Good day, ladies and gentlemen, and welcome to the Q3 2018 Rapid7 earnings conference call. At this time, all participants are on a listen only mode. Later, we will conduct a question and answer session, and instructions will follow at that time. If you require operator assistance during the program, please press star then zero on your touch-tone telephone. As a reminder, today's conference is being recorded. I would now like to introduce today's conference call, Mr. Jeff Bray.
Thank you, operator. Good afternoon, everyone. We appreciate you joining us to discuss Rapid7's Q3 2018 financial and operating results, in addition to our financial outlook for the fourth quarter and full fiscal year 2018. I'm Jeff Bray, I'm here today with Corey Thomas, our President and CEO, and Jeff Kalowski, our CFO. We've distributed our Q3 2018 earnings press release over the wire. It is now posted on our website at investors.rapid7.com. We've also posted our updated company presentation and financial metrics file on our investor relations website. This call is being webcast and can be accessed at investors.rapid7.com. The webcast of this call will be archived, and a telephone replay will be available until November 13, 2018. We would like to bring the following to your attention. The date of this call is November 6, 2018.
Our discussion today contains forward-looking statements about events and circumstances that have not yet occurred, including, without limitation, statements regarding our objectives for future operations and future financial and business performance. These forward-looking statements are based on our current expectations and beliefs on information currently available to us. Statements containing words such as "anticipate," "believe," "continue," "estimate," "expect," "intend," "may," "will," and other similar statements are intended to identify such forward-looking statements. Actual outcomes and results may differ materially from the expectations contained in these statements due to a number of risks and uncertainties, including those contained in the Risk Factors section of our most recent quarterly report on Form 10-Q, filed with the Securities and Exchange Commission on August 7, 2018, and subsequent reports that we file with the Securities and Exchange Commission. The information provided on this conference call should be considered in light of such risks.
Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by applicable law. On this call, we will provide and talk about our results using non-GAAP financial measures and provide non-GAAP guidance. Unless otherwise stated, for purposes of comparability, we'll be presenting results in accordance with ASC 606 in addition to ASC 605.
We believe that the use of these non-GAAP financial measures provides an additional tool for investors to use in understanding company performance and trends, but note that presentation of non-GAAP financial information is not meant to be considered in isolation or as a substitute for the directly comparable financial measures prepared in accordance with GAAP. We have provided a reconciliation of the historical non-GAAP financial measures to the most comparable GAAP measures in the financial statement tables included in the press release issued today announcing our results. The press release announcing our financial results is available on our website at investors.rapid7.com. At times, our prepared comments or responses to your questions may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results.
Please be advised that this additional detail may be one-time in nature, and we may or may not provide an update in the future on these metrics. With that, I'd like to turn the call over to Corey.
Thank you, Jeff. Good afternoon, everyone. Thank you all for joining us today on our third quarter 2018 earnings call. I am pleased to announce that Rapid7 had a great third quarter, reflecting strong performance across the world and across our product offerings. We're exceeding our growth goals while demonstrating greater operating leverage. In Q3 2018, we exceeded the high end of our guidance for revenue and operating profit. Our total revenue under ASC 605 grew by 30% year-over-year. Our focus on ARR bookings has increased our recurring revenue, which, for the first time, accounted for over 80% of our total revenue in the third quarter. Our ARR accelerated for the fifth quarter in a row, growing 46% year-over-year. We demonstrated operating leverage, and we are making good progress towards our goal to be profitable in 2019 on a non-GAAP basis.
Our strong results were driven by consistent execution by our go-to-market teams and continued product innovation. Our sales teams executed very well and have embraced selling subscriptions, driving higher ARR. Our customers increasingly recognize the need for SecOps and specifically the value delivered by our cloud-based products. Our focus on innovation and our platform approach is driving adoption within and across product lines. During the third quarter, we added to our already broad set of market-leading solutions, launching InsightConnect, which builds on our Komand acquisition from last year. As security teams try to balance increasing workloads with limited resources, complex ecosystems, and rising threats, our customers are seeking solutions to streamline their processes to reduce risk and help them quickly respond to issues.
InsightConnect, which is one of the first cloud-native security orchestration, automation, and response solutions, is designed to seamlessly integrate with the myriad of security, development, and IT systems that customers have today, including competitors' vulnerability management and SIEM solutions. Built with security, IT, and development in mind, InsightConnect has a wealth of potential use cases and benefits, enabling higher productivity workflows, connecting people, process, and technology. With the rollout of InsightConnect, Rapid7 now has four engines to drive the growth of our Insight platform. InsightVM, recognized as the highest-rated leader in vulnerability management by Forrester. InsightIDR, a UBA-powered cloud-native SIEM recognized as the visionary with the highest ability to execute by Gartner. InsightAppSec, the future of cloud-based application security testing. InsightConnect, our cloud-native security orchestration, automation, and response application.
