Earnings Call: Q2 2019

Aug 1, 2019

Good day, ladies and gentlemen, and welcome to the Q2 2019 Rapid7 Earnings Conference Call. As a reminder, this conference call may be recorded for replay purposes. It is now my pleasure to hand the conference over to Neeraj Mahajan, Vice President, Investor Relations. You may begin. Thank you, operator, and good morning, everyone. We appreciate you joining us today to discuss Rapid7's 2nd quarter financial and operating results in addition to our financial outlook for the 3rd quarter and full fiscal year 2019. With me on the call today are Corey Thomas, our CEO and Jeff Kalowski, our CFO. We have distributed our earnings press release over the wire and it is now posted on our website at investors. Rapid7.com, along with the updated company presentation and financial metrics file. This call is being live via webcast and following the call an audio replay will be available at investors. Rapid7.com until August 8, 2019. As a reminder, our discussion today contains forward looking statements about events and circumstances that have not yet occurred, including, without limitation, statements regarding our objectives of future operations and future financial and business performance. These forward looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the expectations contained in these statements due to a number of risks and uncertainties, including those contained in our most recent quarterly report on Form 10 Q and subsequent reports that we filed with the Securities and Exchange Commission. The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing projected or implied by such forward looking statements, and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by the applicable law. Our commentary today will be primarily in non GAAP terms and reconciliations between our GAAP and non GAAP results and guidance can be found in today's earnings press release. At times, in our prepared comments or in response to your questions, we may offer incremental metrics to provide greater insights into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be one time in nature and we may not may or may not provide an update in the future on these metrics. With that, I'd like to turn the call over to Corey. Thank you, Neeraj, and good morning, everyone. Thank you all for joining us today on our Q2 2019 earnings call. Rapid7 had another strong quarter driven by the strength of our Incyte platform products. We again exceeded the high end of our guidance. Year over year revenue grew by 35% and we generated non GAAP operating profit. We once again demonstrated strong ARR growth of 46% and remain confident of delivering over 30% ARR growth for the full year 2019. Our organic customer growth accelerated to 14%, one of the strongest quarters ever in customer additions. With NetFort, we ended Q2 with 8,400 customers, a growth rate of 16%. In addition, our customer economics remain strong as our platform strategy is working. Average ARR per customer increased by 25% year over year to over $34,000 and recurring revenue expanded to 87% in the 2nd quarter. We're again raising our full year 2019 guidance for total revenue based on the strength of our cloud based products business. We expect to generate leverage across our business and as we discussed in the last quarterly earnings call, we have increased investments in our business to achieve higher long term growth and sustainable profitability. These investments are well underway and we are focused on continued execution on these in the second half of this year. Therefore, we continue to expect non GAAP operating income to be breakeven in 2019. We are especially pleased with the momentum in our international business, where our investments are bearing fruit. We are seeing greenfield opportunities in regions like EMEA and APAC, where customers are increasingly starting to appreciate the ease of use, breadth of analytics and automated remediation capabilities of our Insight platform products. Our business is also benefiting from the investments we have been making to improve channel partnerships. Our partners are embracing our Insight platform and regional partners are increasingly driving expansion in North America. Now, let's review the quarter in the context of our 2019 goals. Our first goal was continue to focus on growth. We delivered strong growth in the 2nd quarter with ARR growth of 46% and revenue growth of 35%. Our updated guidance for 2019 revenue growth reflects our confidence in the business and strategic initiatives. We are winning and retaining customers because of the investments we are making in our business. Our big focus this year was on new customer additions and our sales incentives were aligned with this. We believe customer growth is the key to our long term sustainable growth because every customer we have today generates significant expansion opportunities over time. In addition, as we have expanded both the number of customers and ARR per customer, our team has done a good job of maintaining strong renewal rates. Additionally, our product roadmap resonates with customers. With more and more organizations adopting cloud technologies, the breadth of our Insight product offerings and the integration with cloud providers differentiates us. Our focus on constant innovation was evident at AWS's inaugural cybersecurity conference, Re:Inforce, where we had the opportunity to be a key presenter. Here we announced the integration of our Insight Cloud platform with AWS's new security hub. We also announced our cloud configuration assessment capability. As organizations migrate their infrastructure to the cloud, they need to understand the vulnerability risk as well as the