Earnings Call: Q2 2018

Aug 6, 2018

Good day, ladies and gentlemen, and welcome to the Second Quarter 2018 Rapid7 Earnings Conference Call. At this time, all participants are in a listen only mode. Later, we will conduct a question and answer session and instructions will follow at And as a reminder, this conference is being recorded. I would now like to introduce your host for today's conference, Mr. Jeff Bray. Sir, you may begin. Thank you, operator, and good afternoon, everyone. We appreciate you joining us to discuss Rapid7's Q2 2018 financial and operating results in addition to our financial outlook for the Q3 and full fiscal year 2018. I'm Jeff Gray, VP of Investor Relations and I'm here today with Corey Thomas, our President and CEO and Jeff Kalowski, our CFO. We distributed our Q2 2018 earnings press release over the wire and it is now posted on our website at investors. Rapid7.com. We have also posted our updated company presentation and financial metrics file on our Investor Relations website, which includes additional information to help explain the impact of shifting to 606 on our Q2 financials. This call is being webcast and can be accessed at investors. Rapid7.com. The webcast of this call will be archived and a telephone replay will be available on our website until August 13, 2018. We would like to bring the following to your attention. The date of this call is August 6, 2018. The discussion today contains forward looking statements about events and circumstances that have not yet occurred, including without limitation, statements regarding our objectives for future operations and future financial and business performance. These forward looking statements are based on our current expectations and beliefs and on information currently available to us. Statements continue the words such as anticipate, believe, continue, estimate, expect, intend, may, will and other similar statements are intended to identify such forward looking statements. Actual outcomes and results may differ materially from the expectations contained in these statements due to a number of risks and uncertainties, including those contained in the Risk Factors section of our most recent quarterly report on Form 10 Q filed with the Securities and Exchange Commission on May 9, 2018, and subsequent reports that we file with the Securities and Exchange Commission. The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward looking statements and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call except to the extent required by applicable law. On this call, we will provide and talk about our results using non GAAP financial measures and provide non GAAP guidance unless otherwise stated. For purposes of comparability, we'll be using presenting results in accordance with ASC 605 in addition to ASC 606. We believe that the use of these non GAAP financial measures provides an additional tool for investors to use in understanding company performance and trends, but note that the presentation of non GAAP financial information is not meant to be considered in isolation or as a substitute for the directly comparable financial measures prepared in accordance with GAAP. We've provided a reconciliation of the historical non GAAP financial measures to the most comparable GAAP measures and financial statement tables included in the press release issued today announcing our results. The press release announcing our financial results is available on our website at investors. Rapid7.com. The times in our prepared comments and our responses to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be one time in nature and we may or may not provide an update in the future on these metrics. With that, I'd like to turn the call over to Corey. Corey? Thank you, Jeff, and good afternoon, everyone. Thank you all for joining us today on our Q2 2018 earnings call. Rapid7 had a great second quarter with strong performance around the world and across our products. Our cloud based SecOps solutions address the fastest growing markets in security, and our shift towards recurring revenue is going much better than expected. For the Q4 in a row, ARR growth accelerated, reaching 44% growth this quarter. The financial highlights for Q2 2018 were: under ASC 605, recurring revenue grew 43% and total revenue grew 30%. And we made continued progress towards hitting our 2018 2019 profitability goals. As a result of our first half performance, along with a solid second half pipeline, we are raising our guidance for the rest of the year, highlighted by our new goal for 2018 ARR growth of over 40%. We have increased confidence in achieving the goals that we outlined at our recent Analyst Day of growing ARR over 30% and revenue over 20% through 2020. Our strong results were driven by continued strong execution across our go to market teams, a set of market leading products, our adoption of an ARR focused strategy and the recognition by enterprises of the strategic value of our cloud based SecOps products. The Q2 was our 1st full quarter offering all of our products on a subscription basis and with sales compensation based on ARR. Our go to market teams have quickly adapted to our new approach and we're beginning to realize the productivity benefits of our corporate focus on recurring revenue. Looking at our markets, enterprises are operating in increasingly complex IT environments and yet they have not focused on the core maintenance and management of their technology. Security teams understand that the key question is no longer am I vulnerable? But rather now, how vulnerable am I? And no longer am I compromised, but how and when was I compromised and how quickly can I remediate? More enterprises understand that the first step to managing these risks is to gain visibility into their environment while having strong analytics solutions to help them set their priorities for remediation. However, most security, IT and DevOps teams still find themselves operating in silos, struggling to work together. This misalignment not only results in poor security practices, but it also slows down an organization's ability to innovate. SecOps is the practice of aligning security, IT and DevOps teams through a shared set of data and tools. Shared visibility, supported by analytics and automation, creates a common language to connect disparate teams, break down barriers and ultimately accelerate innovation. The Rapid7 Insight platform unifies data collection and delivers visibility, analytics and automation needed to power a well managed SecOps program. Rapid7 SecOps solutions that are easy to install and easy to use are resonating with our customers who are increasingly viewing these solutions as strategic to their success, as evidenced by our increasing cloud based platform penetration. But just providing visibility and analytics is no longer enough. Even the most efficient security teams are still overwhelmed with manual and mundane tasks required to protect their IT and development environments. That's why we're excited for the upcoming launch of the next product on our Insight platform, which will be the evolution of Command, our security orchestration and automation solution. We acquired Command last year to add another easy to install, easy to use solution to the security team's toolbox. And so far, customer response to Command has been enthusiastic. Command is designed