Good day, ladies and gentlemen, welcome to the Q2 2019 Rapid7 earnings conference call. At this time, all participants are in a listen-only mode. Following management's prepared remarks, we will host a question and answer session. Our instructions will be given at that time. If, during your conference today, you do require operator assistance, press star then zero. An operator will be happy to assist you. As a reminder, this conference call may be recorded for replay purposes. It is now my pleasure to hand the conference over to Neeraj Mahajan, Vice President, Investor Relations. You may begin.
Thank you, operator, and good morning, everyone. We appreciate you joining us today to discuss Rapid7 second quarter financial and operating results in addition to our financial outlook for the third quarter and full fiscal year 2019. With me on the call today are Corey Thomas, our CEO, and Jeff Kalowski, our CFO. We have distributed our earnings press release over the wire and it is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast and following the call, an audio replay will be available at investors.rapid7.com until August 8, 2019. As a reminder, our discussion today contains forward-looking statements about events and circumstances that have not yet occurred, including, without limitation, statements regarding our objectives for future operations and future financial and business performance.
These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the expectations contained in these statements due to a number of risks and uncertainties, including those contained in our most recent quarterly report on Form 10-Q and subsequent reports that we've filed with the Securities and Exchange Commission. The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by the applicable law.
Our commentary today will be primarily in non-GAAP terms, and reconciliations between our GAAP and non-GAAP results and guidance can be found in today's earnings press release. At times, in our prepared comments or in response to questions, we may offer incremental metrics to provide greater insights into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be one-time in nature, and we may or may not provide an update in the future on these metrics. With that, I'd like to turn the call over to Corey.
Thank you, Neeraj. Good morning, everyone. Thank you all for joining us today on our second quarter 2019 earnings call. Rapid7 had another strong quarter, driven by the strength of our Insight platform products. We again exceeded the high end of our guidance. Year-over-year, revenue grew by 35%. We generated non-GAAP operating profit. We once again demonstrated strong ARR growth of 46%. We remain confident of delivering over 30% ARR growth for the full year 2019. Our organic customer growth accelerated to 14%, one of the strongest quarters ever in customer additions. With NetFort, we ended Q2 with 8,400 customers, a growth rate of 16%. Our customer economics remain strong as our platform strategy is working. Average ARR per customer increased by 25% year-over-year to over $34,000. Recurring revenue expanded to 87% in the second quarter.
We're again raising our full year 2019 guidance for total revenue based on the strength of our cloud-based product business. We expect to generate leverage across our business, and as we discussed in the last quarterly earnings call, we have increased investments in our business to achieve higher long-term growth and sustainable profitability. These investments are well underway, and we are focused on continued execution on these in the second half of this year. Therefore, we continue to expect non-GAAP operating income to be break even in 2019. We are especially pleased with the momentum in our international business, where our investments are bearing fruit. We are seeing greenfield opportunities in regions like EMEA and APAC, where customers are increasingly starting to appreciate the ease of use, breadth of analytics, and automated remediation capabilities of our Insight platform products.
Our business is also benefiting from the investments we have been making to improve channel partnerships. Our partners are embracing our Insight platform, and regional partners are increasingly driving expansion in North America. Let's review the quarter in the context of our 2019 goals. Our first goal was continue to focus on growth. We delivered strong growth in the second quarter with ARR growth of 46% and revenue growth of 35%. Our updated guidance for 2019 revenue growth reflects our confidence in the business and strategic initiatives. We are winning and retaining customers because of the investments we are making in our business. Our big focus this year was on new customer additions, Our sales incentives were aligned with this. We believe customer growth is the key to our long-term sustainable growth because every customer we add today generates significant expansion opportunities over time.
In addition, as we have expanded both the number of customers and ARR per customer, our team has done a good job of maintaining strong renewal rates. Additionally, our product roadmap resonates with customers. With more and more organizations adopting cloud technologies, the breadth of our Insight product offerings and the integration with cloud providers differentiates us. Our focus on constant innovation was evident at AWS's inaugural cybersecurity conference, re:Inforce, where we had the opportunity to be a key presenter. Here, we announced the integration of our Insight Cloud platform with AWS's new Security Hub. We also announced our Cloud Configuration Assessment capability. As organizations migrate their infrastructure to the cloud, they need to understand the vulnerability risk as well as the configuration risk. Many solutions provide siloed views, and our customers have expressed dissatisfaction with such a non-integrated approach.