configuration risk. Many solutions provide silo views and our customers have expressed dissatisfaction with such a non integrated approach. Now our customers with one solution can get visibility into traditional and cloud environments for vulnerability risk and configuration risk and can then automate the response to remediate. It is exactly this innovation and product roadmap that has helped us gain share in our key vulnerability management market as our customers appreciate Rapid7 technology depreciation and deeper integration with a broader security ecosystem. Our results also reflect strong performance across other products on our Insight platform, especially InsightIDR, As our SecOps vision resonates with the resource constrained organizations of all sizes, it is helping us win customers. One such example is our recent win of a large local government customer. This customer was looking to replace its legacy SIM solution because of high renewal costs, fatigue due to false positive alerts and the time it took to investigate actual events. Their testers were impressed with IDR's user behavior analytics, its ability to interrogate endpoints during alert investigations and response and predictability and pricing. But what really resonated with this customer was a seamless integration of VM and IDR solutions, allowing them to collect data more efficiently and drive overall productivity improvements. As a result, we won not just the SIEM business, but also the Vulnerability Management business. Our second goal is to continue to make it easier for our customers to adapt our platform and optimize our customer economics. This requires multiyear investment in systems and packaging to make it easier for customers to adopt, renew and expand usage of Rapid7 product portfolio and are a key part of our growth strategy. As I mentioned before, these investments are well underway and are already yielding results this year to set us up to deliver durable growth and sustainable profitability. Our third goal is to continue to drive leverage in our business. In the Q2, we generated a non GAAP operating profit of approximately $500,000 Jeff will talk about this in more detail. But while we feel confident about the path to profitability, we intend to continue investing for durable growth and profitability. Overall, the Q2 was another strong quarter for Rapid7 and we look forward to executing during the remainder of the year. With that, let me turn the call over to our CFO, Jeff Kalowski. Jeff? Thanks, Corey, and good morning, everyone. We're very pleased with our strong performance in the Q2 with results that exceeded our guidance on all metrics. Total revenue for the Q2 was $79,000,000 above the high end of our guidance and an increase of 35% year over year. This strong revenue growth was driven by better than expected product revenue growth, offset by a further decline in professional services revenue. In Q2, we also benefited from an existing customer expanding the scope of their term license, which resulted in approximately $1,000,000 of upfront revenue recognized in Q2. Total ARR grew to $290,000,000 at the end of the second quarter, a 46% increase year over year. ARR growth was primarily driven by strong new customer growth. Our customer count increased by 16% year over year and we ended Q2 with 8,400 customers globally. This includes a benefit from the NetFort acquisition that we closed in April of this year. Without NetFort, our organic customer growth rate accelerated from 12% to 14% in Q2. The quality of our customer base continues to improve as higher growth in our product customers more than offset the decline in service only customers. Our customer economics remain strong with average ARR per customer increasing to over $34,000 up 25% year over year. Strong growth in ARR over the past year drove 50% growth in recurring revenue. Recurring revenue now constitutes 87 percent of total revenue compared to 79% a year ago. Our focus on recurring revenue drove a 62% increase in our product revenue year over year. This was partially offset by a decline in maintenance and support revenue as Nexpo's customers migrate to the Insight platform, resulting in reclassification of maintenance revenue to product revenue. Therefore, it makes sense to look at product and maintenance and support revenue together, which collectively grew at 46% year over year. Our professional services business experienced a further slowdown and revenue declined by 27 percent year over year. This decline is primarily driven by the continued churn of transactional services only customers as our sales team gains momentum with our Insight platform. For the remainder of 2019, we expect professional services revenue to continue declining on a year over year basis. Looking at the business geographically, revenue from North America grew by 34% year over year and comprised 84% of total revenue. International revenue grew by 42% year over year and comprised 16% of total revenue in the 2nd quarter. Contract length for Q2 2019 was 14 months, down from 17 months a year ago and a decline from an average contract length of 15 months we reported in Q1 2019. Our overall renewal rate was 116% in Q2 2019 and as projected declined from last quarter. Our retention rate remains strong and the decline in this rate is a result of a lower forecasted ARR growth rate from 53% last year. Additionally, our increased focus towards new customer growth also contributed to the decline. As Corey mentioned, we are incentivizing our sales force on adding new customers and we plan to continue with this strategy as it maximizes our long term sustainable growth. As a result, we expect the overall renewal rate to stabilize around 110% by