Good day, and thank you for standing by. Welcome to the first quarter 2022 Rapid7 earnings conference call. At this time, all participants are in listen-only mode. After the speaker's presentation, there'll be a question-and-answer session. During this session, if you would like to ask a question, press star one on your telephone. Please be advised that today's conference is being recorded. I would now like to hand the conference over to your speaker today, Sunil Shah, Vice President of Investor Relations. Please go ahead.
Thank you, operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's first quarter 2022 financial and operating results, in addition to our financial outlook for the second quarter and full fiscal year 2022. With me on the call today are Corey Thomas, our CEO, and Tim Adams, our CFO. We have distributed our earnings press release over the wire, and it's now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast, and following the call an audio replay will be available at investors.rapid7.com until May 11, 2022. During this call, we may make statements related to our business that are forward-looking under federal securities laws.
These statements are made pursuant to the Safe Harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to the company's positioning, our future goals and financial guidance for the second quarter and full year 2022, and the assumptions underlying such goals and guidance. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the expectations contained in these statements due to a number of risks and uncertainties, including those contained in our most recent annual report on Form 10-K filed on February 24, 2022, and in the subsequent reports we file with the SEC. The information provided on this conference call should be considered in light of such risks.
Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by applicable law. Our commentary today will primarily be in non-GAAP terms and reconciliations between our historical GAAP and non-GAAP results and guidance can be found in today's earnings press release and on our website at investors.rapid7.com. At times, in our prepared comments or in response to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results.
Please be advised that this additional detail may be one time in nature, and we may or may not provide an update in the future on these metrics. With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey?
Thank you, Sunil, and hello to everyone on the call today. Thank you for joining us for our first quarter 2022 earnings call. Rapid7 kicked off the year with another strong quarter of results as we sustained year-over-year ARR growth of 38%, ending the period with $627 million in ARR while delivering positive free cash flow to start the year. This ongoing momentum in our business was driven by strength across both our security transformation and vulnerability management solutions. Our Insight Platform is resonating with customers as we invest to deliver an integrated experience that enables better security outcomes in today's elevated threat environment. We saw strong upsell and cross-sell engagement within our base as customers expanded usage, driving accelerated growth in ARR per customer, which eclipsed $60,000 in the quarter.
The steady growth in this key metric validates the continued strength and leverage from our customer expansion engine as we remain obsessed in helping customers drive productivity and scale in an increasingly tight talent environment. We see a long runway for sustained customer expansion across our best in suite Insight Platform, supporting line of sight to $80,000 in ARR per customer over the midterm. Another huge recent milestone for Rapid7 was the announcement of our 2022 Social Good Report, which we published in early April. It marks the first comprehensive look at our values-focused mindset around ESG and our investments aimed at creating a secure and resilient future where everyone is empowered to enact positive change.
It highlights Rapid7's focus on going beyond the foundational work of traditional diversity, equity, and inclusion requirements and ESG frameworks to work towards realizing our vision of a secure and prosperous digital future for all. Publishing our first collective annual report on these topics opens the next chapter in building trust, transparency, and dialogue with all our stakeholders. Before I share additional comments on our business, I want to briefly address our response to the situation in Ukraine and associated threat dynamics. Alongside many other businesses and consistent with our values as an organization, we took actions in the first quarter of suspending new business and renewals with organizations primarily located in Russia or Belarus. At the same time, we continue to provide ongoing support to our customers located in Ukraine for the uninterrupted service.
The conflict in this region is another unwelcome reminder of the intensifying threat landscape faced by organizations of every size. Recent executive orders and regulations both in the U.S. and Europe highlight the persistent nature of these threats and the critical need for our customers to prioritize security within their IT budgets. These cyber risk dynamics are evident in Rapid7's recently published 2021 Vulnerability Intelligence Report, which examines the 50 most notable security vulnerabilities and high-impact cyber attacks from the last year. It's clear that the attack landscape has shifted dramatically. Our research team found that cyber risk continues to accelerate, with the widespread threats increasing by over 130% compared to 2020, and more than half of those threats beginning with a zero-day exploit.