Over the last few months, I have met a lot of our customers, discussing with them how we can better help manage their security challenges. One of the consistent themes I hear is that while they want to innovate fast and develop agile applications, they are concerned about the security of these applications, which is why they really like our application security approach and appreciate the investments we are making in our platform. In this context, we are pleased to announce the acquisition of tCell, a leading provider of web defense and monitoring. tCell accelerates our vision for aligning security, IT, and DevOps teams on a common platform, enabling our customers to drive innovation and security. tCell will expand our application security capabilities on the Insight platform as we strive to build the most comprehensive AppSec solution to deliver continuous testing, monitoring, and protection for our customers.
The visibility, data, and analytics created with tCell will enhance our Insight platform capabilities across the board, from vulnerability management to incident detection response, providing our customers with a more holistic approach to information security. tCell was recognized as one of the top three for runtime application self-protection in the most recent Forrester New Wave report. Our innovation and strong execution continues to be recognized by our customers and industry thought leaders. Frost & Sullivan bestowed Rapid7 with its 2018 Market Leadership Award for global vulnerability management. In Frost & Sullivan's words, Rapid7 customers and the industry as a whole see Rapid7 as an innovator that will be able to keep pace with the changing requirements in cybersecurity. Let's review the third quarter in the context of our 2018 goals. Our first goal was to continue to accelerate ARR growth.
ARR is the primary metric we use to manage the business and is a strong indicator of how quickly our recurring revenue is growing. As you may recall, we started off the year with a target of 30% ARR growth. Last quarter, we raised the target to over 40% growth, and I am happy to report that we exceeded expectations yet again and grew ARR by 46% year-over-year. ARR per customer was over $29,000 this quarter, which is 33% growth over the last year and 50% growth over the last two years. Our platform strategy is being quickly adopted, and the feedback is that customers are having a great product experience.
Most directly, we see this in higher renewal rates for our platform customers, which increases the visibility and lifetime value of those customers, in turn, allowing us to invest in new product and customer acquisition, creating a virtuous cycle. Almost half of our total customers are now platform customers and account for over 70% of our total ARR. The breadth of our solutions is driving strong cross-sell growth of over 70% year-over-year in the third quarter. Our platform strategy is working well, driving much higher ARR per customer and higher renewal rates as our customers see the value of moving to the Rapid7 Insight platform. Our second goal is to leverage our SecOps portfolio to drive new customer growth and up-sell and cross-sell to our existing customer base. We again grew our customer base by 10% year-over-year.
One of our largest deals this quarter came from our international team, where a large healthcare company renewed and significantly expanded coverage of our InsightIDR, InsightVM, and InsightAppSec platform products. We believe there is still more opportunity to grow within this customer. This win is also a great example of our extremely talented services team differentiates us from competitors. This relationship started with the client initially engaging our managed services team to help them resolve their security challenges, and over time blossomed into a trusted and strategic partnership. In our next example, our InsightIDR continues to gain mainstream mind share and market share. Recognized as a visionary product by Gartner, InsightIDR consolidates SIEM, UBA, and detection response in one easy-to-install product. One of the largest global fast food chains chose our InsightIDR and InsightVM solutions for their retail operations across multiple brands.
The trends we saw in the last quarter continued with strong growth in our SecOps customer base, offset by deceleration in services-only customers. We are investing our resources where we have the ability to add long-term value for our customers and drive higher lifetime value for Rapid7. As a result, we are winning new enterprise and mid-market customers, up-selling and cross-selling to our existing customer base and displacing competitors. Let me give you a few examples. One of our key new customer wins last quarter was a Fortune 500 semiconductor equipment manufacturer who purchased InsightVM, displacing a competitor. This customer was looking for broad asset coverage and had stringent technical requirements, and we scored the highest of all major players. The customer's desire to partner with someone who has a clear long-term vision, is investing heavily in a best-of-breed product platform clinched the deal for us.
Our platform vision and roadmap yet again won this deal for us, we still have substantial expansion opportunity with them. We are starting to see more and more traction in retail and hospitality industries as they realize that better security infrastructure is needed, not only at their corporate-owned facilities, but also at their franchise locations. Our third goal is to improve profitability. In the third quarter, we saw operating leverage driven by two factors. First, the underlying economics of our business and sales model continued to show improvement. Second, some of our planned investments for the quarter shifted over to Q4. We have increasing confidence in our business model due to strong customer economics, improving visibility, and better cost controls. In addition, with the investments we are making, we expect to obtain long-term leverage in our cost structure by continuing to enhance our underlying back-end systems and processes.
These investments will allow our business to become structurally stronger and enable higher long-term profitability. With the strength of our recurring revenue, we believe we can drive growth and scale for the long term. In conclusion, we feel very good about where we are and the progress we have made towards delivering our stated goals for 2018. With that, let me turn the call over to our CFO, Jeff Kalowski. Jeff?