to enable customers to quickly create and implement workflows that can dramatically improve the efficiency of their security and IT teams. Later this year, we will launch the Insight version of Command, both as a feature of our core Insight solutions and as a standalone Insight product, which we believe will further differentiate Rapid7's set of cloud based SecOps solutions. Our new automation product will join a portfolio of cloud based SecOps solutions that have been recognized as leaders and visionaries, all providing visibility, analytics and now automation on a shared platform that help make our customers more secure and more effective. Rapid7 has 3 major growth engines on our platform. InsightVM, recognized as the future of vulnerability management by Forrester InsightIDR, a UVA powered cloud native SIEM, recognized as the visionary with the highest ability to execute by Gartner and InsightAppSec, the future of cloud based application security testing, which is rapidly expanding as a key part of our highly rated dynamic application security testing portfolio as rated by Gartner. Now let's review the Q2 by looking at our 2018 goals. Our first goal is to deliver ARR growth of at least 30%. We are focusing on ARR because it is a good indicator of how quickly our high quality recurring revenue is growing. It is a more useful metric than billings, and ARR is the primary metric we use to manage the business. This quarter, ARR growth accelerated to 44%, And we are raising our guidance for 2018 ARR growth to over 40% as our transition to a recurring revenue model is ahead of plan. ARR growth is being supported by products that address the fastest growing markets in cybersecurity, our shift from perpetual to subscription across our products and the strong performance of our go to market teams who are quickly transitioning to selling based on ARR. Early in 2018, we officially shifted all of our products to subscription pricing. And in Q2, we saw a strong shift towards SaaS and subscription bookings. Our customers have quickly embraced the simplicity and ease of subscription pricing and continue to migrate to our cloud based solutions with platform customers growing over 60% year over year and about 45% of our customers now using one of our Insight platform solutions. With our new bookings generating more recurring revenue, we saw strong growth in ARR per customer, increasing 31% year over year to over $27,000 per customer. This increase is being driven by higher quality new customer additions as well as ongoing growth in both upsells and cross sells. This has resulted in a higher mix shift of subscription bookings away from services, further increasing our confidence in our mid- and long term outlook. Our second goal is to leverage our SecOps portfolio to drive new customer growth, upselling and cross selling. We grew our customer base 10% year over year with even faster growth of our SecOps customers, but with deceleration in our services only customers. With higher ARR per new customer, we believe these relationships will drive higher lifetime value. 1 of our new customers is a large private software company where we displaced a competitor that was struggling to provide visibility into the customer's AWS environment. Rapid7 has expertise in working with major cloud providers, including AWS and Azure. InsightVM gives customers broad visibility into cloud assets as well as great accessibility with our open APIs. Our land and expand remains strong and we maintain a high renewal rate at 122%. One of the main drivers of our strong renewal rate is our customers coming back to add more coverage to their environment to improve their visibility. This quarter, we had a Fortune 500 retail customer that purchased InsightVM last year returned to add complete coverage of their environment, providing them comprehensive visibility across their entire store footprint. On the cross sell side, a leading national law firm that has been an inside VM customer was looking to add security orchestration and automation to their SecOps practice. When we demonstrated how well Command worked with InsightIDR, the CISO realized that the legacy SIEM was both expensive and difficult to use, generating more false positives than actionable information. The customers won over by InsightIDR's prebuilt dashboards and simple visual search, while commands out of the box workflows and code free automation greatly simplified their detection and response effort. Visibility into application security continues to be a critical need for enterprises and we had another strong quarter across our application security portfolio. A global consulting firm joined us as a new customer, adding InsightAppSec to cover 100 of their internal applications with an opportunity to expand to cover 100 more. Application security has also provided a huge expansion opportunity. As in Q2, a Fortune 100 software company again expanded their AppSpyder coverage and a Global 500 European Bank customer added AppSlider to provide visibility into hundreds of their global web applications. This cross sell deal was also a good example of our solid growth international, a long term opportunity that is still in the early innings. To take further advantage of this opportunity, we recently expanded our Insight platform instances to Canada and Australia, providing customers in those regions the ability to better address data governance requirements and the flexibility to keep security data local. Finally, our 3rd goal to improve profitability. And during the Q2, we improved our operating loss both sequentially and year over year. We continue to expect to generate cash from operations in 2018 and are making progress towards our goal of profitability in 2019. With the success of our subscription transition, we will enter 2019 with more recurring revenue than we originally forecasted, which will help improve the scale of our business and our ability to hit our 2019 targets. With that, I would like to hand the call over to our CFO, Jeff Kalowski. Jeff? Thanks, Corey. Before I begin discussing our strong results for the Q2 2018, I want to remind everyone that as of January 1, we've adopted ASC 606 on a modified retrospective basis, and therefore, we'll report each quarter's results under both ASC 606 and ASC 605. We've included all of these details in our earnings press release today. When discussing our year over year growth rates and other key trends in our business, we will be comparing our results on an ASC 605 basis as we don't have prior year operating results under 606 and a comparison would not be meaningful. We are pleased with our strong performance in the Q2, which beat our guidance on all key metrics and was highlighted by accelerating ARR growth of 44%. First, I will briefly discuss our results on an ASC six zero five basis. Total revenue for the Q2 of 2018 was $61,600,000 an increase of 30% and ahead of our guidance. Recurring revenue was 77 percent of total revenue in the Q2 of 2018, up from 70% in 2017, and which is growth of 43%. Looking at the business geographically, in Q2, North America comprised 84% of revenues, growing 29%. Rest of world revenue increased 33% year over year and contributed 16% of total revenue in the 2nd quarter. Our rest of world revenue growth continues to be impacted due to a large services deal recognized in Q2 2017, but our ARR growth