Get started. Thanks everyone for joining. My name is Adam Tindle, and this is part of my Cybersecurity Coverage here at Raymond James. Obviously, very topical, you know, topic, I guess, right now with everything going on in the world. Very happy to have the team from Rapid7 here. We've got Rafe Brown, CFO, and he is past the 90-day mark, so no excuses, we're gonna grill you.
That's great.
Sunil Shah, who is SVP of Finance.
Mm.
In terms of our format, just a fireside chat. We'd love to keep it interactive. No slides or anything like that, but of course, there's Investor Presentations available on Rapid7's IR site. Rafe, Sunil, thanks for being here.
Pleasure.
I guess for those not familiar, if you could just walk us through sort of the high level overview, the background of the company, market opportunity and key value proposition.
Sure. Just at the highest level, we're a cybersecurity provider. We have a large detection response business, mostly managed detection response business. We have the other big pillar of the business is our Exposure Management space, which grew out of our, you know, our roots, if you will, as a vulnerability management provider. That's evolution continues there. That drives the vast majority of our revenue.
Yeah. What I would try to add to that is as you think about the evolution that we're going through today is that, you know, we grew up as kind of that core security operations platform over the past, you know, 10 plus years, with the core pillars of that, you know, kind of Exposure Management, detection response. As we look at where we are today and where we're going in the future, we're really evolving into that, you know, AI powered, AI enabled managed cybersecurity operator.
Mm-hmm.
As we look forward, where we're really looking to bring together the core elements of Exposure Management and risk visibility and detection response in a way that really elevates outcomes on behalf of customers with an AI powered lens, through integration of the data associated with those two capabilities to deliver better outcomes on behalf of our customers. We see not only from customer standpoint, but from an industry standpoint, a lot of convergence happening across those areas in Core SecOps where AI can really enable the next step of leveraging data intelligence context to drive better outcomes more effectively and more efficiently on behalf of customers. I know AI is gonna be a topic we'll get into a little bit more and something that many of you care very deeply about.
Before we do, Rafe, I mentioned earlier you recently joined as the CFO. I think it'd be helpful to maybe just give a little bit of background on yourself. Obviously you've got some industry experience that might be interesting to folks. Talk a little bit about what about Rapid7 made you excited to take the role.
Yeah. Thank you. Yeah. You know, as you mentioned, my last longer term CFO opportunity was at Mimecast, where I was there for five years, which is an email security provider. Between there and coming here, I worked with Francisco Partners for one year, but actually worked mostly with a number of security companies in their portfolio. I have, you know, a lot of finance years, too many years, most of them doing finance, but a heavy focus on security, you know, for certainly since 2019 when I first went to Mimecast. This opportunity, I think, was unique in a few ways. One, you know, I came into it with quite a bit of knowledge about Rapid7. You know, Mimecast is in the same neighborhood.
We exchanged a lot of D&A over the year of good people going back and forth between the organizations. It has such a reputation as a strong company, as a company that really is on the front lines of protecting its customers and putting customer first, and that's just been that reputation for years. So being in the area, I was aware of that. I'd had the opportunity to meet with Corey, our CEO, you know, over the years. I knew a couple of the directors. That introduced the opportunity to me. What was really interesting for me is the company's in a transition, right? It is really working very hard to not just meet the market, but to get ahead of the market as there's a lot of market dislocation out there. The demands on security companies has never been higher.
You know, we'll talk about AI and all the good things it's doing in our business. Unfortunately, it's doing a lot of bad things in terms of adversaries. Rapid7 is extremely focused on how we get ahead of that, you know, get ahead of those attacks on our customers and on others, because we recognize that that's incredibly important to the customers we have. It's almost something that others just cannot keep up with, other, you know, the individual companies or some of the competition. That's a unique opportunity for us to take a company that has a tremendous customer base and capitalize on this next leg of the journey. I found that very exciting.
Great. We've already seen the prudent decision, at least in my view, to move ARR guidance to quarterly. You've gotten to sort of take a look now, you know, take that experience that you had, previously, take a look at what's going on, under the covers at Rapid7. Any other adjustments? Maybe talk about, you know, sort of that adjustment in the first place.
Sure
Anything else that you're seeing for opportunities.
Yeah. You know, on the kind of the first order of the business walking in the door was to make sure, you know, to ask a million questions, which, you know, my apologies to Sunil and the team. To really dig into our models, to make sure I understood the models, to make sure that we would have confidence in the guidance that we would be giving, but also to make sure we're really understanding the business to the best way we can, to bring insight to ourselves and how we give guidance. You know, we're here to be operators, right?
