Rapid7 Inc (RPD) 2018 Q2 法說會逐字稿

Good day, ladies and gentlemen, and welcome to the Second Quarter 2018 Rapid7 Earnings Conference Call. (Operator Instructions) And as a reminder, this conference is being recorded.

I would now like to introduce your host for today's conference, Mr. Jeff Bray. Sir, you may begin.

Thank you, operator. Good afternoon, everyone. We appreciate you joining us to discuss Rapid7's Q2 2018 financial and operating results in addition to our financial outlook for the third quarter and full fiscal year 2018.

I'm Jeff Bray, VP of Investor Relations, and I'm here today with Corey Thomas, our President and CEO; and Jeff Kalowski, our CFO. We distributed our Q2 2018 earnings press release over the wire and it is now posted on our website at investors.rapid7.com. We have also posted our updated company presentation and financial metrics file on our Investor Relations website, which includes additional information to help explain the impact of shifting to 606 on our Q2 financials. This call is being webcast and can be accessed at investors.rapid7.com. The webcast of this call will be archived, and a telephone replay will be available on our website until August 13, 2018.

We would like to bring the following to your attention. The date of this call is August 6, 2018.

The discussion today contains forward-looking statements about events and circumstances that have not yet occurred, including, without limitations, statements regarding our objectives for future operations and future financial and business performance. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Statements containing the words such as anticipate, believe, continue, estimate, expect, intend, may, will and other similar statements are intended to identify such forward-looking statements. Actual outcomes and results may differ materially from the expectations contained in these statements due to a number of risks and uncertainties, including those contained in the Risk Factors section of our most recent quarterly report on Form 10-Q filed with the Securities and Exchange Commission on May 9, 2018, and subsequent reports that we file with the Securities and Exchange Commission. The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and reported results should not be considered as an indication of future performance.

Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by applicable law. On this call, we'll provide and talk about our results using non-GAAP financial measures and provide non-GAAP guidance, unless otherwise stated, for purposes of comparability, we'll be using -- presenting results in accordance with ASC 605 in addition to ASC 606. We believe that the use of these non-GAAP financial measures provides an additional tool for investors to use in understanding company performance and trends, but note that the presentation of non-GAAP financial information is not meant to be considered in isolation or as a substitute for the directly comparable financial measures prepared in accordance with GAAP. We provided a reconciliation of the historical non-GAAP financial measures to the most comparable GAAP measures in the financial statement tables included in the press release issued today announcing our results. The press release announcing our financial results is available on our website at investors.rapid7.com. At times in our prepared comments or in our responses to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be onetime in nature, and we may or may not provide an update in the future on these metrics.

With that, I'd like to turn the call over to Corey. Corey?

Thank you, Jeff, and good afternoon, everyone. Thank you all for joining us today on our second quarter 2018 earnings call. Rapid7 had a great second quarter with strong performance around the world and across our products. Our cloud-based SecOps solution addressed the fastest-growing markets in security and our shift towards the current revenue is going much better than expected. For the fourth quarter in a row, ARR growth accelerated reaching 44% growth this quarter.

The financial highlights for Q2 2018 were: under ASC 605, recurring revenue grew 43% and total revenue grew 30%. And we made continued progress towards hitting our 2018 and 2019 profitability goals. As a result of our first half performance, along with a solid second half pipeline, we are raising our guidance for the rest of the year highlighted by our new goal for 2018 ARR growth of over 40%.

We have increased confidence in achieving the goals that we outlined at our recent Analyst Day of growing ARR over 30% and revenue over 20% through 2020. Our strong results were driven by continued strong execution across our go-to-market teams, a set of market-leading products, our adoption of an ARR-focused strategy and the recognition by enterprises of the strategic value of our cloud-based SecOps products.

The second quarter was our first full quarter offering all of our products on a subscription basis. And with sales compensation based on ARR, our go-to-market teams have quickly adapted to our new approach and we're beginning to realize the productivity benefits of our corporate focus on recurring revenue.

