Good day, ladies and gentlemen, welcome to the second quarter 2018 Rapid7 earnings conference call. At this time, all participants are in a listen-only mode. Later, we will conduct a question and answer session, instructions will follow at that time. If anyone should require assistance during the conference, please press star and then zero on your touch-tone telephone. As a reminder, this conference is being recorded. I would now like to introduce your host for today's conference, Mr. Jeff Bray. Sir, you may begin.
Thank you, operator, good afternoon, everyone. We appreciate you joining us to discuss Rapid7's Q2 2018 financial and operating results, in addition to our financial outlook for the third quarter and full fiscal year of 2018. I'm Jeff Bray, VP of Investor Relations, I'm here today with Corey Thomas, our President and CEO, and Jeff Kowalski, our CFO. We distributed our Q2 2018 earnings press release over the wire, it is now posted on our website at investors.rapid7.com. We have also posted our updated company presentation and financial metrics file on our investor relations website, which includes additional information to help explain the impact of shifting to 606 on our Q2 financials. This call is being webcast and can be accessed at investors.rapid7.com. The webcast of this call will be archived and a telephone replay will be available on our website until August 13th, 2018.
We would like to bring the following to your attention. The date of this call is August 6, 2018. Discussion today contains forward-looking statements about events and circumstances that have not yet occurred, including, without limitation, statements regarding our objectives for future operations and future financial and business performance. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Statements containing the words such as anticipate, believe, continue, estimate, expect, intend, may, will, and other similar statements are intended to identify such forward-looking statements.
Actual outcomes and results may differ materially from the expectations contained in these statements due to a number of risks and uncertainties, including those contained in the Risk Factors section of our most recent quarterly report on Form 10-Q, filed with the Securities and Exchange Commission on May 9, 2018, subsequent reports that we file with the Securities and Exchange Commission. The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by applicable law.
On this call, we will provide and talk about our results using non-GAAP financial measures and provide non-GAAP guidance unless otherwise stated. For purposes of comparability, we will be presenting results in accordance with ASC 605 in addition to ASC 606. We believe that the use of these non-GAAP financial measures provides an additional tool for investors to use in understanding company performance and trends, but note that the presentation of non-GAAP financial information is not meant to be considered in isolation or as a substitute for the directly comparable financial measures prepared in accordance with GAAP. We have provided a reconciliation of the historical non-GAAP financial measures to the most comparable GAAP measures in the financial statement tables included in the press release issued today announcing our results. The press release announcing our financial results is available on our website at investors.rapid7.com.
At times in our prepared comments and our responses to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be one-time in nature, and we may or may not provide an update in the future on these metrics. With that, I would like to turn the call over to Corey. Corey?
Thank you, Jeff, and good afternoon, everyone. Thank you all for joining us today on our second quarter 2018 earnings call. Rapid7 had a great second quarter with strong performance around the world and across our products. Our cloud-based SecOps solution addressed the fastest-growing markets in security, and our shift towards recurring revenue is going much better than expected. For the fourth quarter in a row, ARR growth accelerated, reaching 44% growth this quarter. The financial highlights for Q2 2018 were under ASC 605, recurring revenue grew 43%, and total revenue grew 30%. We made continued progress towards hitting our 2018 and 2019 profitability goals. As a result of our first half performance, along with a solid second half pipeline, we are raising our guidance for the rest of the year, highlighted by our new goal for 2018 ARR growth of over 40%.
We have increased confidence in achieving the goals that we outlined at our recent Analyst Day of growing ARR over 30% and revenue over 20% through 2020. Our strong results were driven by continued strong execution across our go-to-market teams, a set of market-leading products, our adoption of an ARR-focused strategy, and the recognition by enterprises of the strategic value of our cloud-based SecOps products. The second quarter was our first full quarter offering all of our products on a subscription basis and with sales compensation based on ARR. Our go-to-market teams have quickly adapted to our new approach, and we are beginning to realize the productivity benefits of our corporate focus on recurring revenue. Looking at our markets, enterprises are operating in increasingly complex IT environments, yet they have not focused on the core maintenance and management of their technology.
Security teams understand that the key question is no longer, "Am I vulnerable?" Rather now, "How vulnerable am I?" No longer, "Am I compromised?" How and when was I compromised, and how quickly can I remediate? More enterprises understand that the first step to managing these risks is to gain visibility into their environment while having strong analytic solutions to help them set their priorities for remediation. However, most security, IT, and DevOps teams still find themselves operating in silos, struggling to work together. This misalignment not only results in poor security practices, but it also slows down an organization's ability to innovate. SecOps is a practice of aligning security, IT, and DevOps teams through a shared set of data and tools. Shared visibility, supported by analytics and automation, creates a common language to connect disparate teams, break down barriers, and ultimately accelerates innovation.
The Rapid7 Insight platform unifies data collection and delivers visibility, analytics, and automation needed to power a well-managed SecOps program. Rapid7 SecOps solutions that are easy to install and easy to use are resonating with our customers, who are increasingly viewing these solutions as strategic to their success, as evidenced by our increasing cloud-based platform penetration. Just providing visibility and analytics is no longer enough. Even the most efficient security teams are still overwhelmed with manual and mundane tasks required to protect their IT and development environments. That's why we're excited for the upcoming launch of the next product on our Insight platform, which will be the evolution of Komand, our security orchestration and automation solution. We acquired Komand last year to add another easy-to-install, easy-to-use solution to the security team's toolbox, and so far, customer response to Komand has been enthusiastic.
