All right, we're going to go ahead and get started. Wrapping up end of day one, and we saved the best for last, clearly. I'm Adam Tindle, not the best, but software analyst here at Raymond James. Happy to have the team from Rapid7. Rafe Brown, who is newer to the role, newer to the CFO role, we are going to put him on the spot a little bit here on the webcast, and then, of course, I think everybody knows and is familiar with Corey Thomas, CEO, so CEO, CFO, Rapid7. In terms of the format, just a fireside chat, so anybody who has questions, please feel free to raise your hand. I know it's later in the day. Hopefully, you've had some afternoon coffee and can come up with at least one question, I expect.
But for those not as familiar, Corey, and thank you for being here, maybe just walk us through the background of Rapid7, the market opportunity, and some of the key value proposition.
Yeah, so I'll do it backwards first to talk about where we are today and what we see the biggest opportunity going forward. So if you look at over half our business Detection and Response, our fastest growing line is the Managed Detection and Response supported by AI. And if you think about our core customer base, we serve, I would just say, mid to large enterprise customers. Our sweet spot is 1,000-20,000 employees. And the biggest single opportunity that we actually see today is that for those customers, security is a clear mandate. And instead of just running their security technologies, they're looking for a partner that they can actually outsource more of their security workloads to get scale. And our strategy for doing that is to have an integrated security operations platform that integrates and orchestrates data across the data lifecycle of security .
So, what's the core asset inventory cloud data? What's the risk? What's the controls? What's the policy? What's the configuration? And then monitoring those data telemetry for attacks. Our core belief is that customers want to outsource more and more of their security workloads in that segment over time. So that's just if you zoom out, you say, like, what are we about? We want to be the premier partner that's best in the world at integrating orchestration and providing AI-driven services that allows people to outsource their security operations workloads. Where we are today is we've taken the biggest chunk of that journey with our Command-based MDR offering, which was the first workload that we moved to this model of AI-driven security outsourcing. It's over half the business today. It is growing in the teens.
We see more opportunity to, frankly, grow more there and accelerate growth there as we actually leverage AI to expand the addressable market and use cases, and over time, you'll see us add more and more workloads. We actually added managed or AI-driven Red Teaming this year. We'll look at Managed Risk, Managed Compliance, and other workloads over time, but the core thing is we're helping our customers scale in their environment. The reason we have a right to do this in many ways is because, like many things, AI, it's all about the data, and we've been building a foundation of both the data, the integration, and the services around this for a long time, and so if you think about security operations, it's about, do you know what's in your environment? Can you assess the risk of your environment?
And can you monitor the full environment, which is a core part of the technology? Now, we've done this in two phases over time. The first phase is we actually moved over to the detection and response with the technology, and then we added the service around it. In the most recent phase, we actually upgraded all the technologies to be an integrated platform service to Command Platform service. And in the next phase, we're actually adding more workloads to the AI-managed services space. And so what you'll see is that our growth in the AI-managed workloads today is strong, but we actually have to add more workloads to actually see that growth rate sort of shine through the rest of the business.
Perfect. And sitting here today, we do, as I mentioned, have Rafe Brown, CFO. You recently announced the appointment of Rafe in this role as Tim, and shout out to Tim if he's listening on the webcast. We still love him. He'll serve in an advisory role as he transitions into a well-deserved retirement. Just walk us through the process of finding Tim's successor and the key characteristics that led you to Rafe.
Yeah, look, Tim had some big shoes to fill. We were focused on finding someone that was going to be appropriate for the leverage approach, which, if you think about, if we want to be the premier customer partner that customers actually work with to actually outsource their security workloads using AI, it really is about the operation. So we've got to get two things. One, we're in the middle of a transition. We've done the hardest part of the transition, but we still have time to go. So how we execute, how we actually manage, how we actually make investments, and how we drive accountability is a really big deal. So having someone that could partner with the business and really drive the execution of that transition was a big deal.