Now, our customers with one solution can get visibility into traditional and cloud environments for vulnerability risk and configuration risk, and can then automate the response to remediate. It is exactly this innovation in Product Roadmap that is helping us gain share in our key vulnerability management market as our customers appreciate Rapid7's technology differentiation and deeper integration with the broader security ecosystem. Our results also reflect strong performance across other products on our Insight platform, especially InsightIDR, as our Tech Op vision resonates with the resource-constrained organizations of all sizes, it is helping us win customers. One such example is our recent win of a large local government customer. This customer was looking to replace its legacy SIEM solution because of high renewal costs, fatigue due to false positive alerts, and the time it took to investigate actual events.
Their testers were impressed with InsightIDR's user behavioral analytics, its ability to interrogate endpoints during alert investigations, and response and predictability in pricing. What really resonated with this customer was a seamless integration of InsightVM and InsightIDR solutions, allowing them to collect data more efficiently and drive overall productivity improvements. As a result, we won not just the SIEM business, but also the vulnerability management business. Our second goal is to continue to make it easier for our customers to adapt our platform and optimize our customer economics. This requires multi-year investment in systems and packaging to make it easier for customers to adopt, renew, and expand usage of Rapid7 product portfolio and are a key part of our growth strategy. As I mentioned before, these investments are well underway and are already yielding results this year to set us up to deliver durable growth and sustainable profitability.
Our third goal is to continue to drive leverage in our business. In the second quarter, we generated a non-GAAP operating profit of approximately $500,000. Jeff will talk about this in more detail. While we feel confident about the path to profitability, we intend to continue investing for durable growth and profitability. Overall, the second quarter was another strong quarter for Rapid7, and we look forward to executing during the remainder of the year. With that, let me turn the call over to our CFO, Jeff Kalowski. Jeff?
Thanks, Corey. Good morning, everyone. We're very pleased with our strong performance in the second quarter, with results that exceeded our guidance on all metrics. Total revenue for the second quarter was $79 million, above the high end of our guidance, and an increase of 35% year-over-year. This strong revenue growth was driven by better-than-expected product revenue growth, offset by a further decline in professional services revenue. In Q2, we also benefited from an existing customer expanding the scope of their term license, which resulted in approximately $1 million of upfront revenue recognized in Q2. Total ARR grew to $290 million at the end of the second quarter, a 46% increase year-over-year. ARR growth was primarily driven by strong new customer growth.
Our customer count increased by 16% year-over-year, and we ended Q2 with 8,400 customers globally. This includes a benefit from the NetFort acquisition that we closed in April of this year. Without NetFort, our organic customer growth rate accelerated from 12% to 14% in Q2. The quality of our customer base continues to improve as higher growth in our product customers more than offset the decline in service-only customers. Our customer economics remain strong, with average ARR per customer increasing to over $34,000, up 25% year-over-year. Strong growth in ARR over the past year drove 50% growth in recurring revenue. Recurring revenue now constitutes 87% of total revenue, compared to 79% a year ago. Our focus on recurring revenue drove a 62% increase in our product revenue year-over-year.
This was partially offset by a decline in maintenance and support revenue as NetFort's customers migrate to the Insight platform, resulting in reclassification of maintenance revenue to product revenue. It makes sense to look at product and maintenance and support revenue together, which collectively grew at 46% year-over-year. Our professional services business experienced a further slowdown and revenue declined by 27% year-over-year. This decline is primarily driven by the continued churn of transactional services-only customers as our sales team gains momentum with our Insight platform. For the remainder of 2019, we expect professional services revenue to continue declining on a year-over-year basis. Looking at the business geographically, revenue from North America grew by 34% year-over-year and comprised 84% of total revenue.
International revenue grew by 42% year-over-year and comprised 16% of total revenue in the second quarter. Contract length for Q2 2019 was 14 months, down from 17 months a year ago, and a decline from an average contract length of 15 months we reported in Q1 2019. Our overall renewal rate was 116% in Q2 2019, and as projected, declined from last quarter. Our retention rate remains strong, and the decline in this rate is a result of a lower forecasted ARR growth rate from 53% last year. Additionally, our increased focus towards new customer growth also contributed to the decline. As Corey mentioned, we are incentivizing our sales force on adding new customers, and we plan to continue with this strategy as it maximizes our long-term sustainable growth.