from outside of North America continues to be very strong. On an ASC six zero five basis, non GAAP operating loss was $5,700,000 also meaningfully better than our guidance of a loss of $8,700,000 to $7,800,000 and adjusted EBITDA loss was $3,900,000 for the 2nd quarter compared to a loss of $5,000,000 in the prior year period. Our operating margin improved to a loss of 9% from a loss of 13% in the prior year. Now, I'll discuss results on an ASC 606 basis. Total revenue was $58,400,000 above the high end of our guidance with the primary difference between 606 and 605 being lower perpetual revenue due to ASC 606 accounting. Our product revenue was once again driven by strong bookings globally in both VM and IDR with accelerating recurring revenue growth. As we expected, with the shift towards ARR quotas for our sales force, we did see a slowing in professional services bookings and revenues. We expect professional services revenues will be flat to down compared to 2017. Visibility into our revenue forecast remains very high. Recurring revenue was 79% of total revenue under ASC 606 and 83% of total revenue came from deferred revenue on the balance sheet at the beginning of the quarter. The value of our annualized recurring revenue increased to $198,600,000 at the end of the second quarter, a 44% increase year over year and an acceleration from 38% growth in Q1, evidence of the strength of our products and the success we're having with our shift to subscription. We now expect ARR growth for the year to be over 40%. Calculated billings for the Q2 were 64,000,000 dollars Average contract lengths were 17 months for total billings, down significantly from 23 months in the prior year period and down slightly from 18 months in Q1. As we said since we launched InsightVM and given the move of our full portfolio for perpetual to subscription, we have expected our customers to shift towards 1 year contracts and we saw that in Q2. This reinforces our belief that billings are no longer a meaningful comparison to prior periods during this transition, as they don't capture the benefit of a higher subscription mix and growth of our annual recurring revenue. While contract lengths will be difficult to forecast during this transition period, we believe it's possible they could shorten further from Q2 levels and our operating cash flow could be affected. However, we're still forecasting cash from operations to be positive for 2018. Our customer count increased by 10% year over year and we ended Q2 with more than 7,200 customers globally. As Corey mentioned, we continue to see an improvement in the quality of our customer base and our ARR per customer increased to over 27,000 or growth of 31%. Overall, we continue to see strong bookings from new customers, upsells and cross sells. Our renewal rate was 122% and our expiring revenue renewal rate was 89 9% in the Q2. Turning back to the P and L, non GAAP total gross margin for Q2 2018 was 73%, up slightly from Q1. Product non GAAP gross margin was 78%, down slightly from Q1 and professional services non GAAP gross margins improved to 38%. During the 2nd quarter, professional services margins benefited from slightly higher utilization compared to Q1. We continue to expect professional service gross margins in the mid-30s for the full year 2018 and for our total gross margin to stay in the low to mid-70s on both an ASC 605 and ASC 606 basis. For operating expenses, please note that the only difference between 605 and 606 was in the sales and marketing expense, which was $2,800,000 lower in 606 due to the impact of deferring sales commissions, which was in line with our guidance. During the Q2, sales and marketing decreased to just under 50% of revenues. We realized about 150 basis points of leverage in sales and marketing year over year with the additional improvement due to the accounting changes affecting revenue and commissions under 606. Given the success of our shift to subscription, we'll continue to make investments into the second half of the year to help drive ARR growth, but we still expect to see leverage from sales and marketing expense for the full year of 2018. Moving to 2nd quarter operating loss. Non GAAP operating loss was $6,000,000 which was well ahead of our guidance of a loss of $9,800,000 to $8,400,000 and our operating margin improved to negative 10%. Adjusted EBITDA loss for the 2nd quarter was 4,200,000 dollars Non GAAP net loss per share was $0.13 in Q2 2018, ahead of our guidance. We ended Q2 with cash, cash equivalents and investments of $118,600,000 This compares to $92,000,000 as of December 31, 2017. Our operating cash flow for Q2 was negative $9,100,000 Year to date, cash flow used in operating activities was negative $1,800,000 and as we mentioned earlier, we expect to remain cash positive from operations for 2018. However, we could potentially be down from 2017 due to lower contract lengths. Moving to our Q3 and full year guidance. As for ARR, given the strong momentum we have built in the first half 2018 and our strong performance on new bookings and churn in Q2, we're raising our guidance for the full year ARR growth to exceed 40%. For Q3 2018, on an ASC 606 basis, we anticipate total revenue to be in the range of $58,600,000 to $60,000,000 We anticipate non GAAP operating loss to be in the range of $7,300,000 to 5,900,000 dollars On an ASC 605 basis, we anticipate total revenue to be in the range of $61,700,000 to $63,100,000 which equates to year over year growth of 22% to 25%. We anticipate non GAAP operating loss to be in the range of $6,600,000 to $5,200,000 For the full year 2018, we are raising our total revenue guidance. On an ASC 606 basis, we're raising our guidance for total revenue to be in the range of $237,000,000 to 240,000,000 dollars We are updating our guidance for non GAAP operating loss to be in the range of $25,000,000,000 to $22,000,000 dollars On an ASC 605 basis, we're raising total revenue to be in the range of $250,000,000 to 2 $3,000,000 which equates to year over year growth of 24% to 26%. We are updating our guidance for non GAAP operating loss to be in the range of $24,500,000 to $21,500,000 As Corey said, with our increased momentum through 2018, we are in a great position to meet our goal to generate non GAAP operating profit in 2019, and our goal is to grow revenues by over 20% and ARR by over 30% through 2020. Our full year guidance reflects our increased investment into our sales organization, but we expect to realize leverage from sales expense for the full year 2018. In conclusion, this was a very strong quarter for Rapid7, driven by the strong momentum in our shift to the cloud and subscription, leading to our raised ARR growth outlook. With that, we appreciate your time and support and we'll open the call for any questions. Operator? And our first question comes from the line of Rob Owens of Key I wanted to just touch on how you've expanded the portfolio and you've mentioned a couple of quarters with all products on a subscription basis. Help me understand what that's doing to your competitive position and where you're seeing strong new customer acquisition. I'm guessing on the VM side that's not greenfield. So who and what and where are you displacing your competition at this point? And is it the single VM sale or is it more kind of buying into the entire portfolio? Yes. So it's early days for the