Companies increasingly need to detect and respond to threats more quickly as the average time for exploitation dropped to just 12 days in 2021 from 42 days in 2020. That the business and financial implications of a breach are real, as one-third of the vulnerabilities were exploited to carry out ransomware attacks. Altogether, this escalating threat landscape increases the probability of an average business being targeted by cybercriminals. In a security environment with limited noise and threats, and amidst evolving geopolitical and macroeconomic dynamics, we remain focused on what we do best for our customers, delivering best-in-class security, visibility, analytics, and automation by collecting massive volumes of the right data, analyzing this data for risk, threat, and compromise in a security context, and automating threat response to drive increasing productivity and efficacy of security outcomes.
We expect this focus on securing our customers' digital experiences, coupled with evolving industry dynamics, will continue to support durable demand for our differentiated and best-in-suite Insight Platform, which is reflected in our sustained strong full-year growth expectations. Now, I'd like to give a brief update on the progress towards our three enduring goals before turning the call over to Tim for more details on our financial results and outlook. First, we continue to enable customers to transition to the cloud securely. We began our cloud security journey in 2020 via both organic and inorganic investments with the intent of building a leadership position in the space. We've consistently shared our strategy to be a market leader across each of our core pillars as part of our goal to deliver an integrated platform experience that allows customers to have best-in-class security capability with a lower total cost of ownership.
Two years later, Rapid7's cloud security offering was recently validated by Forrester Wave for cloud security workload as the highest-ranking current offering on the market, validating our leadership status across all three of our core pillars of detection and response, VRM, and now cloud security. InsightCloudSec received the highest possible scores for CSPM, container workload protection, identity and access management, infrastructure as code, and data integration. This is a remarkable accomplishment by our team, and I am extremely proud of what we've achieved in cloud security in a relatively short timeframe. Our leadership in cloud security has generated strong traction with customers. Yet, there is another important distinction to make here, and that is Rapid7's ability to help secure customers' modern cloud environments with capabilities across our Insight platform.
As customers increasingly innovate in the cloud, they can leverage our broad platform capabilities to solve the cloud security challenge. This includes our industry-leading vulnerability assessment technology, which now powers native assessment for container and Kubernetes environments, and our best-in-class detection and response offerings to help identify and mitigate threats across cloud and hybrid environments. The efficiency and productivity of our platform across both traditional and cloud environments is an increasingly important competitive differentiator as customers look to secure their fragmented technology ecosystem. This brings us to our second overarching goal, to meet customers where they are in their SecOps journey by expanding the capabilities and value proposition of our natively integrated Insight Platform. Our results speak to our momentum here. We're seeing strong growth in ARR per customer as customers consolidate fragmented security tools on our platform, driving expanding customer usage and adoption of our solutions.
During the first quarter, over 50% of our new ARR came from existing customers as security teams increasingly look to natively integrated solutions to mitigate the challenge of trying to integrate multiple disparate products. This platform trend has supported strong demand for our security transformation solutions. As we shared last quarter, now represent over 50% of total ARR as customers look to leverage more of our solutions to minimize the seams and gaps that exist in their technology environment. A core part of the Insight Platform value proposition and competitive advantage is our focus on customer outcomes and our ability to drive productivity and scale with quick time to value for security teams with limited resources.
As more companies become resource-constrained amid high security scrutiny and a tightening hiring environment, it means that customers of all sizes and levels of sophistication are seeking access to our security expertise delivered by our expert SOC analysts and infused into our products. Turning to our third enduring goal. We remain focused on expanding profitability and free cash flow while investing for durable growth. Our first quarter investments position us well to drive strong growth while scaling profitability through the balance of the year. We saw strong traction on our full-year hiring plans in the first quarter, even amidst a competitive talent landscape, confirming Rapid7's standing as an employer of choice and providing a solid foundation for this year's growth. We have also been able to absorb the associated wage inflation, which speaks to the efficiency of our business model and our commitment to prioritizing strategic initiatives.