the end of 2019. Turning to margins. Total non GAAP gross margin in Q2 2019 improved to 75%, up from 73% last year. We continue to benefit from a shift towards a more favorable mix of higher margin product revenue. Our product non GAAP gross margin was 80%, up from 78% last year. Professional services non GAAP gross margins declined to 19% when compared to a margin of 38% in q2 2018 due to lower revenue as part of our continued focus on ARR and more strategic professional services. During the Q2, sales and marketing expense decreased to 45% of revenue when compared to Q2 2018 expense of 50%. This improvement reflects the operating leverage inherent in our business model. R and D expenses were 20% of revenue in Q2 2019 as compared to 23% in Q2 twenty eighteen. This lower percentage of revenue partially reflects an increase in capitalized software to account for increased investments in our Insight platform. G and A expenses in Q2 twenty nineteen were stable at 10% of revenue compared to Q2 last year. For Q2 2019, we generated non GAAP operating profit of approximately $500,000 well ahead of our guidance. Non GAAP operating margin was 0.6% compared to a margin of negative 10% in Q2 2018. This improvement is primarily driven by the over performance in revenue. Adjusted EBITDA for the 2nd quarter was $2,700,000 and diluted non GAAP net income per share was $0.02 also well ahead of our guidance. We ended Q2 with cash, cash equivalents and investments of $264,400,000 compared to $285,100,000 as of Q1 2019. The reduction from Q1 primarily reflects the cash outflow related to our acquisition of NetFort, which we acquired in April for approximately $15,000,000 in cash. During the quarter, operating cash flow was $2,500,000 as compared to negative $9,100,000 in the prior year, driven by strong collections, which brought our days billings outstanding back to a normal level. Given the decline in contract length and decline in professional services billing, we are projecting operating cash flow for the full year 2019 to be approximately breakeven. In Q2, our assets and liabilities increased $58,600,000 as a result of our new corporate headquarters lease and our property plant and equipment increased $25,800,000 due to the build out of the corporate headquarters. While we moved into our new corporate headquarters in July, the build out will continue to impact our free cash flow in Q3. Now moving on to the guidance. For Q3 2019, we anticipate total revenue to be in the range of $79,200,000 to $80,800,000 This guidance reflects the strength of our product revenue growth, which is offset by the decline in professional services revenue. We anticipate non GAAP operating loss in Q3 2019 to be in the range of $2,500,000 to $1,500,000 We anticipate non GAAP net loss per share for Q3 to be in the range of $0.04 to $0.02 which is based on an anticipated 49,200,000 weighted average shares outstanding. For the full year 2019, we are raising our guidance and now anticipate total revenue to be in the range of 318,000,000 to $321,000,000 which is 31% growth over 2018 at the midpoint. While we're again pleased to report non GAAP operating income for the Q2, we still continue to see plenty of investment opportunities. As we've stated before, we will invest any upside back into the business and as a result, we are still guiding to breakeven non GAAP operating income for 2019. We anticipate non GAAP net income per share to be $0.05 which is based on an estimated 52,300,000 diluted weighted average shares outstanding. The weighted average shares outstanding for the Q3 of 2019 represent basic shares outstanding given our projected non GAAP net loss. The weighted average shares outstanding for the full year 2019 represent the diluted shares outstanding given our projected non GAAP net income. Non GAAP net income for the full year 2019 largely represents interest income on projected cash and investments. On a GAAP basis, we expect a full year net loss for 2019. As a reminder, we recently moved our global headquarters and our consolidating facilities this year, and hence in Q3 and for the full year 2019, our free cash flow will be negative as a result of significant capital improvements, but these expenditures will decline substantially in 2020. In conclusion, Rapid7 had a strong second quarter and we look forward to delivering ARR and revenue growth of over 30% while significantly improving non GAAP operating margin compared to last year. With that, I want to turn the call back over to Corey for a few closing comments. Thank you, Jeff. Before I open up the call for questions, I want to take a minute to welcome our newest Board member. We are pleased to announce that Christina Kautomowski was the Global Head of Customer Success and Services at SLAC has joined Rapid7's Board of Directors. Christina has an impressive track record of operational excellence and has helped high growth software companies scale to the next level. With that, we appreciate your time and support, and we'll open the call for any questions. Operator? Thank you, Our first question will come from the line of Rob Owens with KeyBanc Capital Markets. Your line is now open. Great and good morning guys. Corey, I want to hone in a little bit on the strength in customer acquisition. And you mentioned Insight IDR. And as we look at the SIEM space overall, it's become noisier. So what's helping you cut through that? What's driving this? And maybe an update on InsightVM as it relates to customer acquisition as well? Yes, I mean, we're really hitting our stride. You can make about us as being roughly 4 years in. We have a compelling product capability with InsightIDR that we can expand. We're getting very comfortable in our