Well, good morning, everyone. I am Rob Owens. I head up the technology research group at Piper and cover cybersecurity and infrastructure software. Very pleased to, after all these years, see Rafe again, but to be having a discussion with Rafe Brown, current CFO of Rapid7.
Thank you.
Nice to see you. Welcome.
Good to see you. Thank you all.
Yeah. At a high level, a lot of changes at Rapid7 with senior management. Maybe just take us through some of the different logistics, a lot of the changes, and then what coaxed you to
Sure.
to come to the company.
Yeah. I joined the company in December of last year, so I am now up over the nine-month hurdle. But essentially out of the top management layer, there has been almost complete turnover just in the last few months. Whether it was Allan Peters joining in October of last year. On June 1, we got a new CEO and a new Chief Technology and Product Officer. Quite literally out of the top five executives on the team, our longest-tenured person is right now the head of HR, who has been there a year and a half. So, it really speaks to a lot of change. I really believe it speaks to the commitment of the organization to really transform the next leg of the journey, and I think that is a big piece of it.
Corey Thomas, who has been the CEO for a number of years, is our Executive Chairman, so we do have that continuity element, as Corey still is active in the organization and part of it. Obviously with that many new executives and the path underway, there is a lot of change going on.
You're no stranger to the Boston area. You're no stranger to being a public company CFO. What compelled you most to come over?
Part of it is really that. Rapid7 had great history and had a very high stock price for a long time.
It did.
That was dislocated over the last few years. I looked at it as this opportunity of coming to an organization where big change was needed, but an organization that was determined to make the big changes to go on that next leg of the journey. I think that's what's really exciting for us. There's certainly stages of any kind of redirection like that, but there were some of them that were just glaringly obvious. I came in for Corey hired me, and he laid out a path that was determined to make some of those big changes, whether it was changes we need to do on the product side and the technology side, changes we need to do to the expense structure.
He had hired a new leader on the go-to-market side who was, at the time I was interviewing, was just a couple of months into this job role, but who was already very actively engaged and could lay out a real strong path of how we could sharpen our go-to-market while we're still building out some of these other legs of the stool. I just like the fact that the company, it had its history. It has over $800 million of ARR. It has all those kind of advantages, but was looking very clearly at the challenge ahead and willing to make the tough choices to get that done.
Company at reasonable scale. Ironically, we haven't had that many companies in cyber achieve $1 billion a year in ARR, number one. But you mentioned big changes. Big changes to go to market, big changes from a product standpoint. There's a lot of change at a very interesting time in cyber.
Sure.
Let's focus on that change and maybe what was required most, in your opinion.
Yeah. I'm sure we'll get into more of this. If you think about our business, we really started talking about it with investors as our core business versus some non-core elements of it. Just zeroing in on the core, which is over 80% of our business. Our core business consists of our D&R business, detection and response business, and our exposure management business, okay? The changes that are needed fundamentally have been making sure we're investing in those solutions and having that focus. I think that's one of the things we've really worked hard on, making sure we're clear of who we want to be as an organization, where those investment dollars are going. When I say that, I really mean going into the product. We're big believers that technology is going to drive the difference in our outcomes down the road.
But what that took was having that discussion that ultimately manifested ourselves just 2 quarters away of starting to communicate around what our core is doing. There's very big and exciting changes into our core products and making sure that we're building world-class products that can really differentiate. What I think has been very exciting is over these 9 months, a lot's happened in the cyber world with the frontier models and their work they're doing. We actually think it's going to be a benefit for our core solutions. If you think about it, this is a finance guy describing this, so it's probably too simplistically, but the exposure management is dealing with all the exposures in a business, finding all the things that need to be upgraded and patched.
Well, we all know that the frontier models are now coming in and finding more vulnerabilities than ever before. Like that part of the business of people going out and hunting vulnerabilities of the industry, that's just on fire, right? I was reading something, Microsoft just came out with a new list of patches, and there was over 900 of them. It's just extraordinary. Well, our customers have to go figure out which of those 900 apply. That's like multitudes more than they've had to deal with. So the exposure management business is on fire. At the same time as the bad actors now have these lists to exploit and the tools, and you need the detection and response. So we're sitting here at the midst of knowing that exposure management and D&R are good businesses by themselves, but looking at a world where they become that end-to-end coverage.
The end-to-end ability to help our customers from taking an exposure to dealing with the attacks. That time space is disappearing, and that need's disappearing. Which puts us in this great position of being one of the few vendors that has both sides of the formula.
Yeah.
Needing to make technology advancements on our own, but I think that's a great opportunity, and I think that's what's exciting about what we are, but it's also the work that we need to do to take advantage of that.
Sure. I want to build on something you said relative to end-to-end.
Yeah.
Because Rapid7 started as a mid-market velocity play inside sales that then Corey built out.