Komand is designed to enable customers to quickly create and implement workflows that can dramatically improve the efficiency of their security and IT teams. Later this year, we will launch the Insight version of Komand, both as a feature of our core Insight solutions and as a standalone Insight product, which we believe will further differentiate Rapid7's set of cloud-based SecOps solutions. Our new automation product will join a portfolio of cloud-based SecOps solutions that have been recognized as leaders and visionaries, all providing visibility, analytics, and now automation on a shared platform that help make our customers more secure and more effective. Rapid7 has three major growth engines on our platform. InsightVM, recognized as the future of vulnerability management by Forrester. InsightIDR, a UBA-powered cloud-native SIEM, recognized as the visionary with the highest ability to execute by Gartner.
InsightAppSec, the future of cloud-based application security testing, which is rapidly expanding as a key part of our highly rated dynamic application security testing portfolio, as rated by Gartner. Now, let's review the second quarter by looking at our 2018 goals. Our first goal is to deliver ARR growth of at least 30%. We're focusing on ARR because it is a good indicator of how quickly our high-quality recurring revenue is growing. It is a more useful metric than billings, and ARR is the primary metric we use to manage the business. This quarter, ARR growth accelerated to 44%, and we are raising our guidance for 2018 ARR growth to over 40% as our transition to a recurring revenue model is ahead of plan.
ARR growth is being supported by products that address the fastest-growing markets in cybersecurity, our shift from perpetual to subscription across our products, and the strong performance of our go-to-market teams who are quickly transitioning to selling based on ARR. Early in 2018, we officially shifted all of our products to subscription pricing, and in Q2, we saw a strong shift towards SaaS and subscription bookings. Our customers have quickly embraced the simplicity and ease of subscription pricing and continue to migrate to our cloud-based solutions, with platform customers growing over 60% year-over-year, and about 45% of our customers now using one of our Insight platform solutions. With our new bookings generating more recurring revenue, we saw strong growth in ARR per customer, increasing 31% year-over-year to over $27,000 per customer.
This increase is being driven by higher quality new customer addition, as well as ongoing growth in both upsells and cross-sells. This has resulted in a higher mix shift of subscription bookings away from services, further increasing our confidence in our mid and long-term outlook. Our second goal is to leverage our SecOps portfolio to drive new customer growth, upselling and cross-selling. We grew our customer base 10% year-over-year, with even faster growth of our SecOps customers, but with deceleration in our services-only customers. With higher ARR per new customer, we believe these relationships will drive higher lifetime value. One of our new customers is a large private software company where we displaced a competitor that was struggling to provide visibility into the customer's AWS environment. Rapid7 has expertise in working with major cloud providers, including AWS and Azure.
InsightVM gives customers broad visibility into cloud assets as well as great extensibility with our open APIs. Our land and expand remains strong, and we maintain a high renewal rate at 122%. One of the main drivers of our strong renewal rate is our customers coming back to add more coverage to their environment to improve their visibility. This quarter, we had a Fortune 500 retail customer that purchased InsightVM last year return to add complete coverage of their environment, providing them comprehensive visibility across their entire store footprint. On the cross-sell side, a leading national law firm that has been an InsightVM customer was looking to add security orchestration and automation to their SecOps practice. When we demonstrated how well Komand worked with InsightIDR, the CISO realized that their legacy SIEM was both expensive and difficult to use, generating more false positives than actionable information.
The customer was won over by InsightIDR's pre-built dashboards and simple visual search. While Komand's out-of-the-box workflows and code-free automation greatly simplified their detection and response effort. Visibility into application security continues to be a critical need for enterprises, and we had another strong quarter across our application security portfolio. A global consulting firm joined us as a new customer, adding InsightAppSec to cover 100 of their internal applications, with an opportunity to expand to cover hundreds more. Application security has also provided a huge expansion opportunity, as in Q2, a Fortune 100 software company again expanded their AppSpider coverage, and a global 500 European bank customer added AppSpider to provide visibility into hundreds of their global web applications. This cross-sell deal was also a good example of our solid growth international, a long-term opportunity that is still in the early innings.
To take further advantage of this opportunity, we recently expanded our Insight platform instances to Canada and Australia, providing customers in those regions the ability to better address data governance requirements and the flexibility to keep security data local. Finally, our third goal, to improve profitability. During the second quarter, we improved our operating loss both sequentially and year-over-year. We continue to expect to generate cash from operations in 2018 and are making progress towards our goal of profitability in 2019. With the success of our subscription transition, we will enter 2019 with more recurring revenue than we originally forecasted, which will help improve the scale of our business and our ability to hit our 2019 targets. With that, I would like to hand the call over to our CFO, Jeff Kowalski. Jeff?
Thanks, Corey. Before I begin discussing our strong results for the second quarter 2018, I want to remind everyone that as of January 1st, we've adopted ASC 606 on a modified retrospective basis, therefore, we'll report each quarter's results under both ASC 606 and ASC 605. We've included all of these details in our earnings press release today. When discussing our year-over-year growth rates and other key trends in our business, we will be comparing our results on an ASC 605 basis, as we don't have prior year operating results under 606, and a comparison would not be meaningful. We are pleased with our strong performance in the second quarter, which beat our guidance on all key metrics and was highlighted by accelerating ARR growth of 44%. First, I will briefly discuss our results on an ASC 605 basis.
Total revenue for the second quarter of 2018 was $61.6 million, an increase of 30% and ahead of our guidance. Recurring revenue was 77% of total revenue in the second quarter of 2018, up from 70% in 2017, which is growth of 43%. Looking at the business geographically, in Q2, North America comprised 84% of revenues, growing 29%. Rest of world revenue increased 33% year-over-year and contributed 16% of total revenue in the second quarter. Our rest of world revenue growth continues to be impacted due to a large services deal recognized in Q2 2017. Our ARR growth from outside of North America continues to be very strong.