That's the number one role that we are hired into and how the finance team can engage with the rest of the organization, whether it's bringing insights into the organization from the data we see, leading projects, leading transformation projects, really digging in deep across the organization, and adding financial discipline to all of those questions. You know, ROI comes up a lot on investments. Also just how can we do better? How can we be more helpful? That is really the first 90 days, I would say, has been just heavily skewed towards getting that operational baseline, working with the team, and then making sure we can differentiate the value within the organization.
I'm gonna ask one more and then I'll pause for questions. I think, you know, one of the key opportunities, at least for investors and for the stock, is the potential to stabilize and ultimately accelerate growth.
Yeah.
The growth algorithm, you know, used to be a little bit easier to understand in the old VM days. It was kind of a, you know, ARR per customer, and new customer growth. You kind of, you know, take those two functions and build up to a growth profile that historically was in, you know, the double digits. The business has changed obviously since then, larger portion of detection and response. Maybe just update us on how you think about the growth algorithm and ultimate growth opportunity for Rapid7 over time.
Yeah. Sunil can jump in here as well. I think the first and foremost is on the detection and response side of the business, that's a market that's growing. There's a number of competitors there, but there's also, we think we can add a lot to that market. We think we can take share in that market in the coming years through the investments we're making, through the demands to keep up in that space, right? There's just so much demand to be the provider who can receive alerts from a broad array of you know, risks out there, whether they're custom, whether they're other security providers. That's just extremely hard to do to receive all those alerts and then make sense of them.
We think that's a winning strategy that allows us to take market share on that side of the business. I think the other side of the equation is on the Exposure Management side. The investments we're making and the upgrades we're bringing to our existing customers, we think that is gonna, you know, help that business stabilize, and indeed, we would love to see that get back to growth as well. You know, at some level. The original model hasn't changed as much, but there's this big shift on the D&R side, and then the opportunity for us is there is that opportunity. The people who do this well will be able to take market share.
Yep. Any questions so far? Quiet crowd. I'll keep going, but please feel free to raise your hand if something comes up. You, Rafe, you mentioned just in that answer, detection and response and how that's different and your intent to take market share. We, you know, historically have thought of Rapid7 in the VM days as Rapid7 Qualys Tenable, right?
Mm-hmm.
That was the kind of the competitive set for core vulnerability management. Maybe just update us on what it looks like in detection and response, what the competitive environment looks like, who the main competitors are, and double-click on your competitive advantage there?
Sure. Well, I think first and foremost, there's a number of providers out there who they monitor their own equipment, right? You know, they, like, they provide detection response, but only for their own branded products that they sell.
Mm-hmm.
There's quite a wide array of them. One of the first things that's a big advantage to us is we are going to be, we do now and we're continuing to be able to take alerts not just from our own solutions, but from this broad array of solutions, right? I think that's probably the single biggest category of competitors out there is people managing just their own business, which very few of our customers or the customers out there buy everything from just one provider, right? You see that with the work we're doing with Microsoft. You see this with all the alerts we're taking in. One of the big pressure points for us is, for a lot of our customers, how do we take in alerts from customized solutions that larger companies have made?
That's an opportunity we think we can close as we go forward. That's probably the single biggest competitor, you know, across the board. There's others like the Arctic Wolf that have their place, that play in different parts of the market that are in the spot. You know, I just think we are in this unique position with, you know, larger accounts, good commercial base of accounts, and the capital and the data to invest to be able to open up that aperture of the services we can provide will be the differentiator over time.
Yeah. I think we're applying kind of our AI roadmap and the capabilities that we're building to really kind of drive that further differentiation and value proposition in the market. You know, MDR in general has been a very fragmented space for quite some period of time. I think that's where. You know, although we've seen a little bit of deceleration there, we've really become, over the past five to seven years, one of the more scaled players there. First and foremost, I think the scale element puts us in a strong position and benefits us relative to what is a long tail of a fragmented space. We've got the capability, the capacity, and the innovation mindset to continue to elevate and iterate on that.
I think one of the other things that we're seeing, and you see this if you look at kind of the way that industry, you know, analysts and, and the research is framing it, is that, you know, one thing that's clear is the analysts largely agree that exposure and detection are converging, right? If we think about that traditional SecOps platform that we've built over time and brought those things together from that standpoint, as we think about an AI-enabled service, and managed service offering as we go forward, importantly, one of the critical, I think differentiators for us relative to that broader set and the kind of separate sets of competitors we play against, is the ability to bring rich exposure, context, and information into a detection program, right?