Looking on our markets. Enterprises are operating in increasingly complex IT environments and yet they have not focused on the core maintenance and management of their technology. Security teams understand that the key question is no longer, "Am I vulnerable?" But rather now, "How vulnerable am I?" And no longer, "Am I compromised?" But "How and when was I compromised, and how quickly can I remediate?" More enterprises understand that the first step to managing these risk is to gain visibility into their environment while having strong analytic solutions to help them set their priorities for remediation. However, most security IT and DevOps teams still find themselves operating in silos, struggling to work together. This misalignment not only results in poor security practices, but it also slows down the organization's ability to innovate. SecOps is the practice of aligning security, IT and DevOps teams through a shared set of data and tools. Shared visibility, supported by analytics and automation creates a common language to connect disparate teams, break down barriers and ultimately accelerates innovation.

The Rapid7 Insight platform unifies data collection and delivers visibility, analytics and automation needed to power a well-managed SecOps program. Rapid7 SecOps solutions that are easy to install and easy to use are resonating with our customers, who are increasingly viewing these solutions as strategic to their success, as evidenced by our increasing cloud-based platform penetration. But just providing visibility and analytics is no longer enough. Even the most efficient security teams are still overwhelmed with manual and mundane tasks required to protect their IT and development environments. That's why we're excited for the upcoming launch of the next product on our Insight platform, which will be the evolution of Komand, our security orchestration and automation solution.

We acquired Komand last year to add another easy-to-install, easy-to-use solution to the security teams' toolbox. And so far, customer response to Komand has been enthusiastic. Komand is designed to enable customers to quickly create and implement workflows that can dramatically improve the efficiency of their security and IT teams.

Later this year, we will launch the Insight version of Komand, both as a feature of our core Insight solutions and as a standalone Insight product, which we believe will further differentiate Rapid7's set of cloud-based SecOps solutions.

Our new automation product will join a portfolio of cloud-based SecOps solutions that have been recognized as leaders and visionaries, all providing visibility, analytics and now automation on a shared platform that help make our customers more secure and more effective.

Rapid7 has 3 major growth engines on our platform. InsightVM recognized as the future of vulnerability management by Forrester; InsightIDR, a UBA-powered cloud native SIEM recognized as the visionary with the highest ability to execute by Gartner; and InsightAppSec, the future of cloud-based application security testing, which is rapidly expanding as a key part of our highly-rated Dynamic Application Security Testing portfolio as rated by Gartner.

Now let's review the second quarter by looking at our 2018 goals. Our first goal is to deliver ARR growth of at least 30%. We're focusing on ARR because it is a good indicator of how quickly our high quality recurring revenue is growing. It is a more useful metric than billings, and ARR is the primary metric we use to manage the business.

This quarter, ARR growth accelerated to 44%, and we are raising our guidance for 2018 ARR growth to over 40% as our transition to a recurring revenue model is ahead of plan. ARR growth is being supported by products that address the fastest-growing markets of cybersecurity, a shift from perpetual to subscription across our products and the strong performance of our go-to-market teams, who are quickly transitioning to selling based on ARR.

Earlier in 2018, we efficiently shifted all of our products to subscription pricing, and in Q2, we saw a strong shift towards SaaS and subscription bookings. Our customers have quickly embraced the simplicity and ease of subscription pricing and continue to migrate to our cloud-based solutions with platform customers pulling over 60% year-over-year and about 45% of our customers now using one of our Insight platform solutions.

With our new bookings generating more recurring revenue, we saw strong growth in ARR per customer, increasing 31% year-over-year to over $27,000 per customer. This increase is being driven by higher quality, new customer addition, as well as ongoing growth in both upsells and cross-sells. This has resulted in a higher mix shift of subscription bookings, away from services, further increasing our confidence in our mid- and long-term outlook.