On an ASC 605 basis, non-GAAP operating loss was $5.7 million, also meaningfully better than our guidance of a loss of $8.7 million-$7.8 million, adjusted EBITDA loss was $3.9 million for the second quarter compared to a loss of $5 million in the prior year period. Our operating margin improved to a loss of 9% from a loss of 13% in the prior year. Now, I'll discuss results on an ASC 606 basis. Total revenue was $58.4 million, above the high end of our guidance, with the primary difference between 606 and 605 being lower perpetual revenue due to ASC 606 accounting. Our product revenue was once again driven by strong bookings globally in both VM and IDR, with accelerating recurring revenue growth. As we expected, with the shift towards ARR quotas for our sales force, we did see a slowing in professional services bookings and revenues.
We expect professional services revenues will be flat to down compared to 2017. Visibility into our revenue forecast remains very high. Recurring revenue was 79% of total revenue under ASC 606, and 83% of total revenue came from deferred revenue on the balance sheet at the beginning of the quarter. The value of our annualized recurring revenue increased to $198.6 million at the end of the second quarter, a 44% increase year-over-year, and an acceleration from 38% growth in Q1. Evidence of the strength of our products and the success we're having with our shift to subscription. We now expect ARR growth for the year to be over 40%. Calculated billings for the second quarter were $64 million. Average contract lengths were 17 months for total billings, down significantly from 23 months in the prior year period, and down slightly from 18 months in Q1.
As we said, since we launched InsightVM, and given the move of our full portfolio from perpetual to subscription, we have expected our customers to shift towards one-year contracts, and we saw that in Q2. This reinforces our belief that billings are no longer a meaningful comparison to prior periods during this transition, as they don't capture the benefit of a higher subscription mix and growth of our annual recurring revenue. While contract lengths will be difficult to forecast during this transition period, we believe it's possible they could shorten further from Q2 levels, and our operating cash flow could be affected. However, we're still forecasting cash from operations to be positive for 2018. Our customer count increased by 10% year-over-year, and we ended Q2 with more than 7,200 customers globally.
As Corey mentioned, we continue to see an improvement in the quality of our customer base, and our ARR per customer increased to over $27,000 or growth of 31%. Overall, we continue to see strong bookings from new customers, upsells and cross-sells. Our renewal rate was 122%, and our expiring revenue renewal rate was 89% in the second quarter. Turning back to the P&L, non-GAAP total gross margin for Q2 2018 was 73%, up slightly from Q1. Product non-GAAP gross margin was 78%, down slightly from Q1, and professional services non-GAAP gross margins improved to 38%. During the second quarter, professional services margins benefited from slightly higher utilization compared to Q1. We continue to expect professional service gross margins in the mid-thirties for the full year 2018, and for our total gross margin to stay in the low to mid-seventies on both an ASC 605 and ASC 606 basis.
For operating expenses, please note that the only difference between ASC 605 and ASC 606 was in the sales and marketing expense, which was $2.8 million lower in ASC 606 due to the impact of deferring sales commissions, which was in line with our guidance. During the second quarter, sales and marketing decreased to just under 50% of revenues. We realized about 150 basis points of leverage in sales and marketing year-over-year, with the additional improvement due to the accounting changes affecting revenue and commissions under ASC 606. Given the success of our shift to subscription, we'll continue to make investments into the second half of the year to help drive ARR growth, but we still expect to see leverage from sales and marketing expense for the full year of 2018. Moving to second quarter operating loss.
Non-GAAP operating loss was $6 million, which was well ahead of our guidance of a loss of $9.8 million-$8.4 million, and our operating margin improved to -10%. Adjusted EBITDA loss for the second quarter was $4.2 million. Non-GAAP net loss per share was $0.13 in Q2 2018, ahead of our guidance. We ended Q2 with cash equivalents, and investments of $118.6 million. This compares to $92 million as of December 31, 2017. Our operating cash flow for Q2 was negative $9.1 million. Year to date, cash flow used in operating activities was negative $1.8 million, as we mentioned earlier, we expect to remain cash positive from operations for 2018. However, we could potentially be down from 2017 due to lower contract lengths. Moving to our third quarter and full year guidance.
As for ARR, given the strong momentum we have built in the first half of 2018 and our strong performance on new bookings and churn in Q2, we're raising our guidance for the full year ARR growth to exceed 40%. For Q3 2018, on an ASC 606 basis, we anticipate total revenue to be in the range of $58.6 million-$60 million. We anticipate non-GAAP operating loss to be in the range of $7.3 million-$5.9 million. On an ASC 605 basis, we anticipate total revenue to be in the range of $61.7 million-$63.1 million, which equates to year-over-year growth of 22%-25%. We anticipate non-GAAP operating loss to be in the range of $6.6 million-$5.2 million. For the full year 2018, we are raising our total revenue guidance.
On an ASC 606 basis, we're raising our guidance for total revenue to be in the range of $237 million-$240 million. We are updating our guidance for non-GAAP operating loss to be in the range of $25 million-$22 million. On an ASC 605 basis, we're raising total revenue to be in the range of $250 million-$253 million, which equates to year-over-year growth of 24%-26%. We are updating our guidance for non-GAAP operating loss to be in the range of $24.5 million-$21.5 million. As Corey said, with our increased momentum through 2018, we are in a great position to meet our goal to generate non-GAAP operating profit in 2019. Our goal is to grow revenues by over 20% and ARR by over 30% through 2020.