Thanks, Corey. Good afternoon, everyone. Before I begin discussing our strong results for the third quarter 2018, I want to remind everyone that as of January first of this year, we adopted ASC 606 on a modified retrospective basis. Therefore, we've been reporting each quarter's results in 2018 under both ASC 606 and ASC 605. We have included all of these details in our earnings press release today. When discussing our year-over-year growth rates and other key trends in our business, we'll be comparing our results on an ASC 605 basis, as we don't have prior year operating results under ASC 606. The comparison would not be meaningful.
We are pleased with our strong performance in the third quarter, which beat our guidance on all key metrics and was highlighted by accelerating ARR growth of 46% year-over-year. Meaningful operating leverage. First, I'll briefly discuss our results on an ASC 605 basis. Total revenue for the third quarter 2018 was $65 and a half million, an increase of 30% year-over-year. Well ahead of our guidance. Recurring revenue was 81% of total revenue the third quarter of 2018, up from 71% in Q3 2017, representing a growth rate of 48%. Looking at the business geographically, in Q3, North America comprised 85% of revenue, growing 29% year-over-year. Rest of world revenue increased 33% year-over-year. Contributed 15% of total revenue in the third quarter.
On an ASC 605 basis, non-GAAP operating loss was $1.5 million, also meaningfully better than our guidance on a non-GAAP loss of $6.6 million to $5.2 million. Adjusted EBITDA was positive $0.2 million for the third quarter compared to a loss of $5.6 million in the prior year period. Our non-GAAP operating margin improved from a loss of 13% in Q3 last year to a loss of 2% for Q3 2018. Now I'll discuss results on an ASC 606 basis. Total revenue was $62.4 million, above the high end of our guidance. Our product revenue was once again driven by strong ARR bookings globally in both VM and IDR, with accelerating recurring revenue growth. With the change in sales comp plans and focus on ARR, we continue to see a favorable shift towards ARR bookings.
As a result, we're experiencing a slowdown in our professional services bookings, and we now expect professional services revenue to be down for the full year compared to 2017. Visibility into our revenue forecast remains very high. Recurring revenue was 82% of total revenue, and 85% of total revenue came from deferred revenue on the balance sheet at the beginning of the quarter. The value of our annualized recurring revenue increased to $217.4 million at the end of the third quarter, a 46% increase year-over-year, and an acceleration from 44% growth in Q2 and 38% growth in Q1. With our strong Q3 performance, we remain confident in achieving the goal we stated in Q2 of over 40% ARR growth for the full year 2018. Calculated billings for the third quarter were $61 million.
Average contract length was 17 months for total billings, down significantly from 23 months in the prior year period, and the same average contract length we reported in Q2. We once again saw our customers shift towards one-year contracts with our continued move towards a subscription-based business model versus perpetual. As a reminder, we don't believe billings are a meaningful comparison to prior periods during this transition, as they don't capture the benefit of a higher subscription mix in growth of our annual recurring revenue. Based on the trend over the last three quarters, we anticipate that contract lengths will remain in this range going forward. As a result, we now expect our operating cash flow for 2018 to be closer to break even due to lower contract duration and lower services billings.
While this transition has a downward impact on operating cash flow versus our previous perpetual license model, the speed at which we are transitioning to a subscription model is a strong positive for our business model. Our customer count increased by 10% year-over-year, and we ended Q3 with 7,400 customers globally. As Corey mentioned, we continue to see an improvement in the quality of our customer base, and in Q3, our ARR per customer increased to over $29,000, which is up 33% year-over-year. Overall, we continue to see strong bookings from new customers, upsells, and cross-sells. Our renewal rate was 120%, and our expiring revenue renewal rate improved to 90% in the third quarter. Turning back to margins, non-GAAP total gross margin for Q3 2018 was 74%, up from 73% in Q2 2018. Product non-GAAP gross margin was 79%, up from 78% in Q2 2018.
Professional services non-GAAP gross margins decreased to 32% from 38% in Q2 2018 due to less revenues as a result of lower services bookings. We expect professional services gross margins to be in the low 30s for the full year 2018, and for our total gross margin to stay in the low to mid 70s. During the third quarter, sales and marketing decreased to 46% of revenue. We've realized almost five percentage points of leverage in sales and marketing since Q1 2018 while continuing to show meaningful growth in ARR. We would note that some expenses shifted from Q3 into Q4, including, as Corey mentioned, system improvements that are targeted at improving our long-term scalability. Our non-GAAP operating loss was $2.8 million, well ahead of our guidance of a loss of $7.3 million-$5.9 million, and our operating margin improved to negative 5%.