overall consolidation, but we are seeing early indicators and evidence around it. And so lots of what I would call our non competitive deals are deals where customers have a great experience on our platform, which is very quickly getting adoption. And I think we shared some of the numbers earlier. But we see our platform very quickly getting adoption and when customers have a great experience, when they have other needs, they're quite willing to actually explore the other capabilities that we have on the platform. And while it's early days, we're seeing more than enough evidence that that is a strong value proposition, especially for existing customers. As for the new customer adds and additions, I would say that it's pretty evenly distributed. You see really 2 big areas where we add new customers. One is the VM space and I'll come back to that in a second. And the other area is in the IDR space or the STEM space with Incyte. Both of those are core contributors, which we've said before. It was a pleasant surprise for us that we could actually expand into a new market and have customers that and have prospects that weren't customers adopting our technologies in those spaces. And that's really a testament, not just the platform, but to the technology strategy that we've taken on by actually having best of breed technology solutions on a common platform. And I'd emphasize that again. I think what's unique is that many times when people try to have a consolidated platform. It's one good solution and a bunch of mediocre solutions. We took quite a different approach is that we actually are consolidating on a common platform that has platform value, but we are designing and have designed all of our solutions to be best of breed quality. And I think that gives us a unique advantage there. Specifically to your question about the vulnerability management market, we still see greenfield opportunity in the mid market, which continues to actually do an effective job of adding net new customers there. We do see displacements though in customers that are looking to upgrade their programs. And that displacement is true both in legacy markets, where you actually have traditional VM players that are no longer as active in the market. And we see that with some of our mainline competitors, where we see customers looking to upgrade their programs and they really value the investments that we place not just on prioritization, but the investments they've seen in workflows and integration into the existing infrastructure with our SecOps Vision. So those are the dynamics that we see. And just to add more commentary around the growth that we saw from ARR last quarter, overall, our products grew quite strongly, but what we saw was that we had extraordinarily healthy growth across all of our product categories. Great. And then for a completely unrelated follow-up, relative to the mix shift that's occurring more rapidly than you might have assumed initially, is that a function of how you're incentivizing your sales force? Is that just where customers want to buy? Anything to do with the channel on that front? And how does that impact kind of the 2019 targets? Thanks. Yes. So one very clear focus is we shifted, we talked about this before, is we learned from others. One of the benefits of the Shift subscription when we made it is that we had the opportunity to learn from others. But we did shift our sales compensation model to be based off ARR. This year was a relatively big change. And I would say there's 2 factors. 1 is our sales team has done a great job of adopting and moving to ARR. The second thing that's important though is that we have strong customer reception. These things are always harder if you're actually pushing stuff on the customers. And in this case, we actually have a positive customer reception, which has made the transition much smoother than we could have anticipated. Thank you. Our next question comes from the line of Saket Kalia of Barclays Capital. Your line is open. Hey, guys. It's Zack Kalia here for Barclays. Thanks for taking my questions here. I'm happy to. Thanks. Hey. So first, maybe for you, Jeff Kalowski, nice acceleration in the ARR. I think that Corey kind of talked about what worked from a product perspective. It sounded very much across the board. But maybe from your perspective, if you think about sort of the benefit or the growth in that metric coming from existing customers shifting to SaaS versus kind of the new customers that are adopting SaaS to begin with, how do you think about that dynamic even qualitatively and how it's helping the ARR number? Yes. So Saket, first off, as Corey said, we had strong ARR growth across all the product lines. And in particularly we had strong upsells and cross sells. But if you recall existing customers that were formally NEXPOs and then shifted to our SaaS offering, we did not raise the price on their renewal other than a nominal inflationary increase because what we didn't want to do was penalize those customers for shifting to the platform. The motive was shifting to the platform will drive more cross sell and more up sell. And at our Analyst Day, we showed the examples of where we were on our perpetual product and that the ARR was in that sort of 40% to 50% range on the ARR piece, that's the annuity going forward. So the existing customers really did not drive the ARR growth. When they convert, they convert at basically their current renewal rate plus an inflationary increase. Got it. That's super helpful. Maybe for my follow-up for you, Corey. You touched on it a little bit in the prepared remarks around geographic expansion. I think you noted Canada and Australia. Maybe just more strategically, can you talk about how big you think Maybe just more strategically, can you talk about how big you think the international business can be for Rapid7 down the road and whether we're seeing some of the same strategic focus on VM as a spend category internationally as maybe we are seeing here in the U. S? It's a great question. So if you look at where we are and we have been for a little bit, we're in the 15%, 16% -ish range of the international as a percentage of our total business. And we think that has great room to actually grow up over time. I'd say one of the things to keep in mind that has been balancing the scales a little bit and sort of make that growth rate a little bit slower is that we've introduced a lot of new products, both our platform and products on our platform over the last 2 years. And one way to think about it is that traditionally when you introduce new things, you actually introduce it to a single market first and then you expand from there. And so that's put a little bit of the weight and the bias to the U. S. For the introduction and then you actually add both territories and localization as you go forward. So we think we have plenty of growth and it's following the natural evolution and that's why you're starting to see the expansion of both new regions around the world that actually have our platform. It has gotten trickier because of the geopolitical issues where you do need to have instances around the world and we've done an effective job of continuing to add instances around the world, but then also local teams and local support. So we're very, very optimistic that our international and global business will continue to grow in