Our second goal is to leverage our SecOps portfolio to drive new customer growth, upselling and cross-selling. We grew our customer base 10% year-over-year with even faster growth of our SecOps customers, but with deceleration in our services-only customers. With higher ARR per new customer, we believe these relationships will drive higher lifetime value. One of our new customers is a large private software company, where we displaced a competitor that was struggling to provide visibility into the customers' AWS environment.

Rapid7 has expertise in working with major cloud providers, including AWS and Azure. InsightVM gives customers broad visibility into cloud assets as well as great extensibility with our open APIs.

Our land-and-expand remained strong, and we maintain a high renewal rate at 122%. One of the main drivers of our strong renewal rate is our customers coming back to add more coverage to their environment to improve their visibility. This quarter, we had a Fortune 500 retail customer that purchased InsightVM last year return to add complete coverage of the environment, providing them comprehensive visibility across their entire store footprint.

On the cross-sell side, a leading national law firm that has been an InsightVM customer, was looking to add security orchestration and automation to their SecOps practice. When we demonstrated how well Komand worked with InsightIDR, the CISO realized that their legacy SIEM was both expensive and difficult to use, generating more false positives than actual information.

The customer was won over by InsightIDR's prebooked dashboards and simple visual search, while Komand's out-of-the-box workflows and code-free automation greatly simplified their detective and responsive effort.

Visibility into application security continues to be a critical need for enterprises, and we had another strong quarter across our application security portfolio. A global consulting firm joined us as a new customer, adding InsightAppSec to cover 100 of their internal applications with an opportunity to expand to cover hundreds more.

Application security has also provided a huge expansion opportunity. As in Q2, a Fortune 100 software company again expanded their AppSpider coverage. And a Global 500 European bank customer added AppSpider to provide visibility into hundreds of their global web applications. This cross-sell deal was also a good example of our solid growth international and long-term opportunities that are still in their early innings. To take further advantage of this opportunity, we recently expanded our Insight platform instances to Canada and Australia providing customers in those regions the ability to better address data governance requirements and the flexibility to keep security data local.

Finally, our third goal to improve profitability. And during the second quarter, we improved our operating loss both sequentially and year-over-year. We continue to expect to generate cash from operations in 2018 and are making progress towards our goal of profitability in 2019. With the success of our subscription transition, we will enter 2019 with more recurring revenue than we originally forecasted, which will help improve the scale of our business and our ability to hit our 2019 targets.

With that, I would like to hand the call over to our CFO, Jeff Kalowski. Jeff?

Thanks, Corey. Before I begin discussing our strong results for the second quarter of 2018, I want to remind everyone that as of January 1, we've adopted ASC 606 on a modified retrospective basis, and therefore, we'll report each quarter's results under both ASC 606 and ASC 605. We've included all of these details in our earnings press release today. When discussing our year-over-year growth rates and other key trends in our business, we will be comparing our results on an ASC 605 basis as we don't have prior year operating results under 606 and a comparison would not be meaningful.

We are pleased with our strong performance in the second quarter, which beat our guidance on all key metrics and was highlighted by accelerating ARR growth of 44%. First, I will briefly discuss our results on an ASC 605 basis. Total revenue for the second quarter of 2018 was $61.6 million, an increase of 30% and ahead of our guidance. Recurring revenue was 77% of total revenue in the second quarter of 2018, up from 70% in 2017 and which is growth of 43%.

Looking at the business geographically. In Q2, North America comprised 84% of revenues growing 29%. Rest of world revenue increased 33% year-over-year and contributed 16% of total revenue in the second quarter. Our rest of world revenue growth continues to be impacted due to a large services deal recognized in Q2 2017, but our ARR growth from outside of North America continues to be very strong.

On an ASC 605 basis, non-GAAP operating loss was $5.7 million, also meaningfully better than our guidance of a loss of $8.7 million to $7.8 million and adjusted EBITDA loss was $3.9 million for the second quarter compared to a loss of $5 million in the prior year period. Our operating margin improved to a loss of 9% from a loss of 13% in the prior year.