Adjusted EBITDA loss for the third quarter was $1.1 million. non-GAAP net loss per share was $0.04 in Q3 2018, well ahead of our guidance. We ended Q3 with cash equivalents, and investments of $311.1 million. This compares to $92 million as of December 31, 2017. Our cash balance reflects the proceeds of our $230 million convertible senior notes offering, which we completed in the quarter. Our operating cash flow for Q3 was negative $4.1 million due to continued reduction in contract length and lower services billings. Our days billing outstanding was at the higher end of the historical range. However, we had strong cash collections in early October. Year to date, cash flow used in operating activities was negative $5.9 million.
As mentioned earlier, we project our operating cash flow to be closer to break even for 2018 as compared to 2017 due to lower contract lengths and less services billings as we successfully transition to a subscription model. In October, we acquired tCell for $14.4 million in cash. While tCell will not have a material impact on 2018 revenue, we will be absorbing their R&D expense in Q4. As Corey mentioned, we believe tCell will play a meaningful role in our InsightAppSec strategy going forward. Moving to our fourth quarter and full year guidance. We'd like to note that for Q4 and the full year, we are providing guidance on an ASC 606 basis only. We believe the differences in our operating results between ASC 605 and ASC 606 have been fairly consistent and well understood by investors now with three quarters of results behind us.
We will, of course, be reporting under both methods for the remainder of 2018. We'll highlight our operating performance on a comparative basis under ASC 605 as we've done over the past three quarters. For Q4 2018, we anticipate total revenue to be in the range of $65.8 million-$67.2 million. Our Q4 guidance reflects stronger product revenues, which are being offset by the decline in professional services revenues. We anticipate non-GAAP operating loss to be in the range of $5.5 million-$4.5 million. We anticipate non-GAAP net loss per share for Q4 to be in the range of $0.10-$0.08, which is based on an anticipated 47.5 million weighted average shares outstanding. For the full year 2018, we are raising our total revenue guidance and now expect total revenue to be in the range of $241.1 million-$242.5 million.
We are updating our guidance for non-GAAP operating loss to be in the range of $23 million-$22 million. We anticipate non-GAAP net loss per share for the full year to be in the range of $0.46-$0.43, which is based on an anticipated 46.5 million weighted average shares outstanding. While we are not providing 2019 guidance at this time, we want to reiterate that the slowdown in professional services bookings does not affect our 20% plus revenue growth outlook through 2020, as the growth and mix of our higher quality ARR bookings will offset the decline in professional services revenue moving forward. As Corey said, with our increased momentum through 2018, we are making good progress towards meeting our goal to generate non-GAAP operating profit in 2019. Our goal is to grow revenue by over 20% and ARR by over 30% through 2020.
In conclusion, this was another good quarter for Rapid7, driven by the strong ARR growth and realizing leverage in the business as we continue our shift towards the cloud and subscription revenue. Before I turn the call over to questions, I am pleased to announce that Jeff Bray, our Vice President of Investor Relations, will be assuming a new role here at Rapid7 as Vice President of Financial Planning and Analysis. Jeff has been with us for almost two years, and he has been a significant contributor to our team and has raised the bar of our investor relations function since his arrival. We all wish him well in this new role. Jeff will be succeeded by Neeraj Mahajan, who comes to us from Grantham, Mayo, Van Otterloo.
Neeraj and Jeff will be reaching out to investor and analyst community post this earnings call to provide a smooth transition for this very important function. With that, we appreciate your time and support, we'll open the call for any questions. Operator?
Ladies and gentlemen, if you have a question or a comment at this time, please press the star then the one key on your touch-tone telephone. If your question hasn't been answered and you wish to move yourself from the queue, please press the pound key. Our first question comes from Saket Kalia with Barclays Capital.
Hey, guys. Thanks for taking my questions here, congrats all around. Congrats, Jeff Bray, on the new role. Congrats, Neeraj, on the new role as well.
Thanks, Saket.
Thanks.
First, maybe for you, Corey. I thought one of the important metrics in the quarter, even though it's a small increase, but just maybe psychologically, is that expiring renewal rate getting a nine handle on it. The question is, how much of that, in your view, is from perhaps a more enterprise-heavy customer base versus the perhaps naturally higher renewal rates that come from subscription, in your view?
Yeah, no, it's a great observation. As you know, it's been steadily increasing. The dominant effect actually was that our platform customers have a much higher renewal rate overall than our non-platform customers. As more and more of our customers move to the platform, and as our recurring and subscription revenue accelerates, we're actually seeing much higher renewal rates on our platform customers than others. That's driving it higher in an environment, by the way, where we're introducing lots of new products, and newer products tend to have lower renewal rates than mature products. It's something we're quite pleased with, even as we continue to actually add new products overall to the platform.
Got it. That's helpful. Jeff Kalowski, for my follow-up for you. We've talked about professional services revenue and bookings being lower as we've sort of transitioned more to an ARR focus. The question is, where do you think that professional services line maybe bottoms, whether that's as a percentage of revenue, as a minimum dollar amount per year, per quarter? How do you think about professional services in the context of the model longer term?