And so we were looking for someone who had operational experience at driving operations and also partnering with the business to actually move through a transition at velocity, but then it could also communicate that to investors because we know investors have been frustrated about how we've communicated in the past. And Rafe was just an exemplar there. He's actually been a COO of a major security company. He has the background where he's actually advised, worked, and had critical roles in the private equity space. And so he knows the operations space. Our team, when they met him, he's a great business partner around it. And he's effective at actually communicating sort of long-term transitions. So that's what we're looking for.
My early impression is that he's brave because as I was preparing the script, I wasn't sure if he was going to be willing to speak up. He is seven days on the job, I think. This is your second week.
That's right. My second Monday.
We'll give you a little bit of a break on everything. But we did want to give you an opportunity to speak, Rafe, just acknowledging very early days. But we'd love to hear your early impressions of Rapid7. And I always think it's interesting when a new exec comes in because we've got investors in the room and on the webcast that are perhaps even learning about Rapid7. And just taking them through your journey to learn the company and then kind of hitting the bid on, this is the job that I want, is effectively what they're having to do in deciding whether or not to invest in Rapid7. So just walk us through sort of your process and why you decided to join.
Yeah, thank you. You know, I think it starts to a great extent. First of all, the company has a great brand. It's been providing great services to its customers for years. And living in the Boston area, everybody knows Rapid7 in this space. And so I was starting from that. But I think the story that Corey was just touching on, the company going through a transition, but really looking at how to go into that next leg of its journey. Products and markets and customer needs change all the time. And the company is really working hard to get out ahead of those needs and demands to provide security to its customers. And I thought that was really exciting.
You can see that in the recent leadership the team's brought in, the attitude that the product team is really digging in hard, really trying to get ahead of that curve and not just to use technology to help us grow and scale, but to use technology to help provide better, consistent, strong services to our customers. That just sets us up for a great opportunity. For me personally, it's a chance to come in and work with a bunch of people that are experienced but also still really excited and energized about making these changes and seeing where we can go together. It kind of all added up to a great opportunity that I was happy to join.
We're looking forward to it. And Corey, one of the stories on Rapid7 or opportunities for Rapid7 is growth and growth acceleration. Talk about the growth levers for the business. We used to think of this in sort of that mix of new customer growth and ARR per customer that led to a buildup of total company growth was sort of the algorithm you used to talk about. But obviously, the business has changed from the VM-only days. How are you thinking about the buildup for growth and how to think about sort of a normalized growth rate for Rapid7 over time?
Yeah, and so if you look at the growth drivers, it's pretty simple. It's that, one, we're looking at the managed services workload, how much capacity do we have in the existing workloads, and what does that add to new workloads. We're already growing in the teens today on the existing workloads with the D&R. And we think that we're, frankly, have more growth left in that engine. And we think we have more capacity to actually grow that engine. And so that's the big focus in the near term is how do we actually unlock that capacity and how do we drive more growth both in the existing customer base and on the net new customer base because we have an amazing opportunity internationally, which has been a big growth engine for the business overall.
The second thing is how do we actually add more workloads to there, which is we start rolling out more, introducing them in 2026, but that probably doesn't hit the bottom line at 2027. But that's what we like about the sustainable growth. The last piece, the third piece of the leg is the focus on growing the ARR per customer and the customer base, which we think we have lots of capacity. We just brought in a new Chief Commercial Officer. I will say that I was disappointed this year with our ability to actually grow the ARR per capacity and the customer base, that expansion business. That was primarily driven by we were not systematized enough. I think I was talking when we started the year that it was a new motion for us, the ability to go out and drive that.
We have seen plenty of opportunity to do that, meaning that we actually have evidence that it's actually doing. We just have to make it more systematic, more consistent in driving. And Alan, our new Chief Commercial Officer, is driving that consistency that we actually need to see overall there. But those are the big growth levers and drivers that we're actually focused on.
You also have new leadership that's great at operations.
Exactly. Absolutely.
Yep, so that makes a ton of sense. You mentioned D&R and exposure management areas have become more prevalent. I guess the question would be, how do you think about the competitive landscape today versus kind of a lot of investors know Rapid7 from the VM days where it's Tenable, Qualys, kind of the traditional.