Now I'll discuss results on an ASC 606 basis. Total revenue was $58.4 million, above the high end of our guidance with the primary difference between 606 and 605 being lower perpetual revenue due to ASC 606 accounting. Our product revenue was once again driven by strong bookings globally in both VM and IDR with accelerating recurring revenue growth. As we expected, with the shift towards ARR quotas for our sales force, we did see a slowing in professional services bookings and revenues. We expect professional services revenues will be flat to down compared to 2017.

Visibility into our revenue forecast remains very high. Recurring revenue was 79% of total revenue under ASC 606 and 83% of total revenue came from deferred revenue on the balance sheet at the beginning of the quarter. The value of our annualized recurring revenue increased to $198.6 million at the end of the second quarter, a 44% increase year-over-year and an acceleration from 38% growth in Q1, evidence of the strength of our products and the success we're having with our shift to subscription. We now expect ARR growth for the year to be over 40%.

Calculated billings for the second quarter were $64 million. Average contract lengths were 17 months for total billings, down significantly from 23 months in the prior year period and down slightly from 18 months from Q1.

As we said since we launched InsightVM and given the move of our full portfolio from perpetual to subscription, we have expected our customers to shift towards 1-year contracts, and we saw that in Q2. This reinforces our belief that billings are no longer a meaningful comparison to prior periods during this transition as they don't capture the benefit of a higher subscription mix and growth of our annual recurring revenue. While contract lengths will be difficult to forecast during this transition period, we believe it's possible they could shorten further from Q2 levels, and our operating cash flow could be affected. However, we're still forecasting cash from operations to be positive for 2018.

Our customer count increased by 10% year-over-year, and we ended Q2 with more than 7,200 customers globally. As Corey mentioned, we continue to see an improvement in the quality of our customer base, and our ARR per customer increased to over $27,000 or growth of 31%. Overall, we continue to see strong bookings from new customers' upsells and cross-sells.

Our renewal rate was 122% and our expiring revenue renewal rate was 89% in the second quarter.

Turning back to the P&L. Non-GAAP total gross margin for Q2 2018 was 73%, up slightly from Q1. Product non-GAAP gross margin was 78%, down slightly from Q1. And professional services non-GAAP gross margins improved to 38%. During the second quarter, professional services margins benefited from slightly higher utilization compared to Q1. We continue to expect professional services gross margins in the mid-30s for the full year 2018 and for our total gross margin to stay in the low-to mid-70s on both an ASC 605 and ASC 606 basis. For operating expenses, please note that the only difference between 605 and 606 was in the sales and marketing expense, which was $2.8 million lower in 606 due to the impact of deferring sales commissions, which was in line with our guidance.

During the second quarter, sales and marketing decreased to just under 50% of revenues. We realized about a 150 basis points of leverage in sales and marketing year-over-year, with the additional improvement due to the accounting changes affecting revenue and commissions under 606. Given the success of our shift to subscription, we'll continue to make investments into the second half of the year to help drive ARR growth, where we still expect to see leverage from sales and marketing expense for the full year of 2018.

Moving to second quarter operating loss. Non-GAAP operating loss was $6 million, which was well ahead of our guidance of a loss of $9.8 million to $8.4 million and our operating margin improved to negative 10%. Adjusted EBITDA loss in the second quarter was $4.2 million. Non-GAAP net loss per share was $0.13 in Q2 2018, ahead of our guidance. We ended Q2 with cash, cash equivalents and investments of $118.6 million. This compares to $92 million as of December 31, 2017.

Our operating cash flow for Q2 was negative $9.1 million. Year-to-date, cash flow used in operating activities was negative $1.8 million, and as we mentioned earlier, we expect to remain cash positive from operations for 2018. However, we could potentially be down from 2017 due to lower contract [mix].