As a result, we expect the overall renewal rate to stabilize around 110% by the end of 2019. Turning to margins. Total non-GAAP gross margin in Q2 2019 improved to 75%, up from 73% last year. We continue to benefit from a shift towards a more favorable mix of higher-margin product revenue. Our product non-GAAP gross margin was 80%, up from 78% last year. Professional services non-GAAP gross margins declined to 19% when compared to a margin of 38% in Q2 2018 due to lower revenue as part of our continued focus on ARR and more strategic professional services. During the second quarter, sales and marketing expense decreased to 45% of revenue when compared to Q2 2018 expense of 50%. This improvement reflects the operating leverage inherent in our business model. R&D expenses were 20% of revenue in Q2 2019 as compared to 23% in Q2 2018.
This lower percentage of revenue partially reflects an increase in capitalized software to account for increased investments in our Insight platform. G&A expenses in Q2 2019 were stable at 10% of revenue compared to Q2 last year. For Q2 2019, we generated non-GAAP operating profit of approximately $500,000, well ahead of our guidance. Non-GAAP operating margin was 0.6% compared to a margin of -10% in Q2 2018. This improvement is primarily driven by the over-performance in revenue. Adjusted EBITDA for the second quarter was $2.7 million, and diluted non-GAAP net income per share was $0.02, also well ahead of our guidance. We ended Q2 with cash equivalents, and investments of $264.4 million, compared to $285.1 million as of Q1 2019. The reduction from Q1 primarily reflects the cash outflow related to our acquisition of NetFort, which we acquired in April for approximately $15 million in cash.
During the quarter, operating cash flow was $2.5 million as compared to negative $9.1 million in the prior year, driven by strong collections, which brought our days billings outstanding back to a normal level. Given the decline in contract length and decline in professional services billing, we are projecting operating cash flow for the full year 2019 to be approximately breakeven. In Q2, our assets and liabilities increased $58.6 million as a result of our new corporate headquarters lease and our property, plant, and equipment increased $25.8 million due to the build-out of the corporate headquarters. While we moved into our new corporate headquarters in July, the build-out will continue to impact our free cash flow in Q3. Now moving on to the guidance. For Q3 2019, we anticipate total revenue to be in the range of $79.2 million-$80.8 million.
This guidance reflects the strength of our product revenue growth, which is offset by the decline in professional services revenue. We anticipate non-GAAP operating loss in Q3 2019 to be in the range of $2.5 million to $1.5 million. We anticipate non-GAAP net loss per share for Q3 to be in the range of $0.04 to $0.02, which is based on an anticipated 49.2 million weighted average shares outstanding. For the full year 2019, we are raising our guidance and now anticipate total revenue to be in the range of $318 million to $321 million, which is 31% growth over 2018 at the midpoint. While we're again pleased to report non-GAAP operating income for the second quarter, we still continue to see plenty of investment opportunities.
As we've stated before, we will invest any upside back into the business, and as a result, we are still guiding to break even non-GAAP operating income for 2019. We anticipate non-GAAP net income per share to be $0.05, which is based on an estimated 52.3 million diluted weighted average shares outstanding. The weighted average shares outstanding for the third quarter of 2019 represent basic shares outstanding, given our projected non-GAAP net loss. The weighted average shares outstanding for the full year 2019 represent the diluted shares outstanding, given our projected non-GAAP net income. Non-GAAP net income for the full year 2019 largely represents interest income on projected cash and investments. On a GAAP basis, we expect a full-year net loss for 2019.
As a reminder, we recently moved our global headquarters and are consolidating facilities this year, and hence in Q3 and for the full year 2019, our free cash flow will be negative as a result of significant capital improvements. These expenditures will decline substantially in 2020. In conclusion, Rapid7 had a strong second quarter, and we look forward to delivering ARR and revenue growth of over 30% while significantly improving non-GAAP operating margin compared to last year. With that, I want to turn the call back over to Corey for a few closing comments.
Thank you, Jeff. Before I open up the call for questions, I want to take a minute to welcome our newest board member. We are pleased to announce that Christina Kosmowski, who is the Global Head of Customer Success and Services at Slack, has joined Rapid7's board of directors. Christina has an impressive track record of operational excellence and has helped high-growth software companies scale to the next level. With that, we appreciate your time and support, and we'll open the call for any questions. Operator?
Thank you, sir. Ladies and gentlemen, at this time, if you would like to ask a question over the phone, please press star and then one on your telephone keypad. If your questions have been answered or you wish to move yourself from the queue, simply press the pound key. To our audience who is participating in the Q&A session, we kindly ask you please limit yourself to one question and one follow-up. Our first question will come from the line of Rob Owens with KeyBanc Capital Markets. Your line is now open.