We continue to invest in our highest return opportunities, including platform growth and delivering holistic cloud security as we balance our dual mandate of scaling profitability while investing for durable growth. In short, we started 2022 with strong results, and we are well on track to meet our goals for this year. Our top-ranked technology and our ability to benefit from multiple areas of security spending give us conviction in our outlook for 2022 and beyond as we expect to continue delivering strong top-line growth while expanding margins on an annual basis. With that, thank you all, and I will now turn the call over to our CFO, Tim Adams, to share additional details on our financial results. Tim?
Thank you, Corey, and good afternoon to everyone. Thank you for joining us on the call today. Before I turn to the results, just a quick reminder that except for revenue, all financial results we discuss today are non-GAAP financial measures unless otherwise stated. Additionally, reconciliations between our GAAP and non-GAAP results can be found in our earnings press release. Rapid7 had an excellent start to the year, ending the first quarter with ARR of $627 million, which represents 38% year-over-year growth. Our sustained growth highlights the strong momentum we are seeing as customers transform their security operations programs around the cloud. In particular, customers are expanding their usage of our platform to more effectively analyze risk across both their traditional and modern IT environments and improve security outcomes.
The compelling value proposition of our Insight Platform is driving robust cross-sell and upsell activity, with first quarter ARR per customer growing 18% year-over-year to $60,000. At the same time, we continue to see a healthy balance of ARR growth from new customers as we ended the quarter with over 10,400 customers globally, which represents 16% growth from the prior year. Security transformation solutions made up over 60% of new ARR in the quarter and continue to grow at a strong pace. This speaks to the success of our land motion across multiple products as well as our commitment to providing a best-in-suite experience across our Insight Platform. First quarter revenue of $157 million grew 34% over the prior year and exceeded the high end of our guidance range.
This outperformance was driven by broad-based demand for both our security transformation and vulnerability management solutions, which drove product revenue of $149 million, representing 36% year-over-year growth and acceleration over the prior quarter. We continue to execute well on our international growth strategy, with international revenue growing 54% year-over-year to 21% of total revenue, while North America grew 30% year-over-year. Turning to our operating and profitability measures for the quarter. Product gross margin was 75% in the first quarter, while total gross margin was approximately 72%, both within our range of expectations. Given the strong momentum we see in the business, we continue to invest in driving durable growth while remaining focused on delivering full-year operating margin expansion consistent with our growth and profitability framework. Our Q1 investments position us to execute against the strong demand backdrop we see.
Despite competitive talent environment, we have seen strong success expanding our workforce. During the first quarter, sales and marketing expenses represented 43% of revenue, compared to 42% in the prior year, and R&D and G&A expenses were 23% and 9% of revenue, respectively, compared to 22% and 8% in Q1 of last year. First quarter operating loss of $5.6 million was consistent with our guidance range, and net loss per share was $0.16, also consistent with our expectations. Now moving to our balance sheet and cash flow statement. We ended the quarter with cash equivalents, and investments of $263 million. Our strong first quarter ARR growth and collection efforts drove Q1 operating cash flow of $10 million and free cash flow of $4 million.
This brings us to our guidance for the remainder of the year. We delivered strong first quarter results and see a durable demand backdrop ahead as cyber risk continues to escalate, driving increased prioritization of security spending for organizations of all sizes. Our expanded market leadership across our Insight Platform positions us to help many of these organizations as they look to consolidate to fewer strategic security vendors in search of better outcomes. As a result, we remain confident in our ability to execute against the strong year-over-year ARR growth guidance of 24%-25% that we shared at the beginning of this year. As we noted during our last call, we will share any relevant updates to this ARR guidance in the second half of the year.
Given our Q1 revenue outperformance, we now expect full year revenue to be in the range of $686 million-$692 million, growth of approximately 28% year-over-year. For our profitability measures, we remain on track to deliver non-GAAP operating income in the range of $17 million-$24 million for the full year, with net income per share in the range of $0.05-$0.16. This is based on an estimated 60.9 million diluted weighted average shares outstanding. For the full year, we continue to expect free cash flow in the range of $40 million-$45 million. Now turning to quarterly guidance.