Moving to our third quarter and full year guidance. As for ARR, given the strong momentum we have built in the first half of 2018 and our strong performance on new bookings and churn in Q2, we're raising our guidance for the full year ARR growth to exceed 40%. For Q3 2018, on an ASC 606 basis, we anticipate total revenue to be in a range of $58.6 million to $60 million. We anticipate non-GAAP operating loss to be in the range of $7.3 million to $5.9 million.

On an ASC 605 basis, we anticipate total revenue to be in the range of $61.7 million to $63.1 million, which equates to year-over-year growth of 22% to 25%. We anticipate non-GAAP operating loss to be in a range of $6.6 million to $5.2 million.

For the full year of 2018, we are raising our total revenue guidance. On an ASC 606 basis, we're raising our guidance for total revenue to be in the range of $237 million to $240 million. We are updating our guidance for non-GAAP operating loss to be in the range of $25 million to $22 million. On an ASC 605 basis, we're raising total revenue to be in the range of $250 million to $253 million, which equates to year-over-year growth of 24% to 26%. We are updating our guidance for non-GAAP operating loss to be in a range of $24.5 million to $21.5 million.

As Corey said, with our increased momentum through 2018, we are in a great position to meet our goal to generate non-GAAP operating profit in 2019, and our goal is to grow revenues by over 20% and ARR by over 30% through 2020. Our full year guidance reflects our increased investment into our sales organization, but we expect to realize leverage from sales expense for the full year 2018.

In conclusion, this was a very strong quarter for Rapid7, driven by the strong momentum in our shift to the cloud and subscription, leading to our raised ARR growth outlook.

With that, we appreciate your time and support. And we'll open the call for any questions. Operator?

(Operator Instructions) And our first question comes from the line of Rob Owens of KeyBanc Capital.

Wanted to just touch on how you've expanded the portfolio and you mentioned this, in a couple of quarters, with all products on a subscription basis. Help me understand what that's doing to your competitive position? And where you're seeing strong new customer acquisition? I'm guessing on the VM side, that's not greenfield. So who and what and where are you displacing your competition at this point? And is it the single VM sale? Or is it more kind of buying into the entire portfolio?

Yes. So it's early days for the overall consolidation, but we are seeing early indicators and evidence around it. And so lots of what I would call are noncompetitive deals are deals, where customers have a great experience on our platform, which is very quickly getting adoption. And I think we shared some of the numbers earlier, but we see out platform very quickly get adoption and when customers have a great experience, when they have other needs, they are quite willing to actually explore the other capabilities that we have on the platform. And while it's early days, we're seeing more than enough evidence that that has a strong value proposition, especially for existing customers. As for the new customer adds and additions, I would say that it's pretty evenly distributed. You see really 2 big areas where we add new customers. One is the VM space and I'll come back to that in a second. And the other area is in the IDR space or the SIEM space with Insight. Both of those are core contributors, which we said before. It was a pleasant surprise for us, that we could actually expand into a new market and have customers that would have prospects that our customers adopting our technologies in those spaces. And that's really a testament not just the platform, but to the technology strategy that we've taken on by actually having best-of-breed technology solutions on a common platform. And I'd emphasize that, again, I think, what's unique is that many times when people try to have a consolidated platform it's one good solution and a bunch of mediocre solutions. We took quite a different approach, is we actually are consolidating on a common platform that adds platform value, but we are designing and have designed all of our solutions to be best-of-breed quality. And I think that gives us a unique advantage there. Specifically, to your question about the vulnerability management market, we still see greenfield opportunity in the mid-market, which continues to actually do an effective job of adding net new customers there. We do see displacements though and customers are looking to upgrade their programs and that displacements is true both in legacy markets, where you actually have traditional VM players that are no longer as active in the market. And we see that with some of our main line competitors, where we see customers looking to upgrade their programs and they really value the investments that we place not just on prioritization, but the investments that they're seeing workflows and integration into their existing infrastructure with our SecOps division. So those are the dynamics that we see. And just to add more commentary around the growth that we saw from ARR last quarter, overall, our products grew quite strongly, but what we saw was that we had extraordinarily healthy growth across all of our product categories.