Yeah. Saket Kalia, clearly, it's been slowing down this quarter. As we said earlier, with the comp plan focus and our sales force driving more ARR, that has certainly had effect, and it's been a favorable change. Secondly, we also decided to focus on more higher strategic services. I'll point out that those services, those higher strategic services engagements, are higher margin, which with our margins going down, it's more due to some excess capacity. However, it's too early to really say where the trough is. It'll be a lower percentage of the total revenues. I think at this point, let's close out the year. We've got another quarter to go. On our February call, we'll give better guidance on where we think that will go in 2019.
Got it. Very helpful. Thanks, guys.
Thank you.
Our next question comes from Rob Owens with KeyBanc Capital Markets.
Great, thanks for taking my question. I guess, first and foremost, as you guys have meaningfully expanded your product portfolio, what has the channel response been? As you get into some more of the traditional type of SIEM and endpoint categories, has this helped channel, or is there more complexity given the broader suite approach coupled with more of a subscription model? Just curious, at this point, what the channel leverage looks like.
I would say our demand from the channel has actually grown and continued to grow. I think that's more a reflection of the channel sees long-term opportunity with Rapid7. Now we're still in the early innings of our expansion into the channel. We're really focused on which channel partners have the right capability. It's clear that we actually have accelerating growth. We built a broader portfolio, especially if you look at our Komand technology, that provides a vast amount of opportunity for our channel partners to actually make money on our platform. Channel partners are recognizing that. Both the inbound interest that we have from channel partners and our discussions with them, make it very clear that we have lots of expansion opportunity with the channel. I think we're in a great position at this point. It's still early innings.
Number 2, I'd love some of your thoughts just in general around InsightVM. I know there's a lot of speculation that maybe VM slows next year as other categories in security take precedence. What do you think relative to your opportunity for InsightVM as you look at 2019? Clearly, the other parts of your portfolio are going to be growing faster, just kind of a general outlook for VM as we enter next year.
Yeah. The first thing is that the VM market's doing incredibly well. We see it as an incredibly healthy market overall. Frankly, it's much healthier than we expect or anticipated, if you think about the plans that we shared at our past Analyst Day. What we see is that the demand for visibility in general has lots of legs well into the future, because people's environments are complex, they're changing, and they want to know what do I have? What's the risk of what I have? What's happening in my environment? How do I best optimize and respond to the changes in my environment, and how do I make myself more efficient? Visibility is a core part of SecOps, we see continued demand for that.
As far as vulnerability management, as it goes forward in the future, I think the underlying baseline of the aspect of visibility it provides continues to be a core demand driver. As I said, it's well ahead of what we expected in our models. If it continues to be strong, that's great. We have strong upside to the plan, but we're really focused on overall visibility and how that translates to people's security operations.
Thanks, Corey.
Thank you.
Our next question comes from Gregg Moskowitz.
Thanks for taking my questions, and I'll echo the congratulations on the results here. If we look at the growth in ARR, congrats again on the acceleration there. How should we think about the underlying fundamental drivers of that expansion? Meaning, is it asset expansion within VM? Is it adoption of IDR or AppSec? All the above? How would you sort of categorize the different components that have driven that relative acceleration?
It truly has been broad-based. We see it across our portfolio. We see it across the customer expansion. We talked in the call about the ARR for customer expanding, so we're clearly seeing strength within our customer base. We see it in the new customers that we're adding. We talked about adding 10% growth in our customer base, but that really is a tale of two stories, where we have services-only customers that are more tactical and more transactional contracting, and we have much higher expansion in our strategic SecOps product customers. It very much is broad-based growth across all of those different dimensions that is leading to the higher ARR growth.
I do want to be clear is that one of the underpinnings is we have very strong performance in the core vulnerability management market, even as we actually are aggressively expanding into the other parts of the SecOps market and opportunity.
That's helpful. Speaking of the expansion to the other opportunities, with the launch of InsightConnect, I know it's early days, but can you talk about, one, the initial customer response, but perhaps more importantly, can you talk about how InsightConnect compares relative to sort of the standalone SOAR platforms that exist out there and the relative advantages you have through an integrated platform? Thank you.
First and foremost, as you may recall, we actually accelerated the launch of InsightConnect based on customer feedback. We had originally told you that it'll be sometime in 2019, but we made it through our first incubation cycle much quicker than we expected, both as a result of great engineering work, but also great customer feedback and go-to-market team engagement work with our customers. I would say the feedback so far, it's very early, has been extraordinarily positive. On your second point, as far as the differentiation, we really think of the differentiation in two parts over time. The first part, which we think is important, is we think that the SOAR market and security orchestration automation market is a mainstream market.
