acquire JiviCloud for a total purchase price of approximately $145,000,000 subject to adjustments to be paid in cash and stock. The acquisition is expected to close in the Q2, subject to customary closing conditions. We anticipate DiviCloud to contribute approximately $10,000,000 in incremental ARR to our business at the time of closing. DBCloud has been executing a hyper growth rate and we anticipate that it will continue to deliver strong growth looking forward. DiviCloud has approximately 50 customers across industries, including finance, technology, media, healthcare and retail. Finally, we intend to finance the acquisition through cash on hand. We have entered into a new revolving credit facility that provides borrowing capacity up to $30,000,000 with an accordion feature to expand potential borrowing capacity up to $70,000,000 In addition, we have announced our intent to offer $200,000,000 in convertible notes in a private placement. In summary, I want to reiterate Rapid7's commitment to closing the security achievement gap on behalf of our customers. The acquisition of Divvy Cloud positions Rapid7 as a leader in cloud security, visibility and automation, furthering our ability to help organizations of all sizes deliver positive security outcomes as they accelerate to the cloud. With that, I will turn the call back over to Sunil for questions. Sunil? Thank you, Corey. As a reminder, we ask that you hold all questions related to Q1 results, Q2 and full year 2020 guidance and the evolving COVID-nineteen situation for our quarterly earnings results call next week. We would appreciate it if we focus today's discussion on the DV Cloud acquisition. Operator, can we open the call for questions? Thank Our first question comes from Matt Hedberg of RBC. Your line is now open. Okay, guys. Thanks for taking my questions. Maybe I'll start with for Cory. I guess, I think Gartner talks about 20% growth for this market, CSPM. I wonder if you could talk a little bit about how you think about the size of this market? And then maybe a little bit more on the competitive landscape, I think would help us all. It's a great question. So, yes, I think about this as Gartner's what they rank as one of their fastest growing markets in security and overall. And we think about this as broader than just security posture management. If you think about what the DB cloud team has been able to do, it's really have a great anchor position in that market. But they've also been able to tackle things like identity, which is extraordinarily complex in the cloud and is a core area of risk as we move forward. Our bonds, we view this as primarily thinking about this as we got confidence if you think about the top down numbers of this having a potential to grow to a multibillion dollar market over time. And then you actually look at the bottom up analysis is more and more people are adopting cloud, more and more people are moving to the cloud. Cloud is where the game will be in infrastructure. And the ability to actually manage cloud security from configurations, policy perspectives, identity configuration perspectives and the infrastructure as a service will be the future battleground. And so we like the acquisition here because it places us not just where existing large opportunity is, but this is the core security battleground for enterprise security as we move to the future. And so we think about this as a multibillion dollar opportunity that both expands our TAM and allows us to be where the customer action is today. Thank you, Matt. That's great. And then maybe just one more. I think it looks like they have about 50 customers today, many of which are very large. I'm wondering if you could talk about maybe what an average deal size looks like for Divvy Cloud and how it's priced today? And I don't know if there's any confidence you can give us on how you which maybe plan to price in the future? Yes. If you have a range, I would say it's roughly a couple of 100 ks today. One of the things that attracted us to it is that this is a demand area that we got from some of our larger more complex customers. If you think about if you're a large customer, you don't have as much control over the security environment as you did on the traditional IT side. You have teams of developers, you got partners and you're responsible for security and the governance and the attestation around compliance. And so you need an integrated platform that gives you visibility, but also the ability to automate remediation of issues that come up. And so we do see this being biased towards the larger end of the market from the start. But what I would say is that our expectation is that any company that adopts cloud in any meaningful way and DevOps in any meaningful way will need this type of solution. And so while it's going to start at the enterprise level, we expect it to move constantly as people adopt and migrate more complexity into the cloud. I would say we have no current plans to make material changes to how they price it and approach it. They're extraordinarily smart and talented team. And if anything, we're just looking at how we accelerate the onboard demand that they've built. Thanks. We'll look forward to chatting next week. Thank you much. Thank you. And our next question comes from Gur Talpazda of Stifel. Your line is now open. Hi. This is actually Chris Giroz on for Gore. For Corey, put simply, why GIVI cloud and why now? Yes. It's a great question, especially why now. You can imagine that we thought about that heavily as we go through. So first and foremost, it's aligned with our strategy. If you think about the core four pillars of security operations, vulnerability management, detection and response, cloud and application security as well as SOAR and we