Yeah, people are always shocked that it's like a third of our revenue.
Is that right?
So when you look at it, over half of our ARR is D&R. We think we have growth capacity there that we have to execute on it. Now, I will say that what we've asked, both Rafe and myself, have talked to Alan, our Chief Commercial Officer, and we're very focused on him actually really instrumenting and operationalizing the system. So we said, take the time that you actually need and really focus on that. But in the next sort of quarter or two, really focus on instrumenting, operationalizing the system there. But already over half of our growth, over half of our ARR is the D&R engine today. And so that changes your competitive dynamic where you're competing against people that participate in that D&R space.
If you look as we go forward, though, we do think that as we think about our ability to deliver an integrated security operations service experience that lets people offload more of their workloads, we think we have a pretty unique value proposition there.
D&R, though, it's kind of a wide variety of competitors. If you were to kind of name a couple of names, I mean, are you competing with CrowdStrike in D&R? Are you competing with?
You see some. So if you think about CrowdStrike, so everyone offers a managed service on their own technology. So CrowdStrike, SentinelOne offers managing their technology stack, which is a pretty broad technology stack there. And for customers that are only on that stack, that works for them. That is not the majority of customers in the market. It is some that are there. So that's one side. Then you have a bunch of private companies that, frankly, are getting easier to compete with because they run out of free money, which was a challenge over the last couple of years as every private company was for sale and the money was free. That was a challenge. So you have a bunch of companies from the eSentire, Arctic Wolf, ReliaQuest.
You have some really, really good companies in that spectrum and some companies that are struggling in this direction. But it's a long list of companies, competitors.
Yep. We talked about growth moderating a little bit in more recent years. I guess the flip side is, and to Rapid7's credit, profitability has significantly improved. Maybe just talk about the journey from running the business. I mean, back in the day, it was closer to break-even levels to your current non-GAAP operating margin in the mid-teens ballpark. And where do you see optimal levels of profitability? I'm not sure if Rafe wants to weigh in on that question as well.
Yeah, well, I think the way we are really going after it currently is thinking very much about how we'll exit 2026. There's been a lot of investment into the system, largely building out the operations in India, doing a bunch of work into the product. And those costs have been coming on board on 2025. But what we'll start to see, at least how we're thinking about it, is that towards the end of 2026, we'll be focusing on how are we exiting? Are those efficiencies appearing and paying off? And hopefully, that'll give us that line of sight, if you will, for ongoing improvement over time. But it's really a question of making sure we have our instrumentation correct, of being able to assess where to invest, when to invest, when we need to make adjustments to our investments. So we'll be constantly looking at those investments.
Are we getting the rewards we thought on the growth side of the equation? And if so, maybe we continue them in those cases. But in other cases, we'll look for opportunities to drive efficiencies on the bottom line.
Okay. I mean, I guess philosophically, things like India or other optimizing events that would potentially help improve margins, would the philosophy be more like, hey, we can sort of hold this very healthy margin level in the mid-teens and then reinvest the upside for growth? Or would it make more sense to sort of let the margin keep accreting upward?
I think it depends on the cost of the growth at the end of the day. So the way to think about it is that what we're driving and what I manage us to is how do we actually show as we move into next year. Alan's going to put in the system in place. But how do you actually you should start seeing evidence as we move towards the middle of the year of where's the growth happening? Is it on the plan? Is the AI security services strategy playing out? And then if you're starting to see the tea leaves of growth, then you have many more options that are actually there. If it's not, then that means there's some elements that are not working. And that means more should flow to the bottom line is kind of the simple way to think about it.
I think that we will make fairly pragmatic decisions that are going to be focused on how do we actually grow free cash flow overall. I would be thrilled if we're growing free cash flow by top-line growth and keeping margins tighter or growing slightly. If the evidence isn't there, then we'll have to just grow margins overall.