Yeah.
Once he took the helm, it was always a company that sold into call —it was resource-starved types of companies that might have a few IT guys.
Yeah.
Not huge budgets. So that concept of managed services always kind of came up and went away.
Sure.
and came up and went away. We are now at a point, I think, just from a technology curve standpoint, where that mid-market customer and low-end enterprise
Yeah.
however you want to characterize it, but probably needs more help than ever in terms of time of exposure and understanding to response and actually patching or reconfiguring or however we are thinking about it from the other end. How much is the managed services proposition really coming into play here? I always felt like before Rapid7 did not embrace it as much as it needed to.
Yeah.
Now it feels like given where we are at in this point in history.
More important
it needs to be more important than ever.
Yeah, I think that's exactly right. One of the tensions for a room like this is we know our customers need service, but we need to deliver that with a software-like margin. That's one of the mantras we have internally always w e have to figure out how to do that. At the end of the day, when an organization is under attack, they need security expertise. A lot of time, that needs to come in the form of a human who's experienced and knows how to manage them through that. What we need to be able to do, though, is also provide that at a good margin is the finance side of it. But you also think about it as this world has changed, the number of alerts is just skyrocketing.
The infrastructure, if you're a commercial company or you're a manufacturing organization that's quite large, a re examples of organizations where we do really well from a sales perspective. You have world-class enterprise needs. You can't have your business shut down any more than anybody else, but that's not your expertise. That's where you get with a company like us. What we're doing and one of the first very visible steps of it is we acquired a company called Kenzo Security that, overly simplifying again, helps gather alerts from a much broader set of equipment and allows you to quickly be able to bring those alerts into your SOC. But the more alerts you bring in, the more alerts you have to monitor.
Humans just can't keep up with that scale, so we're building that technology to, if you will, find all the different alerts, sort out very quickly which alerts go together. One attack can set off alerts all over. You need that centralized, allocated down, and so then you can provide that package to the humans that get involved. Ultimately, we're building that technology that has this broader data view across the organization and the exposures that will hopefully let the machine revolutionize the hard work it is to make sense out of the noise. Yet the humans jump in where it's really needed, where somebody's under attack. That's to your point exactly. You need that combination. You need a service.
That service has to be empowered by AI and technology, but it has to be always set up so that there can be a human that comes in as well. Right now, in our cost structure, and we've talked about this on the call, we have large SOCs that run out there. We made an investment of adding people to it over this last year to make sure that we're providing that service, but we're very well aware that you can't keep adding people to that problem. It's got to be technology with true expertise.
Where would you say you are then on that technology journey to be able to deliver that to end customers? And what are they asking for that Rapid7 might not have?
Right now, we're relatively early stages. We did the Kenzo Security acquisition earlier this year. Right now in our product stack, we have the two separate product stacks, if you will, the exposure management and the D&R. The Kenzo Security solution came in earlier this year. A lot of work's going on there. Dan, who's our new Chief Product and Technology Officer, is investing heavily, really bringing those platforms together, driving that next generation products that we'll hopefully start to see some releases over the course of 2027. That'll be exciting. As we know, software development, it's a continuum as you're on the journey.
We're relatively early in that journey, but I think we're making really great strides, and if I looked at our organization, in nine months, the amount of focus, the sharpness, whether it's on the product side, whether it's on the customer success side, it's just night and day crispness in that execution, which is Corey's strategy and now Wael's strategy, our new CEO. That's very exciting. The reality is all great things take time to come. The bad things seem to show up right away first in life. But we're on that continuum, and I think we're going to start to see release after release over the next few quarters that is going to be quite exciting.
No, that's great. Okay, so new CFO walking in the door nine months in, third restructuring, I think, in three years. Not only from a disruptive element, but as you came in, what needed to be changed from your perspective? Where was the low-hanging fruit?
Yeah.
How does this position Rapid7 to grow from here?
Sure. I think one of the first priorities I had that came up in every interview with everyone across the board is we had to get much more control about our ability to guide publicly but to guide internally as well, to really double down on how we're laying out our projections and our modeling for the organization. So we took that very seriously, and we continue to. I think we've made good progress there. I certainly don't want to jinx myself, but again, that's that readiness of an organization who had frankly had some challenges on that front in the quarters leading up to it. I had to make sure the organization was ready to deal with the analysis, the reality, the giving good guidance, the whole shebang, and what that means. So we took that on priority one.
I think the next version of that is making sure we're able to do that deeper level dive, really zeroing in on how the different products are performing, contributions by product, really getting that granular look that is all part of this broader situation as we're going forward of the prioritization to be able to make sure we know how to prioritize on what products, on what go-to-market strategies, and how to bring that together. I think that has been a real tremendous piece. Then lastly, and this speaks to when you go into an organization that's had restructurings in the past, and then a lot of those costs came back. There was a restructuring in 2023. You look at the financials, all those costs came back. So we have to look at it, well, why was that?