Great. Good morning, guys. Corey, I wanted to hone in a little bit on the strength in customer acquisition. You mentioned InsightIDR, and as we look at the SIEM space overall, it's become noisier. What's helping you cut through that? What's driving this? Maybe an update on InsightVM as it relates to customer acquisition as well.
Yeah, we're really hitting our strides. You can think about us as being roughly four years in. We have a compelling product capability with InsightIDR that we can expand. We're getting very comfortable in our go-to-market motion, so we know how to target our customers. At the core of it, we actually have a solution that is fairly unique in the market. Yet most of the SIEM products are designed for customers that have unconstrained resources. What we find is if you think about most of the market, whether you think about the mid-enterprise or even what I think about as the margin-constrained large enterprise companies, your retail companies, your healthcare companies, they have to figure out how to actually have the most productivity and the most impact with limited resources.
For us, we've really delivered a strong solution for that market, and that's allowed us to continue to actually aggressively grow and gain share in the overall market. More and more, our strategy and our value and our success in customers is feeding on itself, where customers are telling other customers, and even industry analysts like Gartner and others are recognizing the value and the leadership that we're providing.
Great. For my completely unrelated follow-up question, given we're entering the third quarter here in what's typically a strong federal quarter, maybe an update or a reminder as to where you guys are relative to the U.S. opportunity, and percentage of sales, things of that nature.
Yeah, we're still very early stage in the overall both opportunity, and it's a relatively small percentage of our overall sales. The way that we think about federal, it is massive upside if you look over the next five to 10 years, and we will be a major player in the overall federal market. At the same time is that when you think about us having launched a pervasive cloud platform for security a few years ago, and the federal government still being in the earlier stages of their adoption, our strategy is really to continue to grow our overall commercial presence. We are aggressively growing in the overall state and local and education market, that are highly receptive to our cloud-based platform and strategy. As the federal government standardizes approach to the cloud, you'll see us play an increasing role there in the future.
Again, our expectations are that federal is not a major contributor this year or frankly, even for the next few years.
Great. Thank you.
Thank you very much, Rob. Appreciate it.
Thank you. Our next question will come from line of Saket Kalia with Barclays Capital. Your line is now open.
Hey, guys. Thanks for taking my questions here.
Absolutely.
Hey, first maybe for you, Jeff. Obviously another nice ARR quarter. On the renewal rates, you mentioned that they ticked down from I think 120% down to 116%, and we said that maybe those will stabilize as we get into the back half at around 110%. You talked to some of the drivers there around customer acquisition, and such. Could you just go a little bit deeper into those and talk about how the expired renewal rates are doing, how the upsell, cross-sell component of it is doing, just to understand that dynamic a little bit better?
Sure. It's a good question. First off, on the expiring renewal rate, those are still strong, and they were in the 90% range, so there's no change there. I think as you heard Corey talk about, our focus this year is really on acquiring customers. While upsell and cross-sell is still healthy, we've had a shift towards more new news, which drives the rate down. Also, we're forecasting an ARR growth rate from 53% to over 30% plus, right? You can't assume that that rate will stay the same given the decline. That's just not the way the math works. Overall, our rates are strong, so there's nothing negative in that expiring renewal rate whatsoever.
Okay, got it. That's really helpful. Corey, maybe a little bit of a higher-level question. A lot of success here so far in the first half of 2019. I know it's early to start talking about 2020, just given the ARR upside that we've seen pretty consistently over the last few quarters, how do you think about that 2020 framework that you provided at the last Analyst Day?
It's a good question. It's one that we actually get a lot. Of course, it's actually too early to actually give guidance for 2020. If you think about the backdrop, in Analyst Day, we actually talked about a three-year cadence of 20% revenue growth, and 30% ARR growth. We've clearly performed well in excess of that so far, and we actually have started off this overall year on a strong pace. The thing that I think is the most important is we're extraordinarily both optimistic about the market and the performance of our teams. While it's too early for us to actually give specific guidance, what I will say is that we're confident in the fact that we'll continue to be a growth company. We'll be growing revenue over 20% next year. We'll be growing ARR over that amount also.
I think about that as that we're a company that's centered on the large opportunity that's in front of us. We have a strong and healthy team. We're going to be pursuing that aggressively. That said, we are going to come back with actually guidance later. It's just way too early to actually provide any guidance at this stage.