Yeah, that's a fair answer. I think that's what investors would like a good management team to do. So one of the other things that you've done over the years, Corey, is been very willing to adapt your go-to-market approach. And you've fully owned some things work, some things haven't. So maybe just talk about some of the moves you've made over time, the more recent move to regional model and platform selling motion and some of the partner moves. Just kind of sum it all up, take us through a little bit of history and sum up the recent moves.
Yeah, look, I think we've been in a transition state for longer than we like. But there's two big drivers of it, if you really want to get simplified down. One is the traditional mid-market that was half of our business is just not a robust opportunity. So if you think about our sweet spot today of being 1,000 employees- 10,000 employees, and we serve all the way up to 50,000, 100,000 employees. But the mass of the market is in that space. That is proficient. That works well. But if you look like three years ago, it was really sort of like a couple hundred employees to 5,000 employees. And what we found is that sub 1,000 employees, we just didn't like the economics of it. So we had to make some shifts, some shifts there. Combined with the AI services strategy has had larger ASPs and longer cycles.
How we manage that has had to evolve. If you look at where we are today, it is a much more strategic sell that is to the CISO or the CIO that is higher in the stack, both with higher ASPs that now we're actually really optimizing and tuning the model now that we have some consistency there. That shift in both the customer segment size and the deal size was bumpy along the way. Now that we have some stability, we're focused on really optimizing the sales engine around that.
Got it. Any questions so far? Quiet crowd, as expected. I'll keep going in some higher-level questions, and then we'll get into some capital structure stuff. But you mentioned AI, Corey. Cyber spending in general has been pretty resilient overall. But investors do have concern. We hear some concern that AI spending might ultimately command a larger portion of the budget, IT budget, potentially at the expense of other things like cyber spending. I guess the question would be, are you seeing any evidence of cannibalism in spending? And how do you think about the resilience of total cyber spending going forward?
Look, I would frame it as people's IT budgets are under some amount of pressure right now. If you talk to customers, it's that they were growing easily, and now they're not growing easily, so people are having to actually figure out what they want to do. They're figuring out also, but for cyber, the regulatory environment's increasing. The attacks are there, and so you have just as many tailwinds as you do headwinds on the overall budget. Part of why we've set up the strategy that we've done is our buyer proposition is very easy. As you need to get scaling your budget, you should actually be moving and outsourcing more of your security workloads and doing that with great skill and efficacy. I mean, our biggest thing right now is customers just like, yeah, we like it. We need you to deliver more of those security workloads faster.
And that's why we feel really good about the dynamic space that we're actually in. And we don't see that abating where people are going to try to get more leverage off of their security budgets and investments. But the leverage off their security budgets and investments is they're having a harder time hiring security staff, the budget for it, not even the talent for it, than they are actually spending money on security services. And so we feel good about that setup. But that's why we're very focused on actually playing that out.
Right. And it makes sense, the whole MDR offering, especially if it ties into that. And the other thing I did want to ask about that we get questions on, and it's just a little bit frustrating in my shoes, covering more of the mid-cap size cyber stocks in general. That's our sweet spot at Raymond James because there's this view that sort of the big guys are almost becoming monopolistic in many different markets, leading with AI, NVIDIA, et cetera, and bleeding its way into cyber, whether it's Palo buying CyberArk now, CrowdStrike consolidating the world. I guess as you think about sort of the competitive dynamics within cyber and this move towards these big platforms, how do you try to navigate and compete as one of those mid-size?
What's clear is you have to be great at something. And so we've said that we will build the best integration and orchestration platform, leveraging data, which sets up the AI use case. And we will be best at helping customers outsource their security operations to an AI security services partner, us. And we're going to have a curated ecosystem of technology partners like Microsoft that we actually use around it. That is not something that's being offered by CrowdStrike, Palo Alto, and others where they're actually deeply integrating with Microsoft and a number of security players, building an integrated technology ecosystem based on an integration orchestration platform that helps people outsource their security operations over time. Is that for every customer? No. Is it for a lot of customers? Absolutely. And so you have to be more specific in these environments.