excess of our overall business and that it would actually get to more normative rate as a percentage of total revenue as you go forward. As far as your question about demand, I would say demand is picking up substantially outside of the U. S, specifically in Europe and in pockets of Asia. We see good health in places like Australia. However, I would say that it still lags the U. S. In terms of the intensity of the spend and the intensity of the focus, which is why we actually see that as a good growth opportunity. It's an area where you already have market traction, you have market awareness, the regulatory environment is increasing over there and we're seeing increasing both traction and growth and opportunity pipeline. So I'll say the dynamics are healthy, but it's not quite to the U. S. Level, both in VM and I'll say broadly in the overall security market. Very helpful. Thanks guys. Thank you. Thank you. Our next question is from the line of Gar Palataz of Stifel. Your line is open. Awesome. Thanks for taking my question. Congrats on the quarter and apologies if there's some background noise here at the airport. Corey, if you think about hitting the ARR target for the year, what assumptions are you making that get you comfortable there with the big bump in the forecast here? Because if I look at the numbers, you're effectively calling for about $30,000,000 plus of net expansion from current levels. It's a pretty big bump from here on out, but you guys sound very, very confident. So can you give us some granularity to what you're kind of assuming within that assumption or within that forecast? Yes, you can imagine that we actually put a great deal of scrutiny whenever we look at any of these things, especially when we raise targets. I would say we were comfortable with it for 2 reasons. 1, the easiest thing to look at is there's really 3 things to go into it. 1 is what does your past performance indicate? The second thing is what's your pipeline indicate? Because that gives you good visibility into what you see both in the Q3 but also a pipeline for the Q4 and you look at trends there. And then I'll say one of the most important things that we're really obsessed about as a company is the productivity of our sales reps and our teams. And so how are we doing both retaining and managing sales team? We continue to have better than expected retention of our sales team, lower attrition of the sales team. We continue to be conservative in our assumptions there. And we're also seeing healthy and strong productivity from that team. And you can imagine that the lower attrition of the sales team is really a testament to the fact that they are not just enjoying the culture and the experience of Rapid7, but they're also effectively able to engage customers and to sell the platform and the suite of products that we have on our subscription basis. And that all contributes to what drives that 40% forecast. Again, past performance, opportunity pipeline and the productivity of our core sales team is the things that we look at when we look at how we both forecast our business as we go forward. That's really helpful. Maybe just kind of going a little bit more high level here. If you look across the VM world, it kind of feels like a pretty good place to be in security these days. Do you kind of see this as a function of the breach environment, meaning more ransomware type breaches working in your favor? Or do you think we're seeing kind of a broader change in mentality as customers ultimately value these solutions kind of more than they did perhaps even a few quarters or years ago? Yeah, I would say that one of the reasons that we've always said that when you think about security operations and SecOps, VM is a great core to have is because it is at least half of the overall visibility story that you actually need. One half being the assets and one asset to what the risk and exposure and vulnerability to those assets, the other half being the data that talks about what the activity in the environment and what's happening in the environment. VM has half of the visibility that you actually need to actually run an effective security operation. And so as people and organizations get more focused on how they effectively run their security operations, they become more and more obsessed with visibility. And that's why you see the spend not just in VM, but also in logging, SIEM and other technologies that provide visibility. And I would say the whole visibility sector in general is doing quite well these days. That's helpful. Thanks a lot. Congrats again. Thank you. Thank you. Our next question comes from the line of Matt Hedberg of RBC. Your line is open. Hey guys, thanks for taking my questions. Well done. Corey, ARR per customer was impressive. It looks like you're only in the first few innings there. I think you've said that I think your average customer takes about 1.5 solutions. And I believe you've said you think you can increase the ARR per customer 7 times from here. I guess, first of all, is that 7 times assumption based on currently available products? And second, we hear a lot about IDR and VM, but how is InsightOps contributing to that upsell? Yes, it's a great question. So if you recall at our Analyst Day, we really had 3 categories that we talked about. 1 is the overall vulnerability and risk management category, which include the Insights VM and the Insight AppSec and their legacy on premise component, Insight IDR for the SIEM category. And then we talked about the security, the core operations in analytics space that included both the Command and the follow-up to Command, the cloud based follow-up to Command as well as InsightOps. I would say that for our 7X, it includes InsightOps, although we're seeing such material traction on the VM, IDR and AppSec bot, that's consuming most of our bandwidth right now. One of the things that you'll see over the coming year is a greater focus and greater resource allocation on both the inside ops and on the Command side and the platform version of Command. And Command is not built into the model of the multiple that we actually have that we talked about at the Analyst Day. So we see a really strong multiple of ARR available to us and we see upside to that as we continue to actually invest and launch new things as we go forward. That's great. And then maybe as a follow-up, you guys have talked about your integration with VM and IDR with Azure. Can you talk a little bit more about what that partnership means? Is there any sort of feedback, beta customer feedback that you could share with us on that particular relationship? Yes. And can you I'm sorry, Matt, can you just repeat the question one more time? Yes, integrating InsightVM and IDR with Azure, I believe you guys talked about that during the quarter as sort of a new announcement. Just kind of curious on some feedback on that particular integration. Absolutely. It goes back to the discussion we're having around visibility is that one of the drivers of visibility is that people's teams and resources are constrained and you can't manage what you can't see. And as IT organizations increasingly adopt more AWS and more Azure, they need the visibility to understand what assets do they have in those environment, what's the vulnerability and risk profile of those environments and what are the activities and is it indicators