This is a prime use case that really is going to have productivity improvements and impact for customers both large and small, and we really focus on a solution that actually makes it extraordinarily easy and simple for customers of all sizes and skill sets to get the benefits of those productivities. The ease of use and the built-in integrations is of course a key focus and a long-term differentiator. That's true in a standalone case. The additional benefit that we actually have by baking it into our platform is that we have quite a large customer base, and those customers get great experiences right out of the box that allows them to get faster productivity and get experience with security orchestration and automation on a product platform that they're used to, comfortable with, and already are baking an increasing amount of their IT and security infrastructure in.
Thank you. Our next question comes from Matthew Hedberg with RBC Capital Markets.
Hey, good afternoon, guys. Thanks for taking my questions. International continues to do well, and it's an area of focus for you guys. I'm curious, as you think about heading into next year, when you think about the opportunity internationally, how do you think about additional investments there? From a broad adoption perspective, where is that market relative to the U.S., especially as your platform expands beyond VM?
Yeah. If you look at our percentage of revenue basis, it's still under 20%. We think it has massive expansion opportunities. If you look at it, we really start looking at it on a per ARR basis as we go forward, and you continue to see it actually continue to climb up year by year as a percentage of ARR, and as a percentage of revenue, but definitely as a percentage of ARR. As we actually add more cloud instances around the world, you all know the geopolitical backdrop. More and more countries want to have an instance in their own territories, and we've been adding more instances around the world. We added the Australia instance this year. We expect that dynamic to continue to happen, and we think we have lots of upside there.
One of the things we continue to see is that the overall international market is behind the U.S. market in terms of security spend. We think that's changing. You definitely see that in Europe, where we're seeing strong and healthy performance. We expect that continue to change overall, and we expect the international market to grow faster than the U.S. market in general.
That's great. Then maybe a follow-up on the prior question on Connect. Can you help us with how that's priced? If a customer, I mean, with the pre-built integration with VM and IDR, it seems like it's going to be a natural upsell. If you think about what that could mean on a per customer ARR basis, any sense on what the uplift would be there? Or could be there?
Yeah. I would say it's too early. It's priced on a per workflow basis because that's the natural way, and that's the least friction way for customers to price it. We think that this has one of those viral effects that can lower the cost of our sales and marketing over time. Is because if you think about it, if customers have a great experience with a couple of workflows, the expansion of workflows is quite natural. One of the things that we're paying attention to is sort of like, what's the average workflows per customer, and how does that evolve over time? We, in fact, are seeding out workflows in our InsightVM and InsightIDR solutions. We think the feedback on that, at least from some early conversations, has been positive.
It's too early to tell what the average workflows per customer will be overall.
That's great. Thanks a lot, guys. Congrats on the results.
Thank you so much.
Our next question comes from Michael Turits with Raymond James.
Hey, guys. This is Eric Keith on for Michael. Congrats on the quarter. A question for you, Corey. Just to follow up on Rob's question earlier, could you elaborate on your penetration of VM with existing customers? Further to that, can you talk about some of the puts and takes of why customers are choosing to expand their visibility? Or maybe their hesitance in expanding their coverage? Just curious on your thoughts on that.
Yeah. We haven't seen hesitancy in expansion. I think the backdrop you asked about is we're clearly growing our new customers, and that's working well there. You're also highlighting the fact that regardless of cross-sell, we're actually growing the upsell into customers' accounts, and customers are actually getting more VM visibility with us. That is an extraordinarily healthy dynamic. I think that's driven by two factors. One, they actually have more assets and more types of assets that need visibility into. Whether that's cloud assets, whether that's IoT assets in the future, there's more and more assets that they're looking for visibility into. The second thing is that VM customers have historically been under-penetrated. Now, the environment is changing because they're adding more assets. We think across our customer base, we still have substantial room to actually grow the upsell and cross-sell.
Part of the reason that we can do this, though, is that we are still adding new customers to the platform. Of course, our customers capped at 100% of their assets, and we've been growing the assets of our customers, but we continue to add new customers into our customer base that are starting off at lower levels, and then they grow and expand over time. That actually creates a positive dynamic for us in the overall VM market and gives us more sustainability on the upsell dynamic.
Got it. A question for Jeff, if I may. I know you guys are moving away from billings as a metric, but could you provide any color on some of the moving pieces for the deceleration in current billings on a 605 basis?
We don't have any comparative data from the prior year if you're trying to look at the change in short-term billings by taking the revenue plus the change in current deferred, because it's really not meaningful. If you look historically, we're losing the perpetual value of the one-year portion, which makes it look like it's slowing down, and also the decline in services, which is generally all built up front, also affects the change in current billings. That's one factor affecting the change. That's why we talk about ARR. That's really the most important metric, not billings. As we said earlier, we don't guide to billings for a couple of reasons. One is that we're going through the transition to subscription, and it's not meaningful year-over-year, and really the focus is on ARR.
Right. Just one last one if I may. Is there a run rate on R&D for tCell?
No, they have low teens in the number of employees plus their OpEx. That's where they are right now in terms of employees.