Great. And then, for a completely unrelated follow-up relative to the mix shift that's occurring more rapidly than you might have assumed initially. Is that a function of how you're incentivizing your sales force? Is that just where customers want to buy, anything to do with the channel on that front? And how's that impact kind of the 2019 targets?

Yes. So one very clear focus is we shifted -- we talked about this before, is we learn from others. One of the benefits of the shift to subscription when we made is that we had the opportunity to learn from others. But we did shift our sales compensation model to be based off ARR. This year was a relatively big change. And I will say there was 2 factors. One is our sales team has done a great job of adopting and moving to ARR. The second thing that's important though is that we have strong customer reception. These things are always harder if you're actually pushing stuff on the customers. And in this case, we're actually having positive customer reception, which has made the transition much smoother than we could have anticipated.

Our next question comes from the line of Saket Kalia of Barclays Bank.

It's Saket Kalia, Barclays. So first, maybe for you Jeff Kalowski, nice acceleration in the ARR. I think that Corey kind of talked about what works from a product perspective. It sounded very much across the board. But maybe from your perspective, if we think about sort of the benefit or the growth in that metric coming from existing customers shifting to SaaS versus kind of the new customers that are adopting SaaS to begin with, how do you think about that dynamic even qualitatively? And how it's helping the ARR number?

Yes. So Saket, first off, as Corey said, we had strong ARR growth across all the product lines. And in particular, we had strong upsells and cross-sells. But if you recall existing customers that were formally Nexpose and then shifted to our SaaS offering, we did not raise the price on their renewal other than on -- at nominal inflationary increase because what we didn't want to do was penalize those customers for shifting to the platform. The motive was shifting to the platform would drive more cross-sell and more upsell. And at our Analyst Day, we showed the examples of where we were on our perpetual product and at the ARR, was in that sort of 40% to 50% range on the ARR piece, that's the annuity going forward. So the existing customers really did not drive the ARR growth. When they convert, they convert at basically their current renewal rate plus an inflationary increase.

Got it. That's super helpful. Maybe for my follow-up for you, Corey. You touched on it a little bit in the prepared remarks around geographic expansion. I think you noted Canada and Australia. Maybe just more strategically, can you talk about how big you think the international business can be for Rapid7 down the road? And whether we're seeing some of the same strategic focus on VM as a spend category internationally as maybe we are seeing here in the U.S.?

No, it's a great question. So if you look at where we are and we have been for a little bit, we're in the 15%, 16-ish percentage range of the international as a percentage of our total our business and we think that has great room to actually grow up over time. I'll tell you, one of the things to keep in mind that has been balancing the scales a little bit and sort of make that growth rate a little bit slower is that we've introduced a lot of new products both our platform and products on our platform over the last 2 years. And one way to think about it is that, traditionally, [actually if you think] -- if you actually introduce it to a single market first and then you expand from there. And so that put a little bit of the weight and the bias to the U.S., for the introduction and then you actually add both territories and localization as you go forward. So we think we have plenty of growth, and it's called the national evolution and that's why you're starting to see the expansion of both new regions around the world that actually have our platform. It has gotten trickier because of the geopolitical issues, where you do need to have emphasis around the world, and we've done an effective job of continuing to add instances around the world, but then also local teams and local support. So we're very, very optimistic that our international and global business will continue to grow in excess of our overall business and that it would actually get to more normative rate as a percentage of total revenue as you go forward. As far as your question about demand, I would say, demand is picking up substantially outside of the U.S., specifically in Europe and in pockets of Asia. We see good health in places like Australia. However, I would say that it still lags the U.S. in terms of the intensity of the spend and the intensity of the focus, which is why we actually see that there’s a growth opportunity. It's an area where you already have market traction, you have market awareness. The regulatory environment is increasing over there and we're seeing increase in both traction and growth and opportunity pipeline. So I think it’s mature and healthy, but it's not quite to the U.S. level both in VM and I'll say broadly in overall security market.