What didn't we do, or what should we have done, or how do we do it different this time? I think that's the exercise that we spent a lot of time on, of making sure that, yes, we need to do a restructuring. We got to watch the bottom line, but we also have to fund growth. I often say the Rule of 40, simple math, but we all know you get a lot more credit at the top line than the bottom. We have to do both. We have to be a balanced grower, and that's that determination of showing the value on the bottom side while re-accelerating the top. We've been able to dive in there, have those tough conversations but also really flex up on. For example, it's not as simple as taking costs out of a SOC.
You still have to provide great service to your customers, or you're going to get in trouble. What are we going to do different on the technology side? What are we going to do in our customer success organization to make sure we're maximizing the dollars and ultimately taking great care of our customers regardless of the cost structure? Then take care of your customers and then make sure you're meeting your margin goals.
You mentioned a couple of times the managed service elements, and historically, you've had big margin differentials between a managed service business
Yeah.
and a traditional product company. SaaS kind of put us somewhere in the middle, to be honest.
Correct. Yeah.
from a gross margin perspective. Given we don't really have good examples anymore of companies in the managed service area, how should investors perceive the impact to your model longer term?
Yeah.
And where you find efficiencies. You mentioned some of them around the SOC.
Yeah. 100%. The good news is part of our business is just pure software, so software-like margins are really.
Good margins.
good news when you're selling software, and that's a lot of fun. The work we must do is make sure we're taking care of our customers and we're building the technology in to be able to maximize our cost differences, right? That work of having a layer in our own SOCs that helps deal with an explosion of alerts coming in but be able to rationalize those down, making sure they can be taken care of eventually end-to-end by AI for the lower-risk ones. Think of that as. this is path, this is not where we are, but think about it as the technology should be able to find an attack. They decide that a particular server or a particular server port or a port on the firewall needs to be shut down. It could shut that down while remediation takes place, right?
That's that kind of stuff right now that humans are doing all of that. That's just one example, but there has to be an incredible technology layer that sets up the humans to focus on where only humans can play.
If you don't do that, you do have this problem of you've just thrown a bunch of humans at it, and there's just no other way to get there. That is going to break a lot of traditional outsourced SOC players. There's just no way to provide the protection our customers need and deserve in a world with the threats landscape changing so much unless you have that great technology layer. That's, I think, ultimately for us and companies like us that have the resources to invest in it, that's going to be an opportunity to consolidate what's. You get past the big players in MDR very quickly, and you get into this long list. I think that's going to be a real challenge for some companies, but w e're well-positioned to differentiate.
You touched earlier on core versus non-core.
Yeah.
You can drill down into the two.
Yeah.
What is happening with the non-core component? Because if we look at your ARR, it is
Yeah.
flattened down at this point.
Yeah.
Obviously, we've got some mixed stuff happening in there.
Yeah, that's exactly right. Again, core, over 80% of our business, and then we have non-core. Now, to be 100% clear, non-core is not just one thing. There's a number of different products.
Right
solutions in there. The number one question we get in 101s is, "Well, why don't you get rid of it really quickly?" As a finance guy, you're thinking, great idea. We all get to that.
Never listen to the finance guys.
Yeah. The whole company knows that at our organization. The reality is like this: now that we've gotten this crisp focus on what we are going to be in the future on our core solutions, now we can look at our non-core. What we're having to do is go product by product and look at, first of all, the reality of a lot of our customers have a core solution and maybe have a non-core standalone solution. You have to deal with that, right? It takes time to make sure you're going to give your customers the experience they deserve. We're having to go product by product and lay out our strategy, and is it, do we quit? Do we deprioritize selling it? Do you end of life a product?
Do you sell the product, or do you realize that what you really need is to take that functionality, build it into the next generation of core, and create an upgrade path? It is more complicated than one. It's complicated enough this problem's not going to go away in the next 90 days by any stretch of the imagination. It means we have to lay this out. We have to communicate clearly to investors, watch core, and see how core develops over the next few quarters. Likewise, make sure we're drilling in and once something's in non-core, we owe an affirmative answer to ourselves and to the rest of our investors about what we're doing there.
I think one of the things is core is growing and non-core is shrinking, so that's going to naturally help the overall financials, but we're going to have to make some tough decisions and tough investments on how we bring some of those customers over into core application. There is a good opportunity for that, but it's not an easy opportunity.
Right
Or else they would've already upgraded, right? There are many cases where there's functionality that augments our experience on the core side that is in some of these standalone solutions. So there is an opportunity to hopefully upgrade some of those customers and do things like that. But it is going to take us several quarters to work our way through and be able to really be crisp on exactly what to expect on the non-core side.