of normal behavior or is it an indicator of compromise. One of the investments that we continue to make is how do we actually have best in class visibility both in AWS and in Azure. And both of those are critical environments for us to be able to both assess the asset footprint that organizations have, look at the risk profile and look at the activity in those environments for indicators of compromise. Got it. Thanks guys. Thank you very much. Thank you. Our next question comes from the line of Gregg Moskowitz of Cowen and Company. This is Mike on for Greg. To start off, this is your first full quarter under what essentially is now a subscription only model. How has the customer response to the pricing changes been if you look across the U. S, Europe and Asia Pacific? Again, it's been much more positive than we anticipated. We're practical about these things. We know that any type of change can have friction. And I would say that we've had a lower share of friction than we expected as we've done the change. I mean, I think one of the key things to understand about us and our approach is we really focus on sustainability. And the core of that is doing things that are going to benefit the customer. And so if you look, we're not about how do we maximize the dollar in the current quarter or near term, we're about how do you have a great customer relationship, deliver great value to the customer and then maximize the overall lifetime value of the relationship that you have with the customer. And so that led us, as Jeff indicated in his comments earlier, to take an approach that was very obsessed about how do we minimize customer friction, not just Rapid7 friction. And in fact, that's one of the continuing areas of our focus as a business is reducing more and more barriers for our customers and minimizing the overall customer friction. And I think part of the warm reception that we've had to our subscription transition has been customers have recognized that that is the intent and worked with us. Got you. Thanks. And as for my follow-up, what are you seeing or refresh activity? Thanks. We continue to see a robust environment. There's really 2 things I'll talk about there. It's clear that organizations are focused on how do they actually shift from just having a SIEM that's purely compliance focused to how do they do great detection. And that's a shift that benefits us because we have been focused about how do you do great detection and we continue to add in compliance oriented capabilities, but detection is the core of what we do. The second thing that's clear is that customers value that we have an economic model that's aligned with the customer. Again, you can't just like you can't manage what you can't see, you can't detect where you don't have visibility. And our model that makes it easy for customers to have visibility across their entire platform because our detection is based on an IP model, not a purely storage model where customers have unpredictable pricing, that's been very, very well received by the market because it allows them to have the confidence that they have the visibility to do the detection that they want, but in a model that fits with their overall goals and objectives. Thank you. Our next question comes from the line of Jonathan Ho with William Blair. Your line is open. Good afternoon and congrats on the strong results. I just wanted to start out with KOMMAND. Can you talk a little bit about your expectations around the release? And maybe what are our customers sort of looking for just given the demand for increasing automation? Yes, absolutely. And we've seen the great thing is that the automation orchestration market or the SOAR market is Gartner calls it for security. It is an early stage market in this incarnation, but it's replacing lots of the manual workflows and lots of the previous technologies that looked at IT and security processes, that are there. And the core demand for it is that there's just not enough people capacity to do all the work that needs to be done. And by the way, lots of the work is repetitive in orientation and so our customer sales, it can be quite mundane. So customers have this issue where they're spending a great deal of their bandwidth on things that are mundane and competitive, but yet they don't have the capacity to truly catch up and make a difference. That's why you see such a heavy customer focus on orchestration and automation. Our focus on the orchestration and automation market is to actually make it a mainstream solution where not just a narrow set of customers, but tens of thousands of customers can receive the benefit of a powerful, but yet simple orchestration and automation solution that allows them to really give a multiplicative effect on their overall technology and security workforce. And that's what we've been building up and that's what we've been extending. It does all types of workflows, whether you're looking at about the automating parts of detection, automating parts of remediation, automating parts of containment, automating part of the IT management process related to security. There's lots of prebuilt both integrations and workflows that come along today and will come along with our solutions in the future. But our goal really is to drive the productivity of our IT and security teams. And as for the timing, as I said in my prepared remarks, you'll hear more about that in the second half of this year. We have a big focus on that. Great. And then just as a follow-up, when we think about sort of the platform adoption that's happening, how often are you seeing customers maybe buy multiple elements to start out with? Is that increasing or about the same? And sort of the willingness to add on to the platform over time? Just wanted to get some maybe qualitative detail on what you're seeing there. Yes, interesting because you saw that our total renewal rate, which includes cross sell and upsells, went up slightly to 122%. What's interesting is we're seeing an overall increase in the ARR per customer transaction that we had in the quarter. And that's driven by a couple of things. Customers are wanting more visibility when they start off than they historically have, which is a short and nearly positive thing. But it's also customers are starting to look at multiple solutions together and purchasing multiple solutions together. So it's definitely going up. It's going up in noticeable ways. It's just that we have a big customer base that you're looking at there. And so you continue to see ongoing improvement in that. But we've got more than enough positive feedback from customers that our consolidation platform that's based on best of breed technology is clearly a value. Thank you. Thank you. Thank you. Our next question comes from the line of Michael Truetz of Raymond James. Your line is open. Hey guys, good evening. Very strong quarter. Question on the guide. It's a raise for the year and a raise for the next quarter, but less so, it's pretty much where it was on EBIT, EPS, etcetera. So you'll be getting operating leverage year over year, but not so much really out of the incremental raise here. So where is that incremental spend? And it seems like some of it's certainly coming year over year in sales and marketing? Yes, Michael, great question and you're absolutely right. It really comes in 2 areas. 