Understanding that ultimately, if I have a set of devices in my environment that have a certain vulnerability, and I have the context and the intelligence from my platform, you know, through the Rapid7 Insight Platform, that vulnerability is being exploited in the wild, well, then I know that when I identify an alert around that, I need to elevate the prioritization of that. I need to accelerate the speed to response around that, right? That intelligence of bringing that together, at the very least is the starting point, and the opportunity to then elevate that further is identifying where we have vulnerabilities in our environment, and then going and starting to do proactive response to that, right?
Going and identifying, hey, if I know I have these vulnerabilities, they're live in the wild, you know, am I protected against them? Are there signs of compromise that we can proactively respond to, and not just have to respond to threats that come up? I think that as we continue to build the integrated elements and capabilities associated with that, experience in the platform, that's gonna continue to differentiate us.
Interesting.
You mentioned AI in part of that answer. I know that's a big topic. There's some investor view that, you know, when customers are spending more of their budgets on AI, that is going to cannibalize other areas of spend.
Sure.
I've even heard it on cyber, which doesn't make a ton of sense to me. Maybe just, you know, your observations so far as customers are spending on AI, headwind or tailwind and how you're thinking about it for Rapid7?
Yeah. That's a great question. You know, new spend always, you know, finance people tend to wanna be tight with budgets.
Mm-hmm.
It's their, it's their very nature. What we're seeing though, I think fundamentally, AI gives a tremendous advantage to the attackers out there, right? Their ability to innovate on attacks and attacks at scale should scare the heck out of all of us, right? That's, you know, I think regardless of where you are in the space, I think that's a fundamental truth. I think, you know what, budgets are tight, especially if people are making big investments in new areas. That's just the reality. What we're seeing is how do people keep up with the demands from, you know, to protect themselves from the attackers who have new tools that are really quite extraordinary to be used for bad ends.
Mm-hmm.
Also just the sheer volume, you know, everybody's implementing AI into their solutions. Everybody's implementing new alert opportunities. The question is like if you're running a company out there, how do you possibly keep up with that? You can't build a SOC fast enough or hire enough people quick enough or, you know, do on that side. That's where, you know, like, you know, we wish where everybody had bigger budgets for sure, but fundamentally, that's where a solution like ours can come in and help you address the risk-
Right
... and do something efficiently that you couldn't possibly do yourselves. I think that's, you know, this plays out over time, but that's the space we're in.
Interesting. I wanna shift gears into more kinda nuts and bolts operations of the business. I guess, you know, alongside that question, if you wanted to highlight any key financial metrics since we didn't have a slide or perform a presentation.
Yeah
feel free to do so. Also wanna hear more about your 2026 operational plan. Give us a sense of how you think about the right mix between growth margins and cash flow?
Sure
over the long term.
I think we would start with, we are investing for growth in our business. I think it's, you know, it can be put in that context of we're coming out with product innovations that we think will differentiate us on both the D&R and the Exposure Management side. That's investments that started in 2025, and we talked about this on our most recent earnings call as we gave guidance. You know, we did make some of these investments in, as 2025 went along, so now that we're into Q1 of 2026, year-over-year comparison, you very much see and feel those investments when you look at the bottom line. That's just a reality. One of the things we very much talked about also on the call, though, is we expect margins to improve as the year goes on, especially into the back half of 2026.
We as a team are extraordinarily focused on making sure we finish 2026 with, you know, we're focused on that run rate that will carry into 2027. Now, these investments are doing a number of things. They're helping us develop new products that are in place. They're helping us develop a low-cost development center, which will accelerate in a very efficient way our development going forward. We brought in a new sales leader just a few months before I started, so I don't think he's quite hit six months. You know, he's ramping up. He's making a number of changes to build efficiency into his organization, efficacy and efficiency into his organization, and that's very much on their way. What we're seeing is really the investments that were made at the tail end of 2025 continuing to just play out.
We need to start making sure we're getting that return on them as the year goes along, whether it's in product releases, improved performance on the team, improved efficiency in how we're running the business. That's our overall strategy, if you will, for 2026. Where it shows up in the numbers is you know, We'll see margins improving as the year goes on. I think that's very solid. On a free cash flow basis-
Mm-hmm
we're very focused on free cash flow as a measure that, you know, isn't distracted by accounting and all those other things. You can take that, you know, that we can count on that and focus on a very strong free cash flow quarter. Excuse me, quarter and year, the year is what we gave guidance to. Those, I think, are good solids. What we ultimately want to do is be a balanced grower. Good, you know, we'd like to see growth, we'd like to see growth accelerate, but we know we need to build margins over time, and we know we're gonna be. We're making every effort to start doing that in 2026 and then carry that forward.