Okay, thank you.
Our next question comes from.
Thank you.
Our next question comes from Alex Henderson with Needham.
Hi. Good afternoon. This is Dan Park on for Alex. Thanks for taking my questions. As you continue to broaden the Insight platform to incorporate more SecOps features, is this helping to drive more competitive displacement opportunities versus other VM-centric vendors? Clearly, there's plenty to go around with three of the major players all growing at a 20%-plus clip.
Also, have you seen a meaningful change in overall competition?
There's no meaningful change in overall competition. I think the market has great dynamics. I think there's a large market that can support a number of different winners. We don't focus that heavily on the competition in the VM market overall. I would say that displacement is one of the things that we do primarily when customers are looking to operationalize security, and they love our platform story, and they love the story of what we're bringing and how we're tying it all together and driving productivity for their organization. We don't have a strategy that says we have to grow by going out and taking from others. Ours really comes from customers who are looking to operationalize their security, customers that value productivity enhancements, and that want the full visibility that we have. We're focused on those customers that have the most lifetime customer value for us.
Occasionally, those customers are displacing other vendors, but that's not a focus of our growth.
Okay, great. Thanks for the color. As a follow-up, how big of a nut do you expect the step up in OpEx to be with the R&D from tCell and the systems improvement initiatives called out in Q4? Is this expected to continue for a few quarters, or is it really just a one-time impact?
Well, what we said is that we shifted some expenses that did not hit in Q3 into Q4. With respect to next year's growth, what we said is that OpEx is not having a material effect to the full year in OpEx and revenue in 2018. We'll provide a better update when we give guidance in February for the year, for the overall year.
Yeah, I'll provide some of the color behind this. One, as we actually said in our script, we're not changing our profile that we actually expected to go forward. The other thing that I'll highlight is that because our ARR is higher and because our go-to-market engine and more importantly, our customer engine is working faster and better than expected, we actually have increasing confidence in the long-term leverage of the overall model. The systems investments that we're making, specifically in subscription management, specifically in some of our back-end systems, really are all about driving long-term efficiency and increasing the sustainable profitability level over time.
Okay, great. Thanks for the clarification.
Thank you.
Our next question comes from Jonathan Ho with William Blair.
Hi, good afternoon. I just wanted to start with tCell. Can you talk a little bit about what you're adding with tCell that you didn't have before with your AppSec capabilities?
Yeah, that's great. The backdrop or the context of the area is that cloud-based applications are a new standard and a new norm of the type of applications that we are experiencing. If you think about the last 20 years, most of the applications were built and designed on-premise. Now we have this substantial growth of SaaS and cloud-based applications. That, by the way, is not just the traditional technology companies. It's companies of all sizes and scales that are making applications. You have this massive application proliferation of cloud-based applications. We have one of the leading technologies on the dynamic testing. How do you actually test applications about how they perform real time from a security perspective?
What tCell allows us to do, though, is it allows us to actually monitor those applications real time from an embedded perspective to actually look, are they being attacked? Are they being compromised? Then ship that monitoring to protecting those applications real time. It's part of our continuing strategy to actually really turn application security into a long-term massive growth pillar and opportunity. The underlying fundamentals is there's lots of new cloud-based applications that are on the market, and that will be on the market, and this is a market that has incredibly positive competitive dynamics, and we think that we're going to be positioned with continued investment to be a leader overall in this market.
Got it. Just as a follow-up, as you start to see more platform sales, are you starting to see maybe customers look at your products and not lead with a VM sale? Potentially multiple tips of the spear that you maybe didn't have in the past. I just want to get a sense of whether there's any potential there on the non-VM side.
Absolutely. That's frankly expanding. We originally thought that it would be sell VM first and then sell the other products. IDR proved that half of the sales, which is net new customers that didn't have a VM solution, we proved that we could do it. Increasingly now our sales team has the luxury of just going in and say, "Hey, what's your biggest problem?" If it's application security, we can solve that. If it's vulnerability management, we can solve that. If it's monitoring incident detection and response, we can solve that. If you have one of our competitors' VM solutions and another competitor SIEM solution, and you really want to take that data and then use it to automate your workflows, we can go in and help you get better productivity off the existing data solutions we have.
We'll do a great job for you'll be more likely to move over time. Increasingly, we have the capability to go in and just say, "What's your problem, and how do we add the most value?" That drives long-term go-to-market and sales productivity because we don't have to force the conversation. We can just start with the point of greatest pain.
Thank you. Our next question comes from Gregg Moskowitz with Cowen and Company.
Okay, thank you, and congratulations, guys, on a good quarter. I had a follow-up on InsightConnect. My understanding is that InsightVM and IDR do include some more basic automation functionality. If you could elaborate on that and how much appeal you think InsightConnect offers to those customers of yours going forward, that would be helpful.