go to market motion, so we know how to target our customers. And at the core of it, we actually have a solution that is fairly unique in the market. Again, most of these SIM products are designed for customers that have unconstrained resources. What we find is if you think about most of the market, whether you think about the mid enterprise or even what I think about as the margin constrained large enterprise companies, your retail companies, your healthcare companies, they have to figure out how they actually have the most productivity and the most impact with limited resources. And for us, we've really delivered a strong solution for that market and that's allowed us to continue to actually aggressively grow and gain share in the overall market. And more and more, our strategy and our value and our success in customers is speeding on itself, what customers are telling other customers and even industry analysts like Gartner and others are recognizing the value and the leadership that we're providing. Great. And then for my completely unrelated follow-up question. Given we're entering the Q3 here and what's typically a strong federal quarter, maybe an update or a reminder as to where you guys are relative to the U. S. Opportunity and percentage of sales, things of that nature? Yes, we're still very early stage in the overall both opportunity and it's a relatively small percentage of our overall sales. The way that we think about federal, it is massive upside if you look over the next 5 to 10 years, and we will be a major player in the overall federal market. But at the same time is that when you think about us having launched a pervasive cloud platform for security a few years ago and the federal government still being in the earlier stages of their adoption, our strategy is really to continue to grow our overall commercial presence. We are aggressively going in the overall state and local and education market that are highly receptive to our cloud based platform and strategy. And as the federal government standardizes its approach to cloud, you will see us play an increasing role there in the future. But again, our expectations are that federal is not a major contributor this year, frankly, even for the next few years. Great. Thank you. Thank you very much, Rob. Appreciate it. Thank you. And our next question will come from the line of Saket Kalia with Barclays Capital. Your line is now open. Hey, guys. Thanks for taking my questions here. Hi, Saket. Hey, first, maybe for you, Jeff. Obviously, another nice ARR quarter. On the renewal rates, you mentioned that they ticked down from, I think, 120% down to 116%, and we said that maybe those will stabilize as we get into the back half at around 110%. You talked to some of the drivers there around customer acquisition and such. But could you just go a little bit deeper into those and talk about how the expiring renewal rates are doing? How the upsellcrosssell component is doing? Just to understand that dynamic a little bit better? Sure. It's a good question. So first off, on the expiring renewal rate, those are still strong and they were in the 90% range, so there's no change there. I think as you heard Corey talk about, our focus this year is really on acquiring customers. So, while upsell and cross sell is still healthy, we've had a shift towards more new news, which drives the rate down. Also, we're forecasting an ARR growth rate from 53% to over 30% plus, right? So, you can't assume that that rate will stay the same given the decline. That's just not the way the math works. So overall, our rates are strong. So there's nothing negative in that expiring renewal rate whatsoever. Okay, got it. That's really helpful. Corey, maybe a little bit of a higher level question. A lot of success here so far in the first half of twenty nineteen. I know it's early to start talking about 2020, but just given the ARR upside that we've seen pretty consistently over the last few quarters, how do you think about that 2020 framework that you provided at the last Analyst Day? It's a good question. It's one that we actually get a lot. Of course, it's actually too early to actually give guidance for 2020. But if you think about the backdrop, in Analyst Day, we actually talked about a 3 year CAGR of 20% revenue growth and 30% ARR growth. We clearly performed well in excess of that so far and we actually have started off this overall year on a strong base. The thing that I think is the most important is we're extraordinarily both optimistic about the market and the performance of our teams. And so while it's too early for us to actually give specific guidance, what I will say is that we're very we're confident in the fact that we'll continue to be a growth company. We'll be growing revenue over 20% next year. We'll be growing ARR over that amount also. And I think about that as that we're a company that's centered on the large opportunity that's in front of us. We have a strong and healthy team, and we're going to be pursuing that aggressively. That said, we are going to come back with actually guidance later. It's just way too early to actually provide any guidance at this stage. Got it. That's really helpful. Thanks, guys. Thank you. And our next question will come from the line of Matt Hedberg with RBC Capital Markets. Your line is now open. Hey guys, thanks. Well done on the quarter. Corey, even backing out a NetFort acquisition, you guys still had a big quarter of new customer additions. Obviously, you talked about that. When you think about this sort of this focus on land, I think you said you guys feel confident that you can expand longer term. How do you think about adding the right number of sales headcount to