said for a long time that we thought the fragmented cloud and application security market was a strategic market that both our customers were asking for and was relevant to our strategy about ensuring that cloud ensuring that overall security operations continue to be scalable and deliver the security outcomes people were looking for. And so it was highly, highly aligned with our strategy. The second thing is that it's an area that we've been contemplating for a while. We've been patient. We like to take our time. When we think about strategic acquisitions, we like them to be strategically aligned in an area where we already have existing customer demand in an area that we believe can be accretive over time and so affect that category. Then the question is, why do you actually really, act now in the midst of the COVID thing? I would say that otherwise we definitely would have done it, but why do you do it now in the midst of what's happening in the world? And one of the interesting things that we saw from our customer base is that the initiatives that we're getting green light green light right now were all about digital initiatives that help people engage with customers in a world where they cannot be person to person engagement. And most of those initiatives are actually being driven out of the cloud. And so our one of our beliefs as we were actually going through this is that cloud adoption is one of the things that accelerates over the next 18 months as people start thinking about not just how they work from home, but how do they engage their customers and consumers around the world in a digital way. And so while that's not a reason to do the deal, it actually provided additional confidence that if you've got to actually be in a market, you want to be in the market at the point of acceleration. And they have the right team, the right technology at a time when the market we believe is going to accelerate and that made all the logic in the world to us. That makes a ton of sense. One more if I may. To what degree does your customer base overlap with that of Divvy Cloud? We're just trying to understand the potential to sell the core suite of insights products into the Divvy Cloud enterprise installed base? Yes. So one thing we're excited about is sort of like the 2 different factors. 1, in our enterprise customer base and I'll remind you that 60 percent of our revenue comes from the company's over $1,000,000,000 and then we have good penetration in both the Fortune 500 as well as the Fortune 100. This has been an area that they've asked us for. So I've been in discussions where our customers were struggling with how they actually manage their cloud exposure and their cloud visibility and their actually cloud governance. The other thing is when we look at the DB cloud base, while we haven't released a significant number, we had a number of overlapping customers. And that all gave us confidence that between what we're seeing and interest we have from our sales team, the existing customer overlap, this is something that we think fits quite naturally into our portfolio overall. Great. Thanks guys. Thanks Chris. Thank you. And our next question comes from Greg Moskowitz of Mizuho. Your line is now open. Okay. Thank you very much. Corey, you mentioned that Davy Cloud is in hypergrowth mode. How fast are they growing? And roughly how many employees do they have? Yes. So I would say that we have not released the growth numbers. But I would just say, yes, but if we consider hyper growth anything over 50%, and they've been clearly growing in excess of that. I think we did share the amount of revenue that they actually had coming in. And so I think that if you look at the prior year, they actually had quite strong growth coming in. We expect good demand this year, but we are all living through something that we don't control, which is the pandemic, which we'll talk about on our call next week. And then, Greg, do you have a second question associated with that? Number of employees. Number of employees. It's roughly, I think, in the mid-70s. 70 to 8, right around there, correct. Yes, mid-70s. Okay, perfect. Thanks, Jeff. And then how should we think about the timeline to integrate DigiCloud? I know, Corey, you said it will be integrated with Insight over time. So if you could maybe expand on that as well as just go to market going forward? Thank you. Yes. No, it's a good question. So one, I would say that we looked at it I told you, we look at the smart team, we like the roadmap. So we're continuing to actually drive the roadmap that they have. We think we have the right strategy for customer adoption. We're starting with integrations with our core InsightVM and InsightIDR products. And then over time, it will move to our Insight cloud platform. That's not the first priority up to date, primarily because we think this can add instant value to our customers. But we would expect that in a reasonable timeframe that they would actually have an offering in our Insight cloud platform. But our first priority is to continue the momentum that we actually have in the market and focus on integration. Okay. Thank you. Thank you. And ladies and gentlemen, this does conclude our question and answer session. I would now like to turn the call back over to Corey Thomas for any closing remarks. So I just want to thank all of you again for taking the time at the last minute. This is something that we're extraordinarily excited about. The pandemic has lots of things to worry about in the world, but we feel very good about our ability to meet our customers' needs and that's the core focus of Rapid7 and our team and our organization. And we wish all of you help, as we go through this global pandemic together. Thank you again for your time.