Great. You mentioned new sales leadership. Rapid7's been a company that's been very willing to adapt its go-to-market over the years. Maybe just talk about learnings from adjustments over recent years and opportunities moving forward from a go-to-market standpoint.
Yeah. Do you wanna go ahead?
Yeah. No. Like, I think ultimately, you know, Allan's brought in a really deliberate view, around kind of the rigor of which we operate and really kind of elevating. He's come in, he's brought in, he kind of had the opportunity to refresh his leadership staff at the end of last year. That, what that gives us is really a clean start to 2026, right? He came in, brought in some of the right leaders that he felt were gonna be the right team to scale the organization to go forward, really elevate the ways that we go about running our operational motions, I think that's been a great start.
And then ultimately, you know, there's always the various different equations of how we think about enablement, you know, incentive structure, compensation, things like that, and I think he's bringing a really rich, mature mindset to that, but also a lot of great context from his prior lives of deeply understanding the exposure space, deeply understanding the detection and response space, and allowing us to drive greater focus in how we're engaging with customers, being really deliberate about where we're spending our time, where the, you know, the sales organization, the sales teams are spending time, and positioning us to drive better outcomes as a result, as it, as it relates to kind of just the business performance, the dynamics, and how we're efficiently scaling that mechanism over time.
I think that's been a great, you know, Allan's been a great addition to the team. We're continuing to evolve and elevate the leadership staff there and the way that we operate. You know, Rafe, if you wanna speak to anything beyond that.
No, I think The good historical context that there. I think he's off to a very strong start.
Yeah. Is this like remapping accounts, new geography?
Mm.
You know, maybe just a little bit more like.
There's a few things that we've done with, you know, to kick off the year. One, it's just basically good execution, but, you know, comp plan's in hand within those first couple of weeks by sales kickoff. Good sales kickoff, lots and lots of training. Good execution to start the year is very important. Redrafting how we're doing compensation plans to make sure it's very focused on rewarding good behaviors and behaviors that build the business. Made some changes on the channel side that we've done with new channel leadership and also how we're structuring those deals, our arrangements with the channel. All of that, you know, notoriously in cyber, a lot's bought through the channel. Channel pipeline converts better and oftentimes has better margins, right?
That's just fundamentally part of it, Allan's come in, that made a quick assessment, has made changes, we're seeing that just across the organization, some of that playing out.
Is there any, you know, KPIs that you can maybe mention that change? You know, is there more of a focus on growth or more of a focus on, you know?
Well, in Allan's world, it's all growth all the time, right? You know, I mean-
That's what I was hoping you'd say.
Yeah. Yeah. Yeah, that's exactly right. You know, the incentives there are all about new and, you know, new and expansion ARR is really just the in and out measure there.
Mm-hmm.
I would say again, you know, back to those fundamentals that we're focusing through on the, on the finance side, is we have very good and close interaction with the ops team on there. We're constantly reviewing deals to make sure it's informing us and our ability to give guidance, to make sure we have a, you know, a beat on the organization to understand if there's any roadblocks, right? It's just, you know, the these... They're basics, but they're very important basics to making sure we're on that side. Whether it's a renewal account or whether it's a new account, that interaction, and I think, you know, Allan, under his leadership, has been extremely open on that side and we're working together very well as we, as we start March forward, right?
Yeah.
Good execution on these things aren't... There's no magic wand. It's just day in and day out of focus.
Yeah, I think that would go a long way with investor credibility and valuation multiples ultimately follow.
Yeah.
One of the other opportunities for value creation, you mentioned free cash flow, the capital structure. You know, maybe you could just cover the state of the balance sheet.
Sure
cash flow and potential for debt pay down, et cetera.
Yeah. Just to level set with everyone, we do have two convertible bonds that are out there. The first one for $600 million matures in March of 2027. you know, in this next.
Mm-hmm
print, everything will be moving to current on that liability.
We'll have you back next year to celebrate.
Yeah. Exactly right. You know, that is that bond's out there. That's obviously a key focus. We currently have more than that cash available to us, cash and investments.
Mm.
You know, we, some of those investments as of 12/31 were in long term. They're all set to mature, you know, within the year, so that'll all become in current. You know, from a, just a basic math perspective, we have the cash on hand that will be able to satisfy that bond. We have, you know, we guided $125 million-$135 million on the free cash flow for this year. Again, good, strong free cash flow to take care of that. The first takeaway is we have this responsibility to take care of the debt. Then there's, beyond that, we've got to make sure we have cash to invest into the business, cash for a rainy day as the world is, a complicated place right now. We'll have that cash on hand.