Our next question is from the line of Gur Talpaz of Stifel.

Congrats on the quarter and apologies if there's some background noise here, just at the airport. Corey, if you think about hitting the ARR target for the year, what assumptions are you making that gets you comfortable there with a big bump in the forecast here because if I look at the numbers you're effectively calling for about $30 million plus of net expansion from current levels, it's a pretty big bump from here on out, but you guys sound very, very confident. So can you give us some granularity as to what you kind of assuming with the net assumption or the net focus?

Yes. You can imagine that we actually put a great deal of scrutiny. Whenever we look at any of this things, especially when we raise targets. I would say we were comfortable with it for 2 reasons. One, the easiest thing to look at is, there's really 3 things that go in to it. One is what does your past performance indicate? The second thing is what's your pipeline indicate, because that gives you good visibility into what you see both in the third quarter, but also a pipeline for the fourth quarter and you look at the trends there. And then I'll say one of the most important things that we've really obsessed about as a company is the productivity of our sales reps and our teams, and so how are we doing both retaining and managing the sales team? We continue to have better-than-expected retention of our sales team, the lower attrition of the sales team. We continue to be conservative in our assumptions there. And we're also seeing healthy and strong productivity from the team. And you can imagine that the lower attrition of the sales team is really a testament to the fact that they are not just enjoying the culture and the experience of Rapid7, but they're also effectively able to engage customers and to sell the platform and the suite of products that we have under our subscription basis. And that all contributes to what drives that 40% forecast. Again, past performance, opportunity pipeline and the productivity of our core sales team is the things that we looked at when we look at how we both forecast our business as we go forward.

That's really helpful. And maybe just kind of going a little more high-level here. If you look across the VM world, it kind of feels like a pretty good place to be in security these days. Do you kind of see this as a function of the breach environment, meaning more Ransomware-type breaches, working in your favor? Or do you think we're seeing kind of a broader change in mentality as customers ultimately value these solutions kind of more than they did, perhaps, even a few quarters or years ago?

Yes. I would say that, one of the reason that we've always said that, when you think about security operations in the SecOps, VM was a great core to have is because it is at least half of the overall visibility story that you actually need. One half in the assets, what assets and what the risk and exposure and vulnerability of those assets. The other half the data that talks about what's the activity in the environment and what's happening in the environment. VM has half of the visibility that you actually need to actually run an effective security operation. And so people in the organizations get more focused on how they effectively run their security operations, they become more and more obsessed with visibility and that's why you see the spend not just in VM, but also in [LogIT], SIEM and other technologies that provide visibility. And I will say the whole visibility sector in general is doing quite well these days.

Our next question comes from the line of Matt Hedberg of RBC.

Corey, ARR per customer was impressive. It looks like you're only in the first few evenings there. I think you've said that -- I think your average customer takes about 1.5 solutions, and I believe you said you think you can increase the ARR per customer 7x from here. I guess, first of all, is that 7x assumption based on currently available products? And second, we hear a lot about IDR and VM, but how is InsightOps contributing to that upsell?

Yes. It's a great question. So if you recall at our Analyst Day, we really had 3 categories that we talked about. One is the overall vulnerability and risk management category, which includes the InsightVM and the InsightAppSec and their legacy on-premise components. InsightIDR for the SIEM category. And then we talked about the security, the core operations in the analytics space that included both the Komand and the follow-up to Komand, the cloud-based follow-up to Komand as well as InsightOps. I would say that for our 7x, it includes InsightOps, although we're seeing such material traction on the VM, IDR and AppSec side. That's consuming most of our bandwidth right now. One of the things that you'll see over the coming year is a greater focus and greater resource allocation on both the InsightOps and on the Komand side and the platform version of Komand. And Komand is not built into the model of the multiple that we actually have that we talked about at the Analyst Day. So we see a really strong multiple of ARR available to us. And we see upside to that as we continue to actually invest and launch new things as we go forward.