For the second quarter of 2022, we expect revenue in the range of $163 million-$165 million, which represents growth of 29%-31% over the prior year. We expect operating income to be in the range of $0-$2 million and non-GAAP loss of $0.07-$0.03 per share, which is based on an estimated 58.8 million basic weighted average shares. We continue to focus on delivering strong growth with consistent annual improvement in operating margin and free cash flow in alignment with our growth and profitability framework. As we look at the profitability dynamics for this year, we continue to expect the majority of our operating income and free cash flow to be driven in the second half of the year.
This reflects first half investments in durable growth and underscores our strong confidence in the underlying demand trends and outlook for the year. In summary, we are pleased with our first quarter results and believe they give us a solid foundation for achieving our goals in 2022. As the threat landscape intensifies, we are committed to delivering market-leading security operations technology to enable better security outcomes for our customers. Thank you for joining us on the call today, and we will now open the line for questions. Operator?
Thank you. As a reminder, to ask a question, you'll need to press star one on your telephone. To withdraw your question, press the pound key. In the interest of time, please limit yourself to one question so that we can get to everyone in the queue. Our first question comes from Matt Hedberg with RBC Capital Markets. Your line is open.
Great, guys. Thanks for taking my questions and congrats on a great start to the year here. Corey, I think both you and Tim mentioned, you know, sort of the strong cyber backdrop here that I think we all see in the headlines every day. I'm just curious, could you talk about the durability of this spend? I think oftentimes we get questions about like, you know, has there been a pull-forward spending or something of that nature as a result of COVID. Just kind of curious, you know, if you could give us some additional data points on the durability of spend that we've seen, especially when we see these increased cyber breaches, feels like daily in the headlines.
Yeah, Matt. One, thank you, and it's a great question. I think there's two dynamics that you're seeing. The one we think is extraordinarily strong in the environment. We also think it's durable. It's driven by two factors. One we actually started talking about last year, and we noted sort of in the second half of last year that we were seeing and planning on executing for sustained durable growth in the environment. In fact, we've seen that play out quite well. That was driven by security becoming a mandatory part of digital transformation. It has a presence here at the table. You see that with boards, you see that with executives, you see that with regulators. That makes it durable where people have to stay current and relevant.
There's an additional one that we're actually starting to see the early parts of that only strengthens that momentum, and that's with the current state of global conflict around cyber, standards are also having to raise and increase. Not only do you have it as something that's on board or mandatory agendas, is I suspect what you're gonna see over time, we're already seeing that in certain parts of the market, is that companies are gonna have to increase their standards, all across the board of cybersecurity, and that creates another driver of durability. Again, all the data that we see indicates that this is gonna be a sustained focus for businesses at higher level of the standards for the foreseeable future.
Thanks, Corey.
Thank you.
Thank you. Our next question comes from Matt Salzman with Morgan Stanley. Your line is open.
Hey, team, this is Matt Salzman on for Hamza Fodderwala. Thanks for taking the question. So you've had IntSights for a few quarters now. So just would love to get a sense on how the integration's going, you know, is your sales force fully ramped there, and if you're seeing any incremental customer interest. Thanks.
Yeah, it's a great question. The integration is going extraordinarily well. The teams are working well together. It gets a little easier as you actually get to an environment where people can travel and engage more. The second thing is the XDR story really resonates with our customers, and we're seeing that be an attractive part of customers who are looking to improve their operations, lower their total cost of operation. The Rapid7 XDR story is a powerful story that delivers both efficacy and productivity, and that resonates extraordinarily well with customers. It also provides incremental land motions and opportunities.
When you look at it all up, I would say that we are seeing the ability to not just land, not just cross-sell, but really it's been a catalyst for customers continuing to look at the leadership of our XDR story all together. Thank you.
Thank you. Our next question comes from Alex Henderson with Needham. Your line is open.
Great. Thanks so much. I was looking at the net new ARR and the quarter-to-quarter increase in the customers, and the net results there obviously are substantially lower in the March quarter than in other quarters. Yes, you're up 18% year-over-year in terms of customers. But if you look at it quarter-to-quarter, it's actually kind of an underwhelming number. I'm pretty sure that is just strictly the mechanics of the seasonality because I think it did something similar in the first quarter of last year. Can you just talk about the seasonality of that net new ARR and the seasonality of the new customer additions that are typical in the March quarter? Thanks.