Yeah, absolutely. One of the things that we look at when we do expansions, and especially acquisitions, is that it should be a great large TAM expansion in its own right, but it's to also differentiate our existing products and offerings versus competitors in the market. InsightConnect is a perfect example of that. We talked earlier about how it actually compared favorably and what the overall dynamics in security orchestration and automation were, but it also does an amazing job of differentiating our solutions. One of the biggest complaints that people have, I'll use the vulnerability management market, for example, in vulnerability management, is that it's great. You provide visibility, you provide understanding. I know what to do. I don't have the capacity to go actually remediate and fix all of these issues.
We embedded and included in there, at actually no cost, automation scenarios that allow people to actually connect to their patch management and their configuration management systems, and automatically translate from vulnerability management to automatically updating their systems to improve the productivity of the overall ITS security teams. Again, vulnerability management. I have issues. I want to automatically contain vulnerabilities in my environment so I can patch them. Automatically integrates into the network infrastructure that allows automatic containment or orchestrated containment. That allows our customers to be more productive on our solution than they are on competitive solutions. Again, customers prefer us because of our operations focus and the productivity that we drive to their teams.
If you take IDR, again, it's great to actually know that you have an incident, it's great to investigate an incident, but the entire SIEM market has been lacking the ability to really respond to the incident. That's been an outsourced affair. What we're doing with automation, with our InsightConnect product, is we're tying the analytics and the investigation to the response operations, allowing you to automatically contain and limit the damage by tying both security and IT together. What that means is that if I find an issue with a user, I can automatically integrate with the identity access and management system. If I find an issue with the device, I can automatically contain that device on my network.
Part of our value proposition with our security operations overall stack is that it allows different teams across both development, security, and IT to work together more efficiently. What we've included in our products from an automation perspective is just one example of that. Our expectation is that as people get experience with that, they'll continue to expand their footprint and workloads over time.
That's really helpful, Corey. Appreciate the color and all the detail on that. Just as a follow-up, you did mention earlier that you're starting to see more traction in retail and hospitality as those customers realize they need a more secure infrastructure. I'm wondering if there's anything that you're putting in place to emphasize your go-to-market focus on these industries, or is it just a function of seeing more pull from those customers? Thanks.
Yeah. When we see more pull from customers, we actually take that into account in our go-to-market planning and our territory assignment. We shift our focus about how we plan and allocate our go-to-market resources, be it from a marketing perspective or from a sales resource allocation perspective as we see different opportunities.
All right. Terrific. Thank you.
Our next question comes from Melissa Franchi with Morgan Stanley.
Great. Thanks for taking my question. I wanted to follow up on the tCell commentary. Corey, should we anticipate that tCell will eventually become its own product on the Insight platform, or is it largely going to be developed into InsightAppSec? Just very broadly, if you could just maybe give us an update of how InsightAppSec is progressing relative to your expectations. It's a product that we haven't heard too much about recently, would love to get an update.
I would say InsightAppSec in general is well ahead of our expectations. The market's stronger, our position is stronger, and we're very optimistic about the overall application security market in general. I would say on the packaging, it's too early to tell. We are very disciplined when we acquire technology about putting them through our incubation engine, which really figures out what's the optimal go-to-market pricing, package positioning, and messaging that drives the most adoption, and the most efficient customer acquisition for that particular product category. You will see us with a single or a set of application security offerings because it's a big market for us, but we're really focused on how do we minimize customer friction and how do we maximize customer lifetime value in this fast-growing market.
Yeah, Melissa, I'll just add that the revenue is accelerating much faster than our overall growth rate, both in the ARR and in revenue. It's doing very well.
Last thing, it's just a market that's under-penetrated in general, and that we're under-penetrated in. We have great growth prospects in this market. I'll also say we really like the competitive dynamics overall in the cloud-based application security market.
Got it. Okay. One follow-up for Jeff. Jeff, this year we've obviously seen a divergence between ARR growth, billings, and revenue growth, and obviously that's from the subscription transition and contract duration changes. As we're looking into FY 2019, I know you're not guiding, how should we think about the relative relationship between those top-line metrics and how to think about relative growth between those?
Yeah. If you look at our overall ARR growth, what we're saying is this year we're going to be over 40%, and our recurring revenue today is about over 80% of the total. We're saying that the ARR will grow 30% over the course of the next two years. If you take our recurring revenue and you assume that will grow 30% into next year, and you apply a factor for services and the perpetual revenue is roughly $3 million in the quarter, that's going to decline slightly into next year. You can sort of get directionally to where the revenue will be for next year.
That's very helpful. Thank you.
Thank you.
I'm not showing any further questions at this time. I'd like to turn the call back over to our host.
Thank you all for joining us for this quarter's call. I appreciate your time, and we look forward to talking to you next time.
Ladies and gentlemen, this does conclude today's presentation. You may now disconnect and have a wonderful day.