1 is we got more customer visibility. We realized that we had the capacity to do growth and strong growth that was accretive to our long term economics, meaning that we're making investments this year that will grow the customer base. But because we understand the productivity and what it costs to get a customer and the value that customers provide over a longer term time arising, we're really investing in both growth and long term and mid term profitability together. Again, we have pretty clear line of sight into the overall customer economics. The second thing that I would say, which is could be a good portion of what we're looking at there is we are having an increased investment in systems. And the reason for that is we have a very, very positive shift to the overall subscription and cloud based subscription model. And we're really looking forward to think about how do we actually optimize the customer experience next year, but also how do we make sure that we continue to have strong renewal rates, but at the right cost leverage as we go forward, combined with the overall customer experience. So we are investing in our overall systems that allow us to scale because we have the higher confidence in our overall growth profile as we go forward. Yes, Michael, you're right in that we did we are investing the revenue upside. But I just want to point out that last quarter we were 33% plus ARR and we've raised that number to 40% plus. So those investments will help drive a higher exiting ARR growth than what we were seeing in the previous quarter based on strong demand in pipeline. Great. And if I get a follow-up, there's been some obviously discussion discussing IDR and the SIEM market. Can you talk about the SIEM market from a competitive perspective? Are you seeing all the major SIEM vendors? Are you seeing primarily those who are cloud based like yourself? How is it shaking out from a segmentation perspective? Yes. So I would say from what we see in new deals, meaning that they're not sort of like Rapid7 customers that are just looking to add on some capabilities to the platform, it is across all vendors. And part of the thing to keep in mind is that we are really the only cloud based vendor of scale that is focused on security, with a security analytics and SIEM offering. And so the people that we see there is that Splunk is course there and they have a strong position there, but their cloud solution isn't their default solution and their sales force really isn't optimized around that. We definitely see some legacy ArcSight and some legacy IBM there, but it's not as strong as it once was. So that's a good thing for us. And then there's a bunch of other smaller players in the market that we see occasion. Great. Jeff, Corey, thank you. Thank you. Thank you. Thank you. Our next question is from the line of Ann Messner of Susquehanna Financial. Your line is open. Hi, thanks for taking my question and congrats on the strong quarter by the way. Thank you. So Cory, Corey, you had previously said that your target of growing ARR 30% through 2020 assumed underlying VM growth of 15 percent and that's a deceleration from what you've previously seen. Also, it would represent slower growth than what it looks like the broader VM market is saying. So would you care to maybe update that assumption now that it looks like your overall ARR number is coming in much stronger than you would have anticipated? Well, Ann, I did say 15% plus. Okay. Fair. That's fair. It's clear that we're seeing very strong dynamics in the overall via market, and we think they are sustainable. The thing that I would say and the tricky thing about the cost segmentation there is that what we're primarily focused on is both total ARR growth and how do we maximize both the value that we provide to our customers and the customer economics. It's really immaterial to me about which bucket it falls in. So if you look at both lots of our go to market strategy and lots of our pricing analysis, it starts with 1, how do we maximize customer value? 2, how do we maximize customer adoption and penetration? And then from that, that really drives how we actually think about our pricing strategy and our pricing strategy really then drives which buckets things go into. I just want to reiterate that because the VM market is incredibly, incredibly healthy. You have sort of like the 3 major players that all have growth of over 20%. And that's really an outcome of the visibility driven customer demand. As far as what we manage to though, we are managing to how do we maximize both the total ARR and the ARR per customer. And because we have a more fully flushed portfolio, we are optimizing around our portfolio pricing in our portfolio, go to market on our cloud based platform. And so that is the primary driver that we have there. And so again, we're consistent with what our total overall ARR growth rates are. You saw we raised the number for the second half of the year. We're extraordinarily confident about sort of what we committed to for 2019 2020. But we're not going to do the sub segment adjustments at this time because we're really focused on optimizing total customer economics. Okay, that's fair. And then maybe just a quick update on the attacker behavior analytics capability that you added back in April. Any impact so far that you can see in terms of customer success stories or win rates? Absolutely. That was a very, very clear differentiator. For those of you that may not be aware is that we have the benefit of having extraordinarily talented consulting and cybersecurity advisory team that does everything from forensics to penetration testing, to security program development to help organizations build their cybersecurity programs. 1 of the big initiatives that we've actually have is to have that team become more and more strategic over time, really adding more value to our customers. And that's a big part of the reason that you see us focus less on the volume of services deals and more on the quality and the impact of the services that we're having on our customers. We're now able to take the learnings that we have from those customer engagements in aggregate and from the talented team that we have, and we're able to include that knowledge in our products that help us do the same type of analysis that we do for our customers to operationalize that in our products that helped our overwhelmed customers who need some of the deep technical expertise really do a more effective job of finding and detecting threats in their environment. And that's the focus of the attacker behavior analytics. And as far as customer reception, it's been quite positive. Customers have a huge amount of respect for our services team and they are thrilled that we're taking the learnings that we get from those services engagements and productizing those and getting those to our broad customer base. That's helpful. Thank you very much. Thank you. Thank you. And our next question comes from the line of Alex Henderson of Needham and Company. Your line is open. Hey guys, Dan Park on for Alex. Thanks for taking my question. So I know recently you announced the integration of the Insight platform with Microsoft Azure. I was wondering if you could just possibly expand on some of the details regarding integration and if you're seeing additional customers coming onto the platform as a result? Yes. So the primary focus of