Our full year guidance reflects our increased investment into our sales organization, we expect to realize leverage from sales expense for the full year 2018. In conclusion, this was a very strong quarter for Rapid7, driven by the strong momentum in our shift to the cloud and subscription, leading to our raised ARR growth outlook. With that, we appreciate your time and support, we'll open the call for any questions. Operator?
Thank you. Ladies and gentlemen, at this time, if you do have a question, please press the star and the number one key on your touchtone telephone. If your question has been answered or you wish to remove yourself from the queue, please press the pound key. Our first question comes on the line of Rob Owens of KeyBanc Capital. Your line is open.
Great, thank you guys for taking my question. Wanted to just touch on how you've expanded the portfolio, you've mentioned this a couple quarters with all products on a subscription basis. Help me understand what that's doing to your competitive position and where you're seeing strong new customer acquisition. I'm guessing on the VM side, that's not greenfield. Who, and what, and where are you displacing your competition at this point? Is it the single VM sale, or is it more kind of buying into the entire portfolio?
Yeah. It's early days for the overall consolidation, but we are seeing early indicators and evidence around it. Lots of what I would call our non-competitive deals are deals where customers have a great experience on our platform, which is very quickly getting adoption. I think we shared some of the numbers earlier. We see our platform very quickly getting adoption, and when customers have a great experience, when they have other needs, they're quite willing to actually explore the other capabilities that we have on the platform. While it's early days, we're seeing more than enough evidence that that is a strong value proposition, especially for existing customers. As for the new customer adds and additions, I would say that it's pretty evenly distributed. You see really two big areas where we add new customers.
One is the VM space, and I'll come back to that in a second, and the other area is in the IDR space or the SIEM space with Insight IDR. Both of those are core contributors, which we've said before. It was a pleasant surprise for us that we could actually expand into a new market and have prospects that weren't customers adopting our technologies in those spaces. That's really a testament, not just to the platform, but to the technology strategy that we've taken on by actually having best-of-breed technology solutions on a common platform. I'd emphasize that again. I think what's unique is that many times when people try to have a consolidated platform, it's one good solution and a bunch of mediocre solutions.
We took quite a different approach, we actually are consolidating on a common platform that has platform value, but we are designing and have designed all of our solutions to be best-of-breed quality. I think that gives us a unique advantage there. Specifically to your question about the vulnerability management market, we still see greenfield opportunity in the mid-market, which continues to actually do an effective job of adding net new customers there.
We do see displacements, though, in customers that are looking to upgrade their programs, and that displacement is true both in legacy markets, where you actually have traditional VM players that are no longer as active in the market, and we see that with some of our mainline competitors, where we see customers looking to upgrade their programs, and they really value the investments that we place not just on prioritization, but the investments that they've seen in workloads, and integration into their existing infrastructure with our SecOps vision. Those are the dynamics that we see. Just to add more commentary around the growth that we saw from ARR last quarter, overall, our products grew quite strongly. What we saw was that we had extraordinarily healthy growth across all of our product categories.
Great. For a completely unrelated follow-up, relative to the mix shift that's occurring more rapidly than you might have assumed initially, is that a function of how you're incentivizing your sales force? Is that just where customers want to buy? Anything to do with the channel on that front? How does that impact kind of the 2019 targets? Thanks.
Yeah. One very clear focus is we shifted, we talked about this before, we learned from others. One of the benefits of the shift to subscription when we made it, is that we had the opportunity to learn from others. We did shift our sales compensation model to be based off ARR. This year was a relatively big change. I would say there's two factors. One is our sales team has done a great job of adopting and moving to ARR. The second thing that's important, though, is that we have strong customer reception. These things are always harder if you're actually pushing stuff on the customers. In this case, we actually have a positive customer reception, which has made the transition much smoother than we could have anticipated.
Thank you. Our next question comes from the line of Saket Kalia of Barclays Capital. Your line is open.
Hey, guys. It's Saket Kalia here, Barclays. Thanks for taking my questions here.
Happy to. Thanks.
Hey. First, maybe for you, Jeff Kowalski, nice acceleration in the ARR. I think that Corey kind of talked about what worked from a product perspective. It sounded very much across the board. Maybe from your perspective, if you think about sort of the benefit or the growth in that metric coming from existing customers shifting to SaaS versus kind of the new customers that are adopting SaaS to begin with, how do you think about that dynamic, even qualitatively, and how it's helping the ARR number?
Saket, first off, as Corey said, we had strong ARR growth across all the product lines. In particular, we had strong upsells and cross-sells. If you recall, existing customers that were formerly Nexpose and then shifted to our SaaS offering, we did not raise the price on their renewal other than a nominal inflationary increase, because what we didn't want to do was penalize those customers for shifting to the platform. The motive was shifting to the platform to drive more cross-sell and more upsell. At our Analyst Day, we showed the examples of where we were on our perpetual product and that the ARR was in that sort of 40%-50% range on the ARR piece, that's the annuity going forward. The existing customers really did not drive the ARR growth.
When they convert, they convert at basically their current renewal rate plus an inflationary increase.
Got it. That's super helpful. Maybe for my follow-up for you, Corey. You touched on it a little bit in the prepared remarks around geographic expansion. I think you noted Canada and Australia. Maybe just more strategically, can you talk about how big you think the international business can be for Rapid7 down the road and whether we're seeing some of the same strategic focus on VM as a spend category internationally as maybe we are seeing here in the U.S.?
No, it's a great question. If you look at where we are, and we have been for a little bit, we're in the 15%, 16%-ish percentage range of the international as a percentage of our total business, we think that has great room to actually grow up over time. I would say one of the things to keep in mind that has been balancing the scales a little bit and sort of make that growth rate a little bit slower is that we've introduced a lot of new products, both our platform and products on our platform over the last two years. One way to think about it is that traditionally, when you introduce new things, you actually introduce it to a single market first, and you expand from there.