Look, the thing I don't love is the environment changes fast, and we have to adapt to the environment that we actually find ourselves in. And so this is why the transition has taken longer than we expected. But you do actually sort of focus on what are customers looking for, what's unique that you can actually do, and how do you drive it forward. And we're there. Now we have to execute on it, and we have to prove that out. But that's why we built up a team of operators around us to go drive that execution over the course of next year.
To your credit, you were visionary in seeing trends in cloud security early with the acquisition of DivvyCloud many years ago. Now, obviously, that investment has been validated over and over again in Google spending a ton of money on Wiz. Maybe just in that piece of the business, it's just kind of an interesting area in cloud security. How would you sort of describe the state of that business for Rapid7, the competitive environment, how it's evolved since DivvyCloud?
Yeah, so our focus in cloud, so we're adding capabilities both directly in our R&D, but also through partnership, and we have some interesting partnerships that we're doing there, and our view of the business is that we will win people that are looking to simplify their security workloads and actually deliver it as a service there. For people that actually want to run it all themselves, that's fine, but we have lots of product customers and uses around it, but if you think about our stack, we have our legacy technologies. We have our integrated Command stack, which is both our technologies, but we have a curated integrated orchestration sort of ecosystem that has partner technologies that we integrate in that is hyper-competitive, so for people that want to roll their own technologies, they can, and they are, and we're seeing good traction there.
And then we have our security operations managed services stack, AI services stack that people want to outsource those full workloads to. We are in the middle right now where we've been upgrading the technology stack and integrating that at the Command layer. And so it's a reasonable chunk of business, not massive today. We have not focused on growing that, just to be clear, because the focus has been to upgrade the technology, start to upgrade the customer base. But really, where we're going to differentiate is delivering it as a service across the customer base.
Got it. That makes sense. We've got time for maybe a couple more. One of the elephants in the room has been performance relative to initial plan or initial guidance over the past few years, and I know we have Rafe, not to put you on the spot, seven days into the job here, but maybe if you guys could both just talk about the key learnings. Obviously, you weren't here for those periods of time, but key learnings and how that might influence both of your thoughts as you kick around initial fiscal 2026 planning.
I think the big one is transitions take a little bit longer than you think sometimes. I would say, but there's actually significant validation of the core strategy around it. It's our job to lay out the goal post. I think that one of my big learnings is that we want to communicate in the interim. So we will sort of, as an example, when Alan came in, we said, listen, make the changes you need to make right now. This is why I lowered the guidance because I'm just like, I don't want to actually be playing quarter to quarter. I'm like, we'll take our medicine now. We'll deal with lower guidance. We will sort of set the expectations that he'll have six months to actually deal with that and when people can actually start seeing the progress there.
And so we do want to communicate effectively about both what are we doing, what are the right expectations. And then as we see progress, then we'll raise expectations from there. But you can expect us to actually make sure that we don't make the sins of the past and get out over our skis on expectations where you require very precise execution and adherence. Now, we are improving the execution. But we will be guiding towards sort of like, hey, this is where it is right now based on the history. And then as we see improvement, we'll actually change those expectations.
Yeah, I think that's right. And I know as we're looking at it, it's really we want to make sure we're very clear on it that we set expectations right. But we also help investors understand the proof points that we're seeing. And we can talk about here's what we'll be looking at. And then we'll talk about what we've seen as those quarters come in. Because you go through any transition, it's more complex than is if just one product straight down the middle of the road situation. But that's fine. People can handle that. We just got to make sure we're really transparent, that we're consistent. And we'll just make sure we can keep that up as we go through this transition ourselves.
Is there a particular growth metric that you're really focused on? Is it more revenue? Is it ARR? Is it net new ARR? And how would you?
Yeah. Look, if you look at we looked at two things, and we're going to update how we actually share information is we're looking at revenue by the different product lines and service lines because that's a really big deal. So if you think about the legacy stuff, our upgraded integrated Command Platform, and our AI services layer. So we're looking at what's the performance of those because they have discrete targets that we're looking at core milestones around. And then from a communication perspective, of course, it adds up to sort of like net ARR. The challenge is you can actually have let's just say as an example is that we could be seeing great things on the Command Platform and the AI services. And we could have more headwinds than we expected on the legacy. And so the net ARR is more challenged.