support that level of customer growth? Yes. It's a very good question. So the simple way that we think about it, the reason that we're focusing on land right now is that in my mind it's always easy to expand. It's always easy to monetize the base. And so as long as possible we want to have these sales teams focused on actually acquiring new customers. When we think about how we grow our sales engine overall, The thing that we're in a good position right now, especially as we go into 2020 and forward, is that we have the ability to actually add sales people and still grow our leverage and profitability in the overall business. And so if you think about what we're really optimizing around is how do we have sustainable growth, which you hear us talk repeatedly about, while still expanding the leverage in the overall business. And we actually think our sales leadership and our operations team has done a good job in setting us up for that. Got it. And then maybe as a follow-up, obviously, the Capital One breach was in the news this week and it looks like it was perhaps a misconfigured laugh. Can you talk about that as an issue? And I believe you have a product called cloud configuration assessment that may help prevent a similar situation. Could you talk a little bit more about that as an issue? Yes, absolutely. I mean, I think the thing about cloud environment, so the first thing I'd say is Capital One is well regarded and has extraordinarily talented cybersecurity team. So I would say more than it'd be an issue specifically then, it just shows the complexity of managing cloud based infrastructure. The second thing is when you think about cloud based infrastructure, cloud based infrastructure is extraordinarily complex with a massive number of permutations, which is why you have to automate your ability to really understand what you have in your environment and how it's configured. And that's why we have such a massive investment in cloud configuration assessment and the analytics of understanding people's cloud exposure, which is different than traditional vulnerability exposure. This is clearly a problem set that we're targeting aggressively. We believe our CCA tower offering is relevant and will be more and more relevant in future. We just introduced the first version of that. It's on an aggressive expansion path in terms of capability. And I think Capital One just demonstrated more than anything the complexity of today's technology environments. Super helpful. Well done, guys. Thank you very much. Thank you. Thank you. And our next question will come from the line of Gur Talpaz with Stifel. Your line is now open. Hi. This is actually Chris Speros on for Gur. Congratulations on another great quarter guys. For Corey, when you acquired NetFort, you noted that it would advise you with the technology to better service some enterprise SIM use cases. Can you speak to the degree to which the acquisition has better enabled you to push up market? Yes, it's a good question. So when we acquired it, we talked about really three things. The first focus we set out the gates was going to be on focusing on enabling a higher level of enterprise use cases in SIEM and then we talked about the augmenting the VM visibility and then IoT long term. For all of them, we are in the technology integration phase. And so it's had no material impact on our go to market engine. And even in that context, our go to market engine for IDR has continued to expand. And we think that this will just be additional capabilities that makes it easier and easier for us to expand in the out years. But as of today, we're still in the technology integration phase. Okay. That's great. And as a follow-up again for you, Corey, your international business grew quite nicely in Q2. How should we think about your long term international opportunity and the degree to which this market currently remains greenfield? Yes. And so the we think about international as having a massive opportunity. We all know that it's lagged the U. S. In terms of both the awareness and the willingness to invest heavily in the main capabilities of cybersecurity. What we're seeing is a pickup in both interest and awareness. Some of it's driven by regulations and compliance. Some of it's driven by the international the connections that companies have around the world. But we are seeing a steady pickup. The way that I think about our international business performing is, it should continue to actually increase as a percentage of our business. If you think about what's happened recently, it's gone from 15% to 16% overall business. We expect that to continue to go up over time. What I'd say is our international team has done a very good job. I think the hard thing is that our largest business from a geography perspective is North America and that's continued to grow well, which just makes it a slower path that actually international becomes a larger and larger share of the business. But we expect those numbers to continue to go up steadily over time. Great. Thanks guys and congrats again. Thank you very much. Thank you. And our next question will come from the line of Michael Turits with Raymond James. Your line is now open. Hey, guys. Good afternoon, Michael Turits. I'd like to focus on the vulnerability management market. 