Got it. That's really helpful. Thanks, guys.
Thank you. Our next question will come from Matthew Hedberg with RBC Capital Markets. Your line is now open.
Oh, hey, guys. Thanks. Well done on the quarter. Corey, even backing out a NetFort acquisition, you guys still had a big quarter of new customer additions. Obviously, you talked about that. When you think about this focus on land, because I think you said you guys feel confident that you can expand longer term, how do you think about adding the right number of sales headcount to support that level of customer growth?
Yeah, no, it's a very good question. The simple way that we think about it is the reason that we're focusing on land right now is that in my mind, it's always easy to expand. It's always easy to monetize the base. As long as possible, you want to have these sales teams focused on actually acquiring on new customers. When we think about how we grow our sales engine overall, the thing that we're in a good position right now, especially as we go into 2020 and forward, is that we have the ability to actually add salespeople and still grow our leverage and profitability in the overall business. If you think about what we're really optimizing around is how do we have sustainable growth, which you hear us talk repeatedly about, while still expanding the leverage in the overall business.
We actually think our sales leadership and our operations team have done a good job in setting us up for that.
Got it. Maybe as a follow-up, obviously the Capital One breach was in the news this week, and it looks like it was perhaps a misconfigured WAF. Can you talk about that as an issue? I believe you have a product called Cloud Configuration Assessment that may help prevent a similar situation. Could you talk a little bit more about that as an issue?
Yeah, absolutely. I think the thing about cloud environments, so the first thing I'd say is, Capital One is well regarded and has an extraordinarily talented cybersecurity team. I would say, more than it being an issue specifically with them, it just shows the complexity of managing cloud-based infrastructure. The second thing is, when you think about cloud-based infrastructure, cloud-based infrastructure is extraordinarily complex with a massive number of permutations, which is why you have to automate your ability to really understand what you have in your environment, and how it's configured. That's why we have such a massive investment in Cloud Configuration Assessment and the analytics of understanding people's cloud exposure, which is different than traditional vulnerability exposure. This is clearly a problem set that we're targeting aggressively. We believe our CCA offering is relevant and will be more and more relevant in the future.
We just introduced the first version of that. It's on an aggressive expansion path in terms of capability. I think Capital One just demonstrated more than anything, the complexity of today's technology environments.
Super helpful. Well done, guys.
Thank you very much.
Thank you.
Thank you. Our next question will come from the line of Gur Talpaz with Stifel. Your line is now open.
Hi, this is actually Chris Prassas on for Gur. Congratulations on another great quarter, guys. For Corey, when you acquired NetFort, you noted that it would provide you with the technology to better service some enterprise SIEM use cases. Can you speak to the degree to which the acquisition has better enabled you to push upmarket?
Yeah, that's a great question. When we acquired it, we talked about really three things. The first focus we said out the gate was going to be on focusing on enabling a higher level of enterprise use cases in SIEM, then we talked about the augmenting the InsightVM visibility and then IoT long term. For all of them, we are in the technology integration phase, so it's had no material impact on our go-to-market engine. Even in that context, our go-to-market engine for IDR has continued to expand, and we think that this will just be additional capabilities that makes it easier and easier for us to expand in the out years. As of today, we're still in the technology integration phase.
Okay, that's great. As a follow-up, again for you, Corey, your international business grew quite nicely in Q2. How should we think about your long-term international opportunity and the degree to which this market currently remains greenfield?
Yeah. We think about international as having a massive opportunity. We all know that it's lagged the U.S. in terms of both the awareness and the willingness to invest heavily in the main capabilities of cybersecurity. What we're seeing is a pickup in both interest and awareness. Some of it's driven by regulations and compliance. Some of it's driven by the international connections that companies have around the world. We are seeing a steady pickup. The way that I think about our international business performing is it should continue to actually increase as a percentage of our business. If you think about what's happened recently, it's gone from 15% to 16% over our overall business. We expect that to continue to go up over time. I'd say is our international team has done a very good job.
I think the hard thing is that our largest business from a geography perspective is North America, and that's continued to grow well, which just makes it a slower path that actually international becomes a larger and larger share of the business. We expect those numbers to continue to go up steadily over time.
Great. Thanks, guys, and congrats again.
Thank you very much.
Thank you. Our next question will come from the line of Michael Turits with Raymond James. Your line is now open.