But the fact that these are performing well, the opposite could be true too. And so it's looking at the foundations. Rafe has already said that he's going to work with the team to figure out the analyst day and how we communicate that transition. So we do want to be accountable to saying it's not a mystery because it's not that hard. But we do want to communicate to you all what we're seeing and what we're tracking in the business.
I think that'd be super helpful for us to be able to model the growth business because there's so much you're giving us breadcrumbs.
Yeah, but we need to be clear about what it is.
Yep. More work for you guys. Sorry, Matt and Sunil. Just bringing it home. Rafe, I would love maybe just some comments on the current capital structure, optimal capital structure, and liquidity. And if Corey wanted to jump into that too. Just something that comes up. Investors obviously see the convert and some of the things that go on. So if you wanted to maybe just touch on that and plans around the capital structure.
Sure. And I think we would start with the fact that we're feeling very comfortable when you take our cash and the government securities we have. We're in a very good position to be able to meet the expectations around the convert as it becomes due. So on that first convert, we feel very good. We've got good runway to before the second smaller one comes due. So that takes one big stress point off the table for a lot of people when they fully understand it's cash plus the government securities that we're carrying that we're already got that satisfied. Beyond that, I think the opportunity for us is to make sure we're funding the operations of the business, obviously, but also making room for if there's tuck-in acquisitions or there's unique teams that are accelerating.
I think universally there's nobody's talking about doing big acquisitions, but there's always those opportunities for tuck-ins or additional investments that we need. We make sure we have that liquidity on hand. We're really all about trying to make sure that we're nailing the operations and the execution, and so we've taken out the convert worry off the table, so now we can focus on our core responsibilities and running a good business.
Would share repurchase be any? I'm just, given the valuation of the stock. I can't imagine there's a lot of acquisitions that would be higher ROI than your own equity, but just not to put you on the spot.
Look, I would say everything's on the table. And we actually look at everything. I think what Rafe just outlined is the core goals that we have is making sure that we have the capital to run the business. And then we're constantly looking at how do we best use the cash that we're actually generating to actually generate the best shareholder return while keeping the risk low. And I think everything on the table from that perspective is right.
Good. Well, we're going to wrap it. I guess just wanted to, Corey and Rafe, if you'd like, first of all, acknowledge, obviously, seven days on the job. Excellent job. I did put you on the hot spot here a couple of times. So well done. Just closing remarks, the key message that you'd like investors that are in the room and also on the webcast that may be newer to the story or listening to some of these interesting inflection points, what's the key message that you'd like to leave with investors?
You want to go first?
Yeah. Well, I think kind of to bookend my opening remarks, I'm very excited to be here. It's an investment for me just like it is for everybody else here. It's an opportunity to be part of a great story. And I'm excited to be part of it. And there's real work to do. But I think there's also real rewards in our future.
So the first is, I'll acknowledge that the transition that we're moving to has actually taken longer. I think the thing that matters more is I always think about investing as every day I'm making an investment. So the question is not what I've done, but what I'm making today. And if you look at where we are today, more customers are looking to actually outsource more of their security workloads than at any time. Rapid7 is uniquely suited. We have an integrated stack. We've expanded that this year with several unique integrated partnerships, including Microsoft among several others. And we are unique in persona strategy of allowing people to actually outsource more of their security workloads with technologies that they're already using, not just our technologies than anyone else. And I actually think that's a focused strategy that we have to deliver and improve the execution on.
But we already have the evidence in our MDR growth. The areas that we're expanding in, the areas of risk and compliance are areas where we have expertise and experience. And we already have the partnerships there. And so it is an execution story, not a risk story. But I think we can drive the execution. And we've just upgraded the team in a number of different areas to drive that execution.
Great. We'll leave it there. Corey, Rafe, thank you so much.
Thank you.