That's put a little bit of the weight and the bias to the U.S. for the introduction, you actually add both territories and localization as you go forward. We think we have plenty of growth, it's following the natural evolution, that's why you're starting to see the expansion of both new regions around the world that actually have our platform. It has gotten trickier because of the geopolitical issues, where you do need to have instances around the world, we've done an effective job of continuing to add instances around the world, also local teams and local support. We're very optimistic that our international and global business will continue to grow in excess of our overall business and that it would actually get to more normative rate as a percentage of total revenue as you go forward.
As far as your question about demand, I would say demand is picking up substantially outside of the U.S., specifically in Europe and in pockets of Asia. We see good health in places like Australia. However, I would say that it still lags the U.S. in terms of the intensity of the spend and the intensity of the focus, which is why we actually see that as a good growth opportunity. It's an area where you already have market traction, you have market awareness. The regulatory environment is increasing over there, we're seeing increasing both traction and growth and opportunity pipeline. I'll say the dynamics are healthy, but it's not quite to the U.S. level, both in VM and I would say broadly in the overall security market.
Very helpful. Thanks, guys.
Thank you.
Thank you. Our next question is from the line of Gur Talpaz of Stifel. Your line is open.
Awesome. Thanks for taking my question. Congrats on the quarter, apologies if there's some background noise here just at the airport.
No problem.
Corey, if you think about hitting the ARR target for the year, what assumptions are you making that gets you comfortable there with the big bump in the forecast here? If I look at the numbers, you're effectively calling for about $30 million plus of net expansion from current levels. It's a pretty big bump from here on out, you guys sound very confident. Can you give us some granularity to what you're kind of assuming within that assumption or within that forecast?
Yeah. You can imagine that we actually put a great deal of scrutiny whenever we look at any of these things, especially when we raise targets. I would say we were comfortable with it for two reasons. One, the easiest thing to look at is there's really three things we're going through it. One is, what does your past performance indicate? The second thing is, what's your pipeline indicate? Because that gives you good visibility into what you see both in the third quarter but also a pipeline for the fourth quarter, and you look at the trends there. I would say one of the most important things that we really obsess about as a company is the productivity of our sales reps and our teams. How are we doing both retaining and managing sales team?
We continue to have better than expected retention of our sales team, lower attrition of the sales team. We continue to be conservative in our assumptions there, and we're also seeing healthy and strong productivity from that team. You can imagine that the lower attrition of the sales team is really a testament to the fact that they are not just enjoying the culture and the experience of Rapid7, but they're also effectively able to engage customers and to sell the platform and the suite of products that we have on a subscription basis. That all contributes to what drives that 40% forecast. Again, past performance, opportunity pipeline, and the productivity of our core sales team is the things that we look at when we look at how we both forecast our business as we go forward.
That's really helpful. Maybe just kind of going a little bit more high level here. If you look across the VM world, it kind of feels like a pretty good place to be in security these days. Do you kind of see this as a function of the breach environment, meaning more ransomware-type breaches working in your favor? Or do you think we're seeing kind of a broader change in mentality as customers ultimately value these solutions kind of more than they did, perhaps even a few quarters or years ago?
Yeah, I would say that one of the reasons that we've always said that when you think about security operations and SecOps, VM is a great core to have is because it is at least half of the overall visibility story that you actually need. One half being the assets, and what assets, and what the risk and exposure and vulnerability of those assets. The other half being the data that talks about what's the activity in the environment and what's happening in the environment. VM has half of the visibility that you actually need to actually run an effective security operation. As people and organizations get more focused on how they effectively run their security operations, they become more and more obsessed with visibility. That's why you see the spend not just in VM, but also in logging SIEM and other technologies that provide visibility.
I would say the whole visibility sector in general is doing quite well these days.
That's helpful. Thanks a lot. Congrats again.
Thank you.
Thank you. Our next question comes from the line of Matthew Hedberg of RBC. Your line is open.
Hey, guys. Thanks for taking my questions. Well done. Corey, ARR per customer was impressive. It looks like you're only in the first few innings there. I think you've said that I think your average customer takes about one and a half solutions, and I believe you've said you think you can increase the ARR per customer seven times from here. I guess, first of all, is that seven times assumption based on currently available products? Second, we hear a lot about IDR and VM, but how is InsightOps contributing to that upsell?
Yeah, no, it's a great question. If you recall at our Analyst Day, we really had three categories that we talked about. One is the overall vulnerability and risk management category, which includes the InsightVM and the InsightAppSec, and their legacy on-premise component, InsightIDR for the SIEM category. We talked about the security, the core operations in our UX space. That included both the Komand and the follow-up to Komand, the cloud-based follow-up to Komand, as well as InsightOps. I would say that for our 7x, it includes InsightOps. Although we're seeing such material traction on the VM, IDR, and AppSec side, that's consuming most of our bandwidth right now. One of the things that you'll see over the coming year is a greater focus and greater resource allocation on both the InsightOps and on the Komand side and the platform version of Komand.
Komand is not built into the model of the multiple that we actually have that we talked about at the Analyst Day. We see a really strong multiple of ARR available to us. We see upside to that as we continue to actually invest and launch new things as we go forward.
That's great. Maybe as a follow-up, you guys have talked about your integration with VM and IDR with Azure. Can you talk a little bit more about what that partnership means? Is there any sort of feedback, beta customer feedback that you can share with us on that particular relationship?
Yeah. I'm sorry, Matt, can you just repeat the question one more time?
Yeah. Integrating Insight VM and IDR with Azure. I believe you guys talked about that during the quarter as sort of a new announcement.