the integration is to provide visibility into the Azure environment and also provide essentially the same vulnerability and risk assessment. The one thing about cloud environments, whether it's Azure or AWS, configuration matters a lot more than vulnerability in those environments. So I suppose the visibility of what I have, because remember most organizations don't know what they have in their environment. And then what's the vulnerability state as it's configured in the environment. And that's the ongoing investment that we have in the cloud and that's the investment that we have in Azure as well as monitoring those environments for indicators of attack just like we monitor all aspects of the IT environment. So that's the focus there. As far as the question about the customer demand, I'd say the earliest customer demand that we have is from our existing customers, which our customers, we have a large base of customers, it's growing and our customers are like many customers all over the world, they have complex environments that span their both on premise environments and their cloud environments. And so that's the primary driver that we have there. We have very few customers that are Azure only. We do have some that are AWS only, but not that many. Most of our customers have a combination of an on premise footprint and that can just be their desktop, laptop and other things, as well as a SaaS footprint that could be things like their CRM system, their human resources systems, as well as a cloud footprint that can be represented by the Microsoft Azure or AWS. And so we really see most customers falling into the category of having multiple complex environments that they need to have visibility into, they need to be able to analyze both the risk and vulnerability profile as well as analyze for the risk of exposure. And then we're also helping them really drive the work that it takes to remediate and correct those environments through our automation frameworks. Okay, great. Thank you for that. And just as a follow-up, I think in the past you sort of talked about 1.5 solutions per customer. I think at least that was a number in the Q1 of 2018. Just wondering if you had any updates on that metric. And if you just talk about how much of the growth is driven by IDR versus ops versus VM? That's a great question. The data we focus on to really show you the value of what we're doing is the ARR per customer, because the whole strategy about having multiple products on a common platform is that we're driving the customer lifetime value, which is what happens when you go from that 1.5 to the roughly 5 plus customers, 5 plus products that we actually have per customer. The reason that we focus less on the products per customer on a quarterly basis, of course, we'll give you snapshots periodically, is because it has a numerator denominator issue where we're both adding new customers at the same time that we're increasing the number of products per customer. So there can be some noise there. The thing that really provides the economic value though is how are we doing at going to ARR per customer. And that's what really creates the economic value. And our next question comes from the line of Melissa Franchi of Morgan Stanley. Your line is open. Great. Thanks for taking my question. Corey or Jeff actually, you mentioned the percent of revenue that was recurring, but I'm wondering if you could give us the percent that's actually coming from Insights today. And then I guess how we should think about the margin profile for Insights versus sort of the traditional term and maintenance, particularly around gross margins? Yes. Let me just sort of go through those, and Jeff can provide some specifics there. We're seeing very strong growth on our core platform, especially in the new sales. So the simple qualitative way to think about it is that as we add new customers, the great majority, especially in the U. S. Customers that we are adding on our cloud based platform. We do have sales to both the federal government and international customers outside of the U. S. That are on our sort of on premise platform and that's expected and natural. But the number of customers and the rate of customers on our total platform is much more positive than we could have hoped for or expected. It's not quite, but I believe it's approaching roughly the half of our overall customer base, has at least one product on our Insight platform. And so that's great progress, not quite happy there. But from where we considering the fact of where we actually launched these things in the recent timeframe, we've made a lot of progress very, very fast in getting customer adoption on the overall platform. The second thing as far as the margin, I'll talk more at a strategic level. It's really what we're optimizing at a strategic level is 1, the ARR per customer and 2, the total margin profile of the company because we have puts and takes, we have lower services mix as we indicated in our prepared remarks. The highest margin things you always have are the on premise because the customers are running it and then you have our cloud based products. I think our margin outlook is aligned with what we actually previously communicated. And that's really what we're managing too, even though there's lots of puts and takes. We're really managing to that overall margin profile that we previously outlined for you. You. Okay. What we're going to say is we don't break out the specific product lines by revenue, but you see that the increasing amount of revenue is from our platform customers. Right. Okay. And then just one quick follow-up on professional services. So you mentioned that you expect that revenue to be flat to down in FY 'eighteen. But is there a level at which it starts to normalize and you'd see growth? Or do you expect it to kind of continue to underpace total revenue growth? Well, I think so it's definitely going to underpace total revenue growth, especially as you go into out years because it's just difficult for a services business to actually keep up with the recurring revenue model in general. The second thing that I'd say around that is that we're really not I mean, we have the luxury of having expanded our product portfolio and having warm customer reception to our overall product portfolio. And so we have both the benefit and the luxury to really focus our services on things that high strategic value for our customers, are a strategic asset and part of our overall business, and that's the focus. So really, we've oriented both our services team and our product team to focus on the quality of the work that we're doing for customers and less on the volume that's there. So I personally am not nor most of our teams focused about what's the services number on an individual yearly basis. We're really focused about, 1, how do we make sure that we have enough visibility so that we can do an accurate job forecasting for you all as we go into a quarter. But really, we want to focus on what's the high quality business that we're doing for our customers. Great. Okay. Thank you very much. Thank you. Thank you. And at this time, I'm showing no further questions. I'd like to turn the conference back over to Mr. Jeff Bray for the closing remarks. Great. Thank you all for joining us today, and looking forward to seeing you all over the next couple of months. Thanks.