You know, when we say invest into the business, really you need some capital on hand to make sure, you know, if there's a tuck-in acquisition or something that comes along like that, you know, we're very focused on technology and technology teams if, you know, as we look through that aperture. We wanna make sure we have that flexibility. Those kind of one, two, three points of the debt, the security of the business, and, you know, opportunistic capital to take advantage of a tuck-in acquisition, that's how we're really marching forward and thinking about the balance sheet.
Okay. Over the years we've seen investors make the case to potentially unlock value via sum- of- the- parts analysis on Rapid7.
Mm.
We've got, you know, kind of these, two different businesses. Maybe just talk about the synergies between Exposure Management with higher growing, Detection and Response side and how you and the board assess whether it makes sense to keep these together, separate them.
Yeah
et cetera.
Well, I think, and Sunil, feel free to jump in, but it starts with, you know, our detection and response business grew out of taking care of our own customers on the vulnerability management side of the house. There is, you know, we've expanded beyond that, and as I mentioned, now we, you know, we're very much focused on the D&R side, going well beyond our own offerings. It does speak to that fundamental offering, that vulnerability management and Exposure Management customers are more and more needing of a Managed Detection and Response solution. We think there is synergy there just from the customers and the customer challenges or the challenges they're facing in their business. I would begin right there.
We also know that even in our own customer bases, try as we might to the contrary, they have other vendors in their solutions that's adding that complexity. Again, if we could leverage our own customers, now we can go to them more and more and say, "You know, it doesn't just begin and end with us. We can open that up, and we can take this work off your plate, and we can frankly do it at, with a really high efficacy," that's a successful path. You know, beyond that, you know, like ultimately, yes, one can debate how you wanna go at on, you know, whether they're separate businesses or not. We actually, you know, tend to see them as quite complementary right now.
Mm-hmm. Sunil, you've been on the Investor side-
Mm-hmm
in Investors' shoes, before. I guess, maybe just taking that.
Mm
what do you think, you know, investors maybe should focus on a little bit more or might be missing or maybe misunderstood? You know, what would be kinda your message for those sitting in that seat?
Yeah. Look, I mean, I think first thing is I would acknowledge, like, we are working through that transformation and transition of the business. I think for, from our standpoint as we look at where we sit today, a lot of that work has been done, which is great. You know, we've really kind of invested, as Rafe talked about, you know, 2025 was really a year of investment in the business to kinda set the foundation, both operationally as we scale things like our India capability center. Also, from an innovation product standpoint to really accelerate the opportunity to drive value with things like D&R by opening up the aperture beyond, let's just say first party native alert to third party alerts and expanding the capacity to do more monitoring of a customer's environment.
I think where we are today is we've put in a lot of the work, a lot of the investment towards that transformation that we're driving the business. You know, now we're kinda getting to that next step of obviously we've brought in a lot of great new leaders, Rafe, Allan, and others, to really kinda drive that next leg of innovation and growth in the business.
Obviously, you know, we have a core strategy around leveraging AI and applying that to now how we take the capabilities, the investments, the feature sets that we've put in, and really be able to deliver better efficacy, better efficiency, and better outcomes to customers by driving that kinda next leg of the value proposition from a capability standpoint, and ultimately that being the lever that allows us to really achieve this sorta vision around an AI powered managed service provider and cybersecurity that positions us to re-accelerate growth in the business and do so while scaling profitability over time. I think for us, you know, we're kind of right in that spot where we've done a lot of the hard work.
We've got work to continue to do, but we're on that journey where now we can really drive that final piece of the transformation. As we look forward, you know, our aim and our objective is to really see that reflect itself in the financial performance of the business.
That's great. Rafe, I'm gonna leave the final word with you. That was a great summary to follow up with, but, you know, what would you like to leave investors with?
Well, I think, you know, it's kinda continuing on that theme. I mean, at some fundamental level, the fact that we're going through this and we had really strong cash flow last year, we've guided to even with these transitions and we're going through these investments, we're talking about a number where free cash flow at the midpoint of the range is flat year-over-year, right? You know, you can see this business while we're making these investments, while we're kind of taking on new market opportunities, we're delivering that bottom line in the simplest measure we can give you, which is free cash flow. That, you know, that's part of why I came here, that gives us that confidence to say we have a very strong foundation. We're taking risks off the table in terms of our debt.
We're helping people get their arms around that, and, you know, I think that coupled with the fruits of these investments that have been going on the last, you know, year or so, I think that sets us up in a, in a good way over the, over the coming years.
That's great. Rafe, Sunil, thank you so much. Everybody, let's go eat.
All right. Thank you so much.