Yeah, no.
Just kind of curious on some feedback on that particular integration.
Absolutely. It goes back to the discussion we're having around visibility, is that one of the drivers of visibility is that people's teams and resources are constrained, and you can't manage what you can't see. As IT organizations increasingly adopt more AWS and more Azure, they need the visibility to understand what assets do they have in those environment, what's the vulnerability and risk profile of those environments, and what are the activities, and is it indicators of normal behavior or is it an indicator of compromise? One of the investments that we continue to make is how do we actually have best-in-class visibility, both in AWS and in Azure. Both of those are critical environments for us to be able to both assess the asset footprint that organizations have, look at the risk profile, and look at the activity in those environments for indicators of compromise.
Got it. Thanks, guys.
Thank you very much.
Thank you. Our next question comes from the line of Gregg Moskowitz of Cowen and Company. Your line is open.
Yes. Hi, this is Michael Turits on for Gregg Moskowitz. Thanks for taking the questions. To start off, this is your first full quarter under what essentially is now a subscription-only model. How has the customer response to the pricing changes been if you look across the U.S., Europe, and Asia Pacific?
Again, it's been much more positive than we anticipated. We're practical about these things. We know that any type of change can have friction. I would say that we've had a lower share of friction than we expected as we've done the change. I think one of the key things to understand about us and our approach is we really focus on sustainability. The core of that is doing things that are going to benefit the customer. If you look, we're not about how do we maximize the dollar in the current quarter or near term. We're about how do you have a great customer relationship, deliver great value to the customer, and then maximize the overall lifetime value of the relationship that you have with the customer.
That led us, as Jeff indicated in his comments earlier, to take an approach that was very obsessed about how do we minimize customer friction, not just Rapid7 friction. In fact, that's one of the continuing areas of our focus as a business, is reducing more and more barriers for our customers and minimizing the overall customer friction. I think part of the warm reception that we've had to our subscription transition has been customers have recognized that that is the intent, and have worked with us.
Got you. Thanks. As for my follow-up, what are you seeing or hearing as it relates to the SIEM refresh activity? Thanks.
We continue to see a robust environment. There's really two things I'll talk about there, is that it's clear that organizations are focused on how do they actually shift from just having a SIEM that's purely compliance-focused to how do they do great detection. That's a shift that benefits us because we have been focused about how do you do great detection, and we continue to add in compliance-oriented capabilities. Detection is the core of what we do. The second thing that's clear is that customers value that we have an economic model that's aligned with the customer. Again, just like you can't manage what you can't see, you can't detect where you don't have visibility.
Our model that makes it easy for customers to have visibility across their entire platform because our detection is based on an IP model, not a purely storage model where customers have unpredictable pricing. That's been very well received by the market because it allows them to have the confidence that they have the visibility to do the detection that they want, but in a model that fits with their overall goals and objectives.
Thank you. Our next question comes from the line of Jonathan Ho, William Blair. Your line is open.
Good afternoon, and congrats on the strong results. I just wanted to start out with Komand. Can you talk a little bit about your expectations around the release? Maybe what are customers looking for, just given the demand for increasing automation?
Yeah, absolutely. The great thing is that the automation orchestration market or the SOAR market, as Gartner calls it, for security, it is an early-stage market in this incarnation, but it's replacing lots of the manual workflows and lots of the previous technologies that looked at IT and security processes that are there. The core demand for it is that there's just not enough people capacity to do all the work that needs to be done. By the way, lots of the work is repetitive in orientation, from our customer sales, it can be quite mundane. Customers have this issue where they're spending a great deal of their bandwidth on things that are mundane and competitive, but yet they don't have the capacity to truly catch up and make a difference. That's why you see such a heavy customer focus on orchestration and automation.
Our focus on the orchestration and automation market is to actually make it a mainstream solution where not just a narrow set of customers, but 10s of thousands of customers can receive the benefit of a powerful but yet simple orchestration and automation solution that allows them to really give a multiplicative effect on their overall technology and security workforce. That's what we've been building up, and that's what we've been extending. It does all kinds of workflows, whether you're looking about the automating parts of detection, automating parts of remediation, automating parts of containment, automating part of the IT management process related to security. There's lots of pre-built both integrations and workflows that come along today and will come along with our solutions in the future.
Our goal really is to drive the productivity of our IT and security teams, and that's where the timing, as I said in my prepared remarks, you'll hear more about that in the second half of this year. We have a big focus on that.
Great. Then just as a follow-up, when we think about the platform adoption that's happening, how often are you seeing customers maybe buy multiple elements to start out with? Is that increasing or about the same? The willingness to add on to the platform over time? Just wanted to get some maybe qualitative detail on what you're seeing there.
Yeah, it's interesting because you saw that our total renewal rate, which includes cross-sell and up-sells, went up slightly to 122%. What's interesting is we're seeing an overall increase in the ARR per customer transaction that we had in the quarter, and that's driven by a couple of things, is customers are wanting more visibility when they start off than they historically have, which is an extraordinarily positive thing. It's also customers are starting to look at multiple solutions together and purchasing multiple solutions together. It's definitely going up. It's going up in noticeable ways. It's just that we have a big customer base that you're looking at there, you continue to see ongoing improvement in that. We've got more than enough positive feedback from customers that our consolidation platform that's based on best-of-breed technology is clearly of value.
Thank you.
Thank you.
Thank you. Our next question comes from the line of Michael Turits of Raymond James. Your line is open.