1st, not exactly clean quarters from your key competitors here. How would you characterize the level of demand and growth in vulnerability management right now? Any slowing there? And are you is your focus on net customer adds an increasingly aggressive attempt to gain share there? It's a great question. So both questions. The first one is, we see the vulnerability management market is overall healthy. And we believe that we're both growing our share of the market. So to your second question, yes, we absolutely are focused on both short term and long term being the share taker in the overall vulnerability management market. And all the evidence and data we have suggest that we're doing an effective job of that. On your question on the overall market, we believe it's a healthy market and it's a fairly healthy market. The backdrop I'll actually provide is that at our Analyst Day, we said that the long term growth rate was a roughly 15% CAGR for the long term. We still believe that. We're clearly going well above that rate today. But we think about the vulnerability management market as a strategically long term and healthy market. Okay. And then can you comment on InsightIDR as a percentage of new ARR? You've talked about that in the past and non VM as a percentage of new ARR? Yes, Michael. So we have commented on IDR and it's again over 30% of the new ARR that we added in Q2. What we said is we're not going to comment on specific product lines, but with IDR, it is becoming a bigger portion of the total ARR revenue mix. So when it was 20%, we said we'd tell you when it's 30%, and it's still over 30%, and we'll update when it gets over 40%. So it's still very healthy. Great. Thanks a lot guys. Thank you. Thank you. And our next question will come from the line of Jonathan Ho with William Blair. Your line is now open. Good morning. I just wanted to see if you could give us a little bit more color on maybe what's driving the increase in ARR per customer. I just wanted to get a sense of, is this you guys are going after larger It's a good It's a good question, especially since we are coming out of the period, where you had the SaaS transition period. The primary driver is just the overall potential. One way to think about it is that if customers are fully deployed and they have all of our products, we've said before, there's roughly a $200,000 ARR per customer opportunity. The focus that we actually have internally is really a deep effect. Our biggest investment this year was on customer adoption and customer experience. And our fundamental belief is that if customers have a good experience, if they're adopting the technology, then they'll expand the technology because we have plenty of natural expansion opportunities. And what we're seeing that the increases are a combination of customers adopting more of our other products that's indicative of our overall InsightIDR, InsightAppSec, the offerings that we actually have available today, there's often more of our product offerings. At the same time, they're actually covering a broader range of their environments with those overall offerings. And that combination of things about what's the percentage of the environments covered overall and how many of the products are people using, that's actually driving overall expansion in the ARR per customer. Got it. And then just regarding the competitive landscape in the SIM space, like are you guys starting to see Microsoft Sentinel or Chronicle show up, I guess, more on the competitive side? Not in any material way. I mean, we've seen snippets of it. My expectation is it will show up more. The SIEM market the SIEM market is it's a competitive market. It always has been a competitive market and always will be a competitive market. We think we're extraordinarily well positioned in the market, but we will see increased competition, especially from Microsoft there. While we still partner with Microsoft in other areas too. And so we feel quite good about the overall competitiveness of our solutions and offerings, even though we expect the market to stay competitive. We do not think this gets any easier over time. We just think that we're well positioned in the market from a technology perspective and extraordinarily talented go to market team. Thank you. Thank you. Thank you. And our next question will come from the line of Greg Moskowitz with Mizuho. Your line is now open. Okay. Thank you. Good morning, guys, and I'll add my congratulations as well. So industry analysts have been talking more frequently about risk based VM and Gartner actually says that only 1% of enterprises will have adopted a risk based approach to vulnerability management by the end of this year. But I guess my question is, can it really be that low? And so Corey, I'd love your don't believe it's that low today and I don't think it will be that low. We see, I don't believe it's that low today and I don't think it will be that low. We see you think about the primary driver of our customers by inside VM, it is to operationalize VM. So while it may not fit into Gartner's model of it, customers are becoming more and more both risk and remediation centric over time. Now I think the trick and one of the misnomers there is that risk today does not mean that you cannot actually remediate key parts of your environment. And so the way that we actually sort of engage with our customers is you should understand your risk so that you're remediated in the right order, but you have to remediate all material issues and risk in your environment. You cannot have say like I just got the most critical risk in the environment, I can leave all the moderates and I'm fine. In fact, that's been proven that basically you're going to be highly likely to be compromised there. So what we're seeing is our mature customers are taking a risk centric approach to making sure they're making the right investments in the right order, but they're also taking a comprehensive approach that says, how do I actually drive remediation overall and the velocity of remediation. And that feedback from our customers is what's really pushed our investments