Hey, guys. Good afternoon. Michael Turits. I'd like to focus on the vulnerability management market first. Not exactly clean quarters from your key competitors here. How would you characterize the level of demand and growth in vulnerability management right now? Any slowing there? Is your focus on net customer adds an increasingly aggressive attempt to gain share there?
It's a great question. Both questions. First one is, we see the vulnerability management market is overall healthy, and we believe that we're both growing our share of the market. To your second question, yes, we absolutely are focused on both short-term and long-term being the share taker in the overall vulnerability management market, and all the evidence and data we have suggests that we're doing an effective job of that. On your question on the overall market, we believe it's a healthy market, and it's a stably healthy market. The backdrop I'll actually provide is that at our Analyst Day, we said that the long-term growth rate was a roughly 15% CAGR for the long term. We still believe that. We're clearly growing well above that rate today. We think about the vulnerability management market as a strategically long-term and healthy market.
Okay. Can you comment on InsightIDR as a percentage of new ARR? You've talked about that in the past in a non-InsightVM as a percentage of new ARR.
Yeah, Michael. We have commented on IDR, and it's again over 30% of the new ARR that we added in Q2. What we said is we're not going to comment on specific product lines, but with IDR, it is becoming a bigger portion of the total ARR revenue mix. When it was 20%, we said we'd tell you when it's 30%, and it's still over 30%, and we'll update when it gets over 40%. It's still very healthy.
Great. Thanks a lot, guys.
Thank you.
Thank you. Our next question will come from Jonathan Ho with William Blair. Your line is now open.
Good morning. I just wondered to see if you could give us a little bit more color on maybe what's driving the increase in ARR per customer? I just wanted to get a sense of, is this, you guys are going after larger deals, or is this more multi-product? Just any additional color would definitely be helpful.
No, it's a good question, especially since we are coming out of the period where you had the SaaS transition period. The primary driver is just the overall potential. One way to think about it is that if customers are fully deployed and they have all of our products, we've said before, there's roughly a $200,000 ARR per customer opportunity. The focus that we actually have internally is really. In fact, our biggest investment this year was on customer adoption and customer experience. Our fundamental belief is that if customers have a good experience, if they're adopting the technology, then they'll expand the technology because we have plenty of natural expansion opportunities. What we're seeing that the increases are a combination of customers adopting more of our other products that's indicative of our overall InsightIDR, InsightAppSec, the offerings that we actually have available today.
They're adopting more of our product offerings. At the same time, they're actually covering a broader range of their environments with those overall offerings. And that combination of things about what's the percentage of the environments covered overall and how many of the products are people using, that's actually driving overall expansion in the ARR per customer.
Got it. Just regarding the competitive landscape in the SIEM space, are you guys starting to see Azure Sentinel or Chronicle show up, I guess, more on the competitive side?
Not in any material way. We've seen snippets of it. My expectation is it'll show up more. The thing about the SIEM market is it's a competitive market. It always has been a competitive market. It always will be a competitive market. We think we're extraordinarily well-positioned in the market, but we will see increased competition, especially from Microsoft there, while we still partner with Microsoft in other areas, too. We feel quite good about the overall competitiveness of our solutions and our offerings, even though we expect the market to stay competitive. We do not think this gets any easier over time. We just think that we're well-positioned in the market from a technology perspective, and we have an extraordinarily talented go-to-market team.
Thank you.
Thank you.
Thank you. Our next question will come from Gregg Moskowitz with Mizuho. Your line is now open.
Okay. Thank you. Good morning, guys, and I'll add my congratulations as well. Industry analysts have been talking more frequently about risk-based VM, and Gartner actually says that only 1% of enterprises will have adopted a risk-based approach to vulnerability management by the end of this year. I guess my question is, can it really be that low? Corey, I'd love your perspective on this as well as how customers are now approaching risk mitigation through InsightVM.
Yeah. One, I don't believe it's that low today, and I don't think it will be that low. You think about the primary driver of customers buying InsightVM, it is to operationalize InsightVM. While it may not fit into Gartner's model of it, customers are becoming more and more both risk and remediation centric over time. Now, I think the trick and one of the misnomers there is that risk today does not mean that you cannot actually remediate key parts of your environment. The way that we actually sort of engage with our customers is you should understand your risk so that you remediate in the right order, but you have to remediate all material issues and risk in your environment. You cannot have, say, like, "I just got the most critical risk in the environment.