Hey guys, good evening. Very strong quarter. Question on the guide. It's a raise for the year and a raise for the next quarter, but less so, it's pretty much where it was on EBIT, EPS, et cetera. You'll be getting operating leverage year-over-year, but not so much really out of the incremental raise here. Where is that incremental spend? It seems like some of it's certainly coming year-over-year in sales and marketing.
Yeah, Michael, great question, and you're absolutely right. It really comes in two areas. One is we got more customer visibility. We realized that we had the capacity to do growth and strong growth that was accretive to our long-term economics, meaning that we're making investments this year that will grow the customer base. Because we understand the productivity and what it costs to get a customer and the value that customers provide over a longer-term time horizon, we're really investing in both growth and long-term and mid-term profitability together. Again, we have a pretty clear line of sight into the overall customer economics. The second thing that I would say, which could be a good portion of what we're looking at there, is we are having an increased investment in systems.
The reason for that is we have a very positive shift to the overall subscription and cloud-based subscription model. We're really looking forward to think about how do we actually optimize the customer experience next year, but also how do we make sure that we continue to have strong renewal rates, but at the right cost leverage as we go forward, combined with the overall customer experience. We are investing in our overall systems that allow us to scale because we have the higher confidence in our overall growth profile as we go forward.
Yeah, Michael, you're right in that we are investing the revenue upside. I just want to point out that last quarter we were 33% plus ARR, and we've raised that number to 40% plus. Those investments will help drive a higher exiting ARR growth than what we were seeing in the previous quarter based on strong demand and pipeline.
Great. If I get a follow-up, there's obviously been discussion discussing IDR and the SIEM market. Can you talk about the SIEM market from a competitive perspective? Are you seeing all the major SIEM vendors? Are you seeing primarily those who are cloud-based like yourself? How is it shaking out from a segmentation perspective?
Yeah. I would say from what we see in new deals, meaning that they're not sort of like Rapid7 customers that are just looking to add on some capabilities to the platform, it is across all vendors. Part of the thing to keep in mind in that is that we are really the only cloud-based vendor of scale that is focused on security with a security analytics and SIEM offering. The people that we see there is that Splunk is of course there, and they have a strong position there, but their cloud solution isn't their default solution, and their sales force really isn't optimized around that. We definitely see some legacy ArcSight and some legacy IBM there, but it's not as strong as it once was, that's a good thing for us.
There's a bunch of other smaller players in the market that we see occasionally.
Great. Jeff, Corey, thank you.
Thank you.
Thank you.
Thank you. Our next question is from the line of Anne Messner of Susquehanna Financial. Your line is open.
Hi. Thanks for taking my question, congrats on the strong quarter, by the way.
Thank you.
Thank you.
Corey, you had previously said that your target of growing ARR 30% through 2020 assumed underlying VM growth of 15%, and that's a deceleration from what you've previously seen. Also, it would represent slower growth than what it looks like the broader VM market is seeing. Would you care to maybe update that assumption now that it looks like your overall ARR number is coming in much stronger than you would have anticipated?
Anne, I did say 15% plus.
Okay, fair. That's fair. Could still be.
It's clear that we're seeing very strong dynamics in the overall VM market, and we think they're sustainable. The thing that I would say, the tricky thing about the cost segmentation there is that what we're primarily focused on is both total ARR growth and how do we maximize both the value that we provide to our customers and the customer economics. It's really immaterial to me about which bucket it falls in. If you look at both lots of our go-to-market strategy and lots of our pricing analysis, it starts with, one, how do we maximize customer value? Two, how do we maximize customer adoption and penetration? From that really drives how we actually think about our pricing strategy, Our pricing strategy really then drives which buckets things go into. I just want to reiterate that because the VM market is incredibly healthy.
You have sort of like the three major players that all have growth of over 20%, and that's really an outcome of the visibility-driven customer demand. As far as what we manage to though, we are managing to how do we maximize both the total ARR and the ARR per customer. Because we have a more fully flushed portfolio, we're optimizing around our portfolio pricing and our portfolio go to market on our cloud-based platform. That is the primary driver that we have there. Again, we're consistent with what our total overall ARR growth rates are. You saw we raised the number for the second half of the year. We're extraordinarily confident about sort of what we committed to for 2019 and 2020. We're not going to do the sub-segment adjustments at this time because we're really focused on optimizing total customer economics.
Okay, that's fair. Maybe just a quick update on the attacker behavior analytics capability that you added back in April. Any impact so far that you can see in terms of customer success stories or win rates?
Absolutely. That was a very clear differentiator. For those of you that may not be aware, is that we have the benefit of having extraordinarily talented consulting and cybersecurity advisory team that does everything from forensics to penetration testing, to security program development to help organizations build their cybersecurity programs. One of the big initiatives that we've actually have is to have that team become more and more strategic over time, really adding more value to our customers. That's a big part of the reason that you see us focus less on the volume of services deals and more on the quality and the impact of the services that we're having on our customers.
We're now able to take the learnings that we have from those customer engagements in aggregate and from the talented team that we have and we're able to include that knowledge in our products that help us do the same type of analysis that we do for our customers to operationalize that in our products that help our overwhelmed customers who need some of the deep technical expertise, really do a more effective job of finding and detecting threats in their environment. That's the focus of the attacker behavior analytics. As far as customer reception, it's been quite positive. Customers have a huge amount of respect for our services team, and they're thrilled that we're taking the learnings that we get from those services engagements and prioritizing those and getting those to our broad customer base.
That's helpful. Thank you very much.
Thank you.
Thank you. Our next question comes from the line of Alex Henderson of Needham & Company. Your line is open.
Hey, guys. Dan Park on for Alex. Thanks for taking my question. I know recently you announced the integration of the Insight platform with Microsoft Azure. I was just wondering if you could just possibly expand on some of the details regarding the integration and if you're seeing additional customers coming onto the platform as a result.