That's a great question. You know, we can hit seasonality. I think the bigger issue is the core driver of the mix. You know, I'll remind you that when we did our analyst day, we talked about mid-teens growth in the ARR per customer and the 5%-10% growth. As you'll recall, the 5%-10% growth got some questions. What we described then was that while that was 5%-10% in aggregate, we were doing an aggressive mix shift to customers that were more strategic-oriented, had much higher lifetime value, and we were looking to take share and drive share in what we consider high strategic value customers and high lifetime value. That's looked at through the lens of customers that are likely to adopt our full platform over time.
When you think about that 5%-10%, we're out executing that metric. You know, in this quarter, while we don't report the breakdown consistently, I would say if you look at our platform customer growth, that was over 25% or roughly 25%, in the quarter. The way that we think about this is that from a long-term perspective, 5%-10% is healthy, but the most important part is actually that we do the mix shift so that we actually have a higher propensity and a higher volume of customers that have high lifetime value and also high profitability. Correspondingly, we're actually defocusing on customers that actually have lower lifetime value and lower profitability, and that's been a multi-year intentional shift. That's the driver and the balance.
I would say that the quality of the customers is actually growing, and that's part of why we actually are so bullish, not just on the growth, but also the ARR per customer potential, because we're seeing our strategic execution play out really well. You see that this quarter with 25% growth in the platform customers.
Corey, let me just.
Could you just clarify what you mean by 25% growth in platform customers, please? What is that exactly meaning? How are you measuring that?
Yeah. The platform customers are just customers that are exactly adopting the Insight Platform. You can think about what we wanna sell to. You know, in the past we've had a mix of things that included, you know, transactional on-prem. Metasploit was a big part of that. You had high volume, but it was much more transactional in nature and had lower lifetime value. When we define strategic customers, this is customers that are actually buying the platform and have the capacity to buy our entire platform suite over time, which gives us high lifetime value. It also generates higher long-term profitability, which is our overall focus. We've continued to make steady shifts in that direction over time. That's how we define it.
Platform customers are customers that are buying only Insight Platform, that has InsightVM, InsightCloudSec, and the InsightIDR portfolios.
Yeah, Corey, I would just add on the seasonality. First off, I felt we had a very strong quarter when you look at the revenue growth and the ARR growth. We do expect a similar pattern this year, quarter over quarter, that we saw last year, where you do see a step-up in the net ARR in Q2. Q3 looks a lot like Q2, and then it steps up again in Q4. We expect a similar pattern this year to what we saw last year.
That's what I thought was the case. Thank you very much. Great, great answers.
Thank you very much.
Thank you. Our next question comes from Rob Owens with Piper Sandler. Your line is open.
Great. Good afternoon. Thanks for taking my question. I apologize if I missed it, but could you unpack the Russia impacts as you talked about suspending activities with both Russia and Belarus, whether it's even significant to revenue or percent of revenue and ARR? Thanks.
Yeah. Hey, Rob, it's Tim. Corey did mention that we are not taking any new business in Russia, in Belarus, and we're not renewing any of those customers. It was very immaterial, so it had no impact on the results.
Any impact on that ARR guide, I guess is the question?
Can you repeat that? Can you repeat the question again, Rob?
Any impact on the forward ARR guide from suspending activities or it's immaterial?
No. Rob, it's really immaterial. Again, you know, the $740-$750 full year ARR guide that we gave you three months ago, we feel very confident in that showing a very nice growth on a year-over-year basis, but no impact from those two geographies.
Great. Thanks.
Thank you.
We have a question from Jonathan Ho with William Blair. Your line is open.
Hi, good afternoon, and let me echo my congratulations as well. In terms of international growth, what seems to be making the most difference there in terms of the strong performance over multiple quarters? Are you making more of your investments sort of outside the U.S. to take advantage of the opportunities there? Thank you.