in integrations, in automations and in alignment with IT teams to actually drive the pace of remediation overall. Okay. That's really helpful color, Corey. Thanks for that. And then for Jeff, can you elaborate on where you're making incremental investments? Also, when we see companies step up investment levels to drive more growth, it's typically a multi quarter event before we see margins normalize, and yet you have reiterated your full year operating margin and EPS targets. What gives you the confidence that you can still achieve those? Yes. So as we said in our prepared comments in the prior quarters that we continue to reinvest the over performance in revenue. And so while still achieving breakeven this year, the nature of those investments as we talked about in prior calls is really to improve our efficiency with systems, to enable customers to order easily, more multi product SKUs and systems to accommodate to make it easier for them to order. And we feel pretty good. It's not short term. It's going to be over the course of a year or 2, but we are making good progress. And the thing that I would add is the reason that we are confident that you'll see those investments show up in the P and L and while we'll still be breakeven for the year is that most of those programs and most of the people were successfully hired and launched in Q2. And so they're turned on as you go into Q3 and Q4. And so we have a good deal of visibility overall into the investments and the impact on the P and L. And so that's why we're still confident in the breakeven for the overall year. Terrific. Thank you. Thank you. And our next question will come from the line of Alex delineate a little bit between what you're seeing in the middle market and what you're seeing in the small or large enterprise market, if that's not a jumbo shrimp comment. Particularly where you have clients that don't have a SOC that probably in some cases may not even have a CISO. Can you talk a little bit about the rate of growth between those two segments and delineate some of the go to market differential there? Thanks. Yes. I would say both I would say the long term rate of growth in the markets we expect to be pretty aligned and pretty similar. I mean one thing to think about us is that because we have a broad product portfolio, we actually have the ability to actually meet customers where their existing needs are. And if you look and you think about the mid market customer is lots of them are starting cybersecurity programs around vulnerability management, incident, sexual response or application security for the first time. And so that's its own motion there, but there's lots of people that are starting programs. If you think about the enterprise motion, there's really 2 dominant things. They have something that lots of people either upgrading their programs or overhauling their programs. And so like I have something that I actually need to actually extend it and do more. And you can think about us actually adding a bunch of capability to complement. So like we can go in with our inside AppSec, we can go in with our VM, our SIEM or our orchestration automation, but we can complement and help them actually expand their RWA security program. And there are a number of customers and we'll find that massive amounts of opportunities there that are overhauling. And they're saying, I have invested in some things that is not relevant for the future. It's not what I need to be successful. So in the VM context that is, I want to operationalize our security and I want to have a way to think about my risk profile and remediation across my entire complex infrastructure that includes cloud and on prem. That's an overhaul and upgrade. We'll go in and people will upgrade us and they'll pay us more money than they paid the previous incumbent because they're actually buying a bigger vision and a bigger aspiration there. Similarly with InsightIDR, most SIEM projects are failed projects in the enterprise space because it's complex, it's expensive. And so you have a lot of failed projects in the Global 2,000 Companies, and we're starting the journey. We're having good traction to success in starting going in and upgrading those overall programs. So the way that we see it is we see both the mid market and the enterprise market as good growth drivers overall into the future. One more question, if I could. We just did a survey and we were surprised to see CrowdStrike show up in the VM space with reasonable penetration. Could you talk a little bit about whether you're seeing CrowdStrike and how they impact the competitive dynamics when you do? Thanks. Yes, so we don't see CrowdStrike as a material competitor in any way for enterprise vulnerability management deals. I would say similar to like Sophos and Microsoft is there's many endpoint companies that cover vulnerability management on the endpoint and provide visibility, vulnerability on the endpoint and there's a source of vulnerability data. But we're not seeing CrowdStrike as a competitor for any enterprise vulnerability management project. I mean, one way to think about it is the first thing that you have to do is be able to actually know what's managed and unmanaged, which scanning tends to be a more effective mechanism to actually do that. But also you're actually covering more than just a desktop. You have a massive long tail. So like most companies that are starting new enterprise vulnerability manager projects are putting the cloud in the context of what they're doing, which is why our customer adoption of CCA got off to a furious and fast start with lots of momentum out the gate. And so we're not seeing them there. But they do, just like others, just like