Yeah. The primary focus of the integration is to provide visibility into the Azure environment and also provide essentially the same vulnerability and risk assessment. The one thing about cloud environments, whether it's Azure or AWS, configuration matters a lot more than vulnerability in those environments. It's both the visibility of what I have, because remember, most organizations don't know what they have in their environment, and then what's the vulnerability state as it's configured in the environment. That's the ongoing investment that we have in the cloud, and that's the investment that we have in Azure, as well as monitoring those environments for indicators of attack, just like we monitor all aspects of the IT environment. That's the focus there.
As far as the question about the customer demand, I'll say the earliest customer demand that we have is from our existing customers, which our customers, we have a large base of customers, it's growing, and our customers are like many customers all over the world. They have complex environments that span their both on-premise environments and their cloud environments. That's the primary driver that we have there. We have very few customers that are Azure only. We do have some that are AWS only, but not that many. Most of our customers have a combination of an on-premise footprint, and that could just be their desktop, laptop, and other things, as well as a SaaS footprint that could be things like their CRM system, their human resources system, as well as a cloud footprint that can be represented by the Microsoft Azure or AWS.
We really see most customers falling into the category of having multiple complex environments that they need to have visibility into, they need to be able to analyze both the risk and vulnerability profile, as well as analyze for the risk of exposure. We're also helping them really drive the work that it takes to remediate and correct those environments through our automation frameworks.
Okay, great. Thank you for that. Just as a follow-up, I think in the past you talked about, 1.5 solutions per customer. I think at least that was the number in first quarter of 2018. Just wondering if you had any updates on that metric and if you just talk about how much of the growth is driven by IDR versus ops versus VM.
That's a great question. The data we focus on to really show you the value of what we're doing is the ARR per customer. The whole strategy about having multiple products on a common platform is that we're driving the customer lifetime value, which is what happens when you go from that 1.5 to the roughly five-plus customers, five-plus products that we actually have per customer. The reason that we focus less on the products per customer on a quarterly basis, of course, we'll give you snapshots periodically, is because it has a numerator/denominator issue where we're both adding new customers at the same time that we're increasing the number of products per customer. There can be some noise there. The thing that really provides the economic value, though, is how are we doing at growing the ARR per customer?
That's what really creates the economic value.
Okay, great. Thank you very much.
Thank you.
Thanks. As a reminder, if you have a question, please press star and the number one key on your touch-tone telephone. Our next question comes from the line of Melissa Franchi of Morgan Stanley. Your line is open.
Great. Thanks for taking my question. Corey, or Jeff, actually, you mentioned the % of revenue that was recurring, but I'm wondering if you could give us the % that's actually coming from Insight today. Then I guess how we should think about the margin profile for Insight versus the traditional term and maintenance, particularly around gross margins.
Yes. Let me just go through those, and Jeff can provide some specifics there. We're seeing very strong growth on our core platform, especially in the new sales. The simple qualitative way to think about it is that as we add new customers, the great majority, especially in the U.S., of customers that we are adding are on our cloud-based platform. We do have sales to both the federal government and international customers outside of the U.S. that are on our on-premise platform, and that's expected and natural. The number of customers and the rate of customers on our total platform is much more positive than we could have hoped for or expected. It's not quite, but I believe it's approaching roughly the half of our overall customer base has at least one product on our Insight platform. That's great progress.
Not quite happy there, but considering the fact of where we actually launched these things in the recent timeframe, we've made a lot of progress very fast in getting customer adoption on the overall platform. The second thing, as far as the margin, I'll talk more at a strategic level, is really what we're optimizing at a strategic level is, 1, the ARR per customer, and 2, the total margin profile of the company. We have puts and takes, we have lower services mix as we indicated in our prepared remarks. The highest margin things you always have are the on-premise because the customers are running it, and then you have our cloud-based products. I think our margin outlook is aligned with what we actually previously communicated, and that's really what we're managing to, even though there's lots of puts and takes.
We're really managing to that overall margin profile that we previously outlined for you.
Yeah, Melissa. What we were going to say is we don't break out the specific product lines by revenue, but you see that the increasing amount of revenue is from our platform customers.
Right. Okay. Just one quick follow-up on professional services. You mentioned that you expect that revenue to be flat to down in FY 2018, is there a level at which it starts to normalize and you'd see growth, or do you expect it to kind of continue to underpace total revenue growth?
Well, I think it's definitely going to underpace total revenue growth, especially as you go into out years, because it's just difficult for a services business to actually keep up with the recurring revenue model in general. The second thing that I'd say around that is that we have the luxury of having expanded our product portfolio and having warm customer reception to our overall product portfolio. We have both the benefit and the luxury to really focus our services on things that add high strategic value for our customers, are a strategic asset and part of our overall business. That's the focus. Really, we've oriented both our services team and our product team to focus on the quality of the work that we're doing for customers and less on the volume that's there.
I personally am not, nor are most of our teams, focused about what's the services number on an individual yearly basis. We're really focused about, one, how do we make sure that we have enough visibility so that we can do an accurate job forecasting for you all as we go into a quarter. Really, we want to focus on what's the high-quality business that we're doing for our customers.
Great. Okay. Thank you very much.
Thank you.
Thank you. At this time, I'm showing no further questions. I'd like to turn the conference back over to Mr. Jeff Bray for the closing remarks.
Great. Thank you all for joining us today, looking forward to seeing you all over the next couple of months. Thanks.
Thank you.
Ladies and gentlemen, thank you for your participation in today's conference. This does conclude the program. You may now disconnect. Everyone, have a great day.