Great question, Jonathan. Our investment strategies remain consistent. I think there's two core drivers. One, you know, the team is executing quite well. The second part of it is the international teams are getting the full benefit of being able to sell the full platform. You know, keep in mind, in a world where you actually have more and more data privacy governance, as we've actually expanded the platform around the world, this has been a driver of shifting the international teams off of these traditional, more transactional businesses like Metasploit to those higher ASP, higher subscription businesses, stickier businesses on our platform. The international team has been a primary beneficiary of that. You're just getting good execution against that opportunity more than anything else.
Thank you.
Thank you. Again, as a reminder, if you would like to ask a question, press star one on your telephone. We have a question from Joshua Tilton with Wolfe Research. Your line is open.
Hey, guys. Thanks for taking my question. I just wanted to confirm that you said 50% of new ARR in the quarter came from existing customers. If that's the case, I think it implies that your NRR is pretty strong. I know you guys don't disclose it anymore, but is there any additional color you can give us on where the NRR stands today?
Yeah. Hey, Jonathan, it's Tim. What I can tell you is that we've seen some very nice steady increases in both the net retention and the gross retention. As you know, we don't disclose what those numbers are. We saw a very nice improvement last year, and that continues into this year as well.
Can I just confirm that you said?
I think since we're all cross-sell.
Can I just confirm that you said 50% of new ARR came from existing customers?
Yes, correct.
Thank you.
Our next question comes from Saket Kalia with Barclays. Your line is open.
Yes. Thank you very much. There was a tick down in your professional services gross margin sequentially. Can you talk to what drove that? Also your product gross margin has been declining on a year-to-year basis. Do you think that's gonna stabilize?
Yeah, this is Tim. Let me start with the professional services. We know that the revenue can vary from quarter to quarter. We think about it on a full year basis. What we did see in Q1 is some experience with the scheduling challenges, which was really driven by some of the attrition in our team. That put a little more pressure on the gross margin because you have to ramp up, hire some new staff, and then we do try to supplement that with some third-party labor as well. That gave us a little pressure on the gross margin that we see in Q1. On an overall basis, though, we still feel very confident with the total gross margin being in the low 70s% for the year and the product gross margin being in that mid-70s%.
We commented similarly last quarter, where it really comes down to product mix that can drive that gross margin. As we've talked about some of these newer services that we have in the marketplace, the security transformation solutions are very high growth, and they are changing the mix dynamic. They're still earlier on in that life cycle of scaling and efficiency and driving their own gross margin. Overall, we feel very confident with the total gross margin being in the range that we've laid out and with product gross margin staying in that mid 70s% range.
Yeah. The only thing I would add to that is that, one, the team has done a great job of bringing in some excellent talent, and they're, you know, they have labs. That's a positive benefit when it comes to services. Then the second thing, when you look at the product mix shifts drives it, but what we've said is that each of our teams are also focused as they actually do that aggressive scale, with more customers, that they're actually making it more efficient over time. We're seeing each product also improve its own gross margin characteristics, over time. Again, it's something that we have, you know, lots of visibility into, and it's in line with our expectations.
Okay, thanks.
Thank you. We have a question from Brad Reback with Stifel. Your line is open.
Oh, that's great. Thanks very much. Corey, just as you look higher level, how's the appetite for M&A this year?
Yeah, it's a good question. One, I'll remind everyone that we tend to be fairly thoughtful and strategic around how we actually think about it. It has to both provide strategic value, be accretive in the midterm, be a good talent and cultural fit. You know, what's a little bit unique about us, it has to have the capacity to both differentiate our existing products but also fit into our cross-selling team. That's a pretty high bar that we actually say no to. You know, the only thing I would say in this environment that we're actually watching, you know, not all private market prices have actually adjusted. I would say that, you know, we're thoughtful and open to it.
That's something that we're paying a lot of attention to, just sort of like how private markets are pricing and trading in general. We're not moving away from our long-term strategic lens about how we actually think about these things.
Great. Thank you very much.
Thank you.
Thank you. I'm showing no other questions in the queue. I'd like to turn the call back to Corey Thomas for closing remarks.
Thank you all so much for joining us today. We really appreciate it, and we look forward to checking in with you next quarter.
This concludes today's conference call. Thank you for participating. You may now disconnect.