Microsoft, just like Sophos and others, they do provide vulnerability information and context on the endpoint, but that's different than sort of like participating in the enterprise vulnerability market and RFPs. Great. Thanks and great quarter. Thank you very much. Thank you. Our next question will come from the line of Keith Weiss with Morgan Stanley. Your line is now open. Thank you, guys. Also a great quarter. Maybe thinking like the opposite side of that question, we talked a lot about the competition from cloud vendors. Can you talk a little bit about sort of the benefits that you expect to get from relationships with like the one you're describing with AWS and when we could start to see that come through into the model? Yes, absolutely. We've been spending a lot of time and we'll be spending more time in the overall cloud market. We really think about it in 2 separate ways. 1 is that we have to have good relationships just to make sure that our technology not just works, but is productive and efficient for our customers. One of the things about cloud environments is it's primarily a la carte model. So the barriers of so if you think about a la carte model with low barriers to entry, what that tends to lead to is extraordinarily high management complexity. And our role in the ecosystem is actually how do we actually reduce management complexity and allow people to manage large complex environments from a cybersecurity perspective. So we spend a lot of time with cloud players, both heavily with AWS, but also with Microsoft on how do we make sure our technology is productive for managing the complexity of cloud environments. And especially if you think about hybrid environments, because we still see this as a hybrid world for a very long time. The second thing that we're actually doing is we're spending more time on the go to market side. You saw that reflected, we talked about our time with AWS' in the Reinforce conference where we spent both time not just as a sponsor, but also time planning and talking about how we align and how AWS is aligned with us and how we align with them, and also spending time thinking about how we actually work with AWS's and eventually Microsoft's go to market teams to make sure that we're helping companies both transition to the cloud and manage cloud hybrid environments. So we look at as well technology and go to market. And we're still in the early innings on the go to market, but we're starting to actually make some public inroads there, which you've clearly seen. And the technology we've been working at for a while and we're going to keep working at. Excellent. And then maybe just one follow-up. You guys are doing really well in international markets. We have been hearing some murmurings of weaker demand trends. Anything on the macro side of the equation internationally that worries you guys at all? Not now. The thing that I would say is that we're probably not a good barometer for the broader market internationally just because we started later, it's still lower percentage of our business than you would see for a typical software company. So we just have lots of room to actually grow and scale. So we still see international at 16% of our revenue as a continued growth and expansion opportunity, but that doesn't necessarily have to reflect the broader market. And our next question will come from the line of Joshua Tilton with Berenberg. Your line is now open. Hi, guys. Thanks for taking my questions. First one, in the past, you would provide us with a breakout of potential average subscription ARR for each product. Have your views on these numbers changed? Does the SIEM maybe increase in wallet share with your clients? And could you possibly remind us of your expectation for InsightConnect? It's a good question. So I don't think we've made any material change in assumption of the average ARR for products. So there's been no change there. InsightConnect is just too early. Really, you can think about InsightAppSec and Insight Connect of having the dynamic is they're a buy and extend model. So I buy a set of workflows and I add more workflows over time. And so you're we're still estimating what's the average initial buy and then what's the expansion rate. And that just takes time. And that's part of sort of like things that we'll update as we go through our overall process of we sort of next year, but it's still too early to tell what that's specifically going to be. That was helpful. And then maybe I guess just a follow-up to that would be then, so SOAR is being viewed more and more as highly complementary to SIEM and obviously SIEM product is growing really great. So what needs to happen to just drive improved adoption for SOAR, especially from the customer base that's already buying IDR? Yes, for us, we believe it's just focus. I mean, we focused the last few years on the technology scale and end of use. And we are now we talked about now this year, we actually put it into limited release. Our next phase in our cycle is next year we expect to go into a broader release with more go to market resources aligned behind it. We think we have a good strategy and a good approach there, but it's mostly timing of how we actually go through our launch and market introduction strategy. We are fairly rigorous and fairly disciplined about how we approach these things, but we will be making significant investments in the overall store area and we have strong confidence that it will yield the fruit. All right. Thanks guys and congrats on the quarter. Thank you. Thank you very much. Thank you. I'm showing no further questions in the queue. Ladies and gentlemen, thank you for your participation on today's conference. This does