I can leave all the moderates, and I'm fine." In fact, that's been proven that basically, you're going to be highly likely to be compromised there. What we're seeing is our mature customers are taking a risk-centric approach to making sure they're making the right investments in the right order, but they're also taking a comprehensive approach that says, "How do I actually drive remediation overall and the velocity of remediation?" That feedback from our customers is what's really pushed our investments in integrations, in automations, and in alignment with IT teams to actually drive the pace of remediation overall.
Okay, that's really helpful color, Corey. Thanks for that. For Jeff, can you elaborate on where you're making incremental investments? When we see companies step up investment levels to drive more growth, it's typically a multi-quarter event before we see margins normalize, and yet you have reiterated your full-year operating margin and EPS targets. What gives you the confidence that you can still achieve those?
As we said in our prepared comments in the prior quarters that we continue to reinvest the over-performance in revenue. While still achieving breakeven this year. The nature of those investments, as we talked about in prior calls, is really to improve our efficiency, with systems, to enable customers to order easily, more multi-product SKUs and systems to accommodate, to make it easier for them to order. We feel pretty good. It's not short-term. It's going to be over the course of a year or two, but we are making good progress.
The thing that I would add is the reason that we're confident that you'll see those investments show up in the P&L and why we'll still be breakeven for the year is that most of those programs and most of the people were successfully hired and launched in Q2. They're turned on as you go into Q3 and Q4. We have a good deal of visibility overall into the investments and the impact on the P&L. That's why we're still confident in the breakeven for the overall year.
Terrific. Thank you.
Thank you. Our next question will come from Alex Henderson with Needham. Your line is now open.
Great. Thank you very much. I was hoping you could delineate a little bit between what you're seeing in the middle market, and what you're seeing in the smaller, large enterprise market, if that's not a jumbo shrimp comment. Particularly where you have clients that don't have a SOC that, in some cases, may not even have a CISO. Can you talk a little bit about the rate of growth between those two segments and delineate some of the go-to-market differential there? Thanks.
Yeah. I would say the long-term rate of growth in the markets we expect to be pretty aligned and pretty similar. One thing to think about us is that because we have a broad product portfolio, we actually have the ability to actually meet customers where their existing needs are. If you look and you think about the mid-market customer is lots of them are starting cybersecurity programs around vulnerability management, incident detection response, or application security for the first time. So that's its own motion there, but there's lots of people that are starting programs. If you think about the enterprise motion, there's really two dominant things. They have something, but lots of people are either upgrading their programs or overhauling their programs.
I have something and I actually need to actually extend it and do more, and you can think about us actually adding a bunch of capability to complement. We can go in with our InsightAppSec, we can go in with our InsightVM, our SIEM, or our InsightConnect, but we can complement and help them actually expand their security program. There are a number of customers, and we're finding massive amounts of opportunities there that are overhauling. They're saying, "I have invested in some things, and it's not relevant for the future. It's not what I need to be successful." In the InsightVM context, that is, I want to operationalize across security, and I want to have a way to think about my risk profile and remediation across my entire complex infrastructure that includes cloud and on-prem.
That's an overhaul and upgrade. We'll go in and people will upgrade us, and they'll pay us more money than they paid the previous incumbent because they're actually buying a bigger vision and a bigger aspiration there. Similarly, with InsightIDR, most SIEM projects are failed projects in the enterprise space because it's complex, it's expensive, and so you have a lot of failed projects in the Global 2000 companies, and we're starting the journey. We have a good traction to success and starting going in and upgrading those overall programs. The way that we see it is we see both the mid-market and the enterprise market as good growth drivers overall into the future.
One more question, if I could. We just did a survey, we were surprised to see CrowdStrike show up in the InsightVM space with reasonable penetration. Could you talk a little bit about whether you're seeing CrowdStrike and how they impact the competitive dynamics when you do? Thanks.
Yeah. We don't see CrowdStrike as a material competitor in any way for enterprise vulnerability management deals. I would say similar to like Sophos and Microsoft, is there's many endpoint companies that cover vulnerability management on the endpoint and provide visibility of vulnerability on the endpoint, and there's a source of vulnerability data. We're not seeing CrowdStrike as a competitor for any enterprise vulnerability management project. One way to think about it is the first thing that you have to do is be able to actually know what's managed and unmanaged, which scanning tends to be a more effective mechanism to actually do that. Also, you're actually covering more than just a desktop. You have a massive long tail.