To that end, it's probably a 2027 event where we start to get a little bit more—
I think we'll have more visibility over the course of—
Definitely more visibility over the course of 2027. You can give investors maybe a little bit better guidebook relative to how those things are transpiring.
Yes, that's exactly right. I think again, one of my jobs is to, while you're going through, frankly, a rebuild in many ways of a lot of the ways we've been communicating and talking to the street, we have to be very clear to take people on the journey with us. We're trying our best to do that with our core, non-core designation and adding that color each quarter.
You mentioned the potential catalysts coming from the frontier models, just in terms of vulnerability discovery. Yet at the same time, you see Defense Factory and other things that a former cybersecurity analyst from years ago who is now the CFO of one of those companies is talking about this autonomous remediation cycle.
Yeah.
How do you think about competition moving forward, and where should investors kind of hang their hat on the defensibility?
Yeah.
of a Rapid7 story longer term?
As noted earlier, first, the frontier models have made certain parts of the cycle much It is just exploded and it is incredibly quick. The bad actors can leverage that, too. So the timeframes in our business of being able to help our customers have just shrunk incredibly.
Yeah.
It used to be exposures might be noted, and they'd be out there sometimes for years before there was a known exploitation.
Right.
We anticipate that that is disappearing. This is where I always go; our biggest competitor is the bad actor, right? Now, there are financial competitors, and that's why we're here today. I think it's, first of all, there's going to be very few companies who are going to be able to go on that journey. We're one of them, 100%. I think we can make those investments to compete in that space, and that's going to create some consolidation opportunities. I think from an investor's perspective, one of the things that's very attractive about Rapid7 is there's competitors out there that are in exposure management, and we have competitors in D&R, but there's very few that have that end -to -end, who own both. I think that's a unique perspective for us.
We think as we bring these technologies together and bring the data underneath that together, is going to add nuance and detail to our visibility about the nature of attacks, the nature of exposures. That's going to add a tremendous amount of color to our ability to deal with all the noise that comes with all of this and help our customers very quickly ascertain when they're under attack, what it is, how to remediate both short-term remediation, longer-term remediation. That is just incredibly important. All the while having to deal with just this onslaught of some fundamental basis. If you're a security professional, you have just an avalanche of vulnerabilities you need to continue to deal with in that process.
We're one of the few providers that's going to be able to help you right from that vulnerability all the way to a response to an attack and be able to drive that. I think that's a unique position for us.
We're not alone on that journey, right? The competition is always fierce, but the good news is that competition between the players is what actually helps our customers, the users out there over the world defend themselves against the real adversaries, which are the bad actors.
Got time for one or two questions. Sure, Ethan.
Yeah. Thank you. The biggest thing on the go-to-market that we've been really focused on, and Allan's done a great job on this, is really refining our view of our ICP, our ideal customer profile, and refine it and focus on it and take our resources and put them all in that area. I think that's something that's been quite attractive. We've noted the last couple of calls are the number of reps we actually are seeing productivity increases on a per-rate basis two quarters in a row, right? Allan doesn't let me forget that, of course. That's just good execution with the resources we have. So we're not throwing sales dollars at trying to get growth going. We're trying to throw intelligence and good execution. Allan came in in October. He'd already hired a bunch of his new leaders in before SKO.
We got comp plans out there. We got the comp plans out there before we really broke out the core versus non-core designation. When you really look at it, we were already leaning in that way. So crisping that up. I see the not incremental dollars going into sales and market in total, but that again, refocusing, get them around those reps, get those reps productive, and help drive that. I think that's a big part of what we're doing.
So 12 months from now, you're back here in Nashville. We're having this conversation again. And hopefully Wael can be with us at that point. What do you hope to have delivered to investors and hopefully pointing them towards for that next goal?
Absolutely. Look, I think the number one thing investors need to watch with us is first and foremost, watch our product releases over the next year. I think it's going to be quite exciting, and I think that's going to tell a lot of story. If you have good product, we know how to sell it, we know how to deliver it. So that'd be first and foremost. I very much want investors to watch our core growth rates. We've talked about, and we've talked about on the street that it's going to be roughly flat as we're going through this process. But as these new products come out, they're going to be very focused into our core. It's going to be great differentiators. Hopefully, we can start to talk about some good news on that front, right? So that's really that driver.
I think once we get done through that exciting stuff, we can also talk about the resolution of some of the non-core stuff, which is frankly more noise than it is the big driver for the organization, but it is a distraction, and we've got to be clear on that. I think the next four quarters, this time next year, we're going to be on that journey, a lot further down that journey, in my view. I think that will be very exciting for me.
All right. Well, Rafe, thank you very much.
My pleasure.
Thank you, everybody.
Thank you all.
That's great. Thank you