Like most companies that are starting new enterprise vulnerability management projects are putting the cloud in the context of what they're doing, which is why our customer adoption of CCA got off to a furious and fast start with lots of momentum out the gate. We're not seeing them there. They do, just like others, just like Microsoft, just like Sophos and others, they do provide vulnerability information and context on the endpoint, but that's different than sort of like participating in the enterprise vulnerability market, and our piece. Thank you very much.
Thank you. Just as a reminder, if you would like to ask a question, that is star then one. Our next question will come from Keith Weiss with Morgan Stanley. Your line is now open.
Thank you, guys. A great quarter. Maybe thinking like the opposite side of that question. We talked a lot about the competition from cloud vendors. Can you talk a little bit about some of the benefits that you expect to get from relationships with like the one you're describing with AWS, and when we could start to see that come through into the model?
Yeah. No, absolutely. We've been spending a lot of time, we'll be spending more time in the overall cloud market. We really think about it in two separate ways. One is that we have to have good relationships just to make sure that our technology not just works but is productive and efficient for our customers. One of the things about cloud environments, it's primarily a la carte model. If you think about a la carte model with low barriers to entry, what that tends to lead to is extraordinarily high management complexity. Our role in the ecosystem is actually how do we actually reduce management complexity and allow people to manage large, complex environments from a cybersecurity perspective.
We spend a lot of time with cloud players, both heavily with AWS but also with Microsoft, on how do we make sure our technology is productive for managing the complexity of cloud environments, and especially if you think about hybrid environments, because we still see this as a hybrid world for a very long time. The second thing that we're actually doing is we're spending more time on the go-to-market side. You saw that reflected. We talked about our time with AWS in the re:Inforce conference, where we spent both time not just as a sponsor, but also time planning and talking about how we align and how AWS is aligned with us and how we align with them.
Also spending time thinking about how we actually work with AWS' and eventually Microsoft's go-to-market teams to make sure that we're helping companies both transition to the cloud and manage cloud hybrid environments. We look at it as both technology and go-to-market, and we're still in the early innings on the go-to-market, but we're starting to actually make some public inroads there, which you've clearly seen. The technology we've been working at for a while, and we're going to keep working at.
Excellent. Maybe just one follow-up. You guys are doing really well in international markets. We have been hearing some murmurings of weaker demand trends. Anything on the macro side of the equation internationally that worries you guys at all?
Not now. The thing that I would say is that we're probably not a good barometer for the broader market internationally just because we started later. It's a lower percentage of our business than you would see for a typical software company. We just have lots of room to actually grow and scale. We still see international at 16% of our revenue as a continued growth and expansion opportunity. That doesn't necessarily have to reflect the broader market.
Excellent. Very nice quarter, guys.
Thank you very much.
Thank you. Our next question will come from the line of Joshua Tilton with Berenberg. Your line is now open.
Hi, guys. Thanks for taking my questions. First one, in the past, you would provide us with a breakout of potential average subscription ARR for each product. Have your views on these numbers changed? Does SIEM maybe increase in wallet share with your clients? Could you possibly remind us of your expectation for InsightConnect?
It's a good question. I don't think we've made any material change in assumption of the average ARR for products. There's been no change there. InsightConnect is just too early. Really, you can think about InsightAppSec like an InsightConnect of how the dynamic is they're a buy and extend model. I buy a set of workflows, and I add more workflows over time. We're still estimating what's the average initial buy and then what's the expansion rate, and that just takes time. That's part of sort of like things that we'll update as we go through our overall process of next year. It's still too early to tell what that's specifically going to be.
Yeah, that was helpful. Maybe, I guess, just a follow-up to that would be then, so SOAR is being viewed more and more as highly complementary to SIEM, and obviously, SIEM product is growing really great. What needs to happen to just drive improved adoption for SOAR, especially from the customer base that's already buying IDR?
Yeah, for us, we believe it's just focus. I mean, we focused the last few years on the technology scale and ease of use. We talked about now this year, we actually put it into limited release. Our next phase in our cycle is next year, we expect to go into a broader release with more go-to-market resources aligned behind it. We think we have a good strategy and a good approach there, but it's mostly timing of how we actually go through our launch and market introduction strategy. We are fairly rigorous and fairly disciplined about how we approach these things, but we will be making significant investments in the overall SOAR area, and we have strong confidence that it'll yield good fruit.
All right. Thanks, guys, and congrats on the quarter.
Thank you. Thank you very much.
Thank you. I'm showing no further questions in the queue. Ladies and gentlemen, thank you for your participation on today's conference. This does conclude our program, and we may all disconnect. Everybody, have a wonderful day.