That's great. And then maybe as a follow-up. You guys have talked about your integration with VM and IDR with Azure. Can you talk a little bit more about what that partnership means? Is there any sort of feedback, beta customer feedback that you can share with us on that particular relationship?

Yes. I'm sorry, Matt, can you just repeat the question one more time?

Yes. Integrating InsightVM and IDR with Azure, I believe, you guys talked about that during the quarter as sort of a new announcement. Just curious on some feedback on that particular integration.

Absolutely. It goes back to the discussion we're having around visibility is that one of the drivers of visibility is that people's teams and resources are constrained, and you can't manage what you can't see. And as IT organizations increasingly adopt more AWS and more Azure, they need the visibility to understand what assets do they have in those environment? What's the vulnerability and risk profile of those environments? And what are the activities? And is it indicators of normal behavior? Or is it an indicator of compromise? One of the investments that we continue to make is how do we actually have best-in-class visibility, both in AWS and in Azure? And both of those are critical environments for us to be able to both assess the asset footprint that organizations have, look at the risk profile, and look at the activity in those environments for indicators of compromise.

Our next question comes from the line of Gregg Moskowitz of Cowen and company.

This is Mike on for Gregg. To start off, this is your first full quarter under what essentially is now a subscription-only model. How has the customer response to the pricing changes been if you look across the U.S., Europe and Asia-Pacific?

Again, it's been much more positive than we anticipated. We're practical about these things. We know that any type of change can have friction. And I would say that we've had a lower share of friction than we expected as we've done the change. I mean -- I think one of the key things to understand about us and our approach is we really focus on sustainability and the core of that is doing things that are going to benefit the customer. And so if you look, we're not about how do we maximize the dollar in the current quarter or near term, we're about how do you have a great customer relationship, deliver great value to the customer and then maximize the overall lifetime value of the relationships that you have with the customers. And so that led us, as Jeff indicated in his comments earlier, to take an approach that was very obsessed about how do we minimize customer friction, not just Rapid7 friction. And, in fact, that's one of the continuing areas of our focus as a business is reducing more and more barriers for our customers and minimizing the overall customer friction. And I think part of the warm reception that we've had to our subscription transition has been customers have recognized that, that is the intent and work with us.

Got it. And as for my follow-up, what are you seeing or hearing as it relates to the SIEM refresh activity?

We continue to see a robust environment. There's really 2 things I talk about in the ARR is that, it's clear that organization are focused on how do they actually shift from just having a SIEM that's really compliant-focused to how do they do great detection? And that's a shift that benefits us because we have been focused about how do you do great detection and we continue to add any compliance oriented capabilities. The detection is the core of what we do. The second thing that's clear is that customers value that we have an economic model that's aligned with the customer. Again, you can't -- just like you can't manage that you can't be, you can't detect where you don't have visibility. And our model that makes it easy for customers to have visibility across their entire platform because our detection is based on an IP model, not a purely storage model, where customers have unpredictable pricing. That's been very, very well received by the market because it allows them to have the confidence that they have the visibility to do the detection that they want, but in a model that fits with their overall growth and objectives.

Our next question comes from the line of Jonathan Ho of William Blair.

I just wanted to start out with Komand. Can you talk a little bit about your expectations around the release? And maybe what are customers sort of looking for just given the demand for increasing automation?

Yes, absolutely. When we see -- the great thing is that, the automation orchestration market or the SOAR market as, Gartner calls it, for security, it is an early-stage market in this incarnation, that it's replacing lots of the manual workflows and lots of the previous technologies that looked at IT and security processes that are there. And the core demand for it is there's just not enough people capacity to do all the work that needs to be done. And by the way, lots of the work is repetitive in orientation and some of our customers tell us it can be quite mundane. So customers have this issue where they're spending a great deal of their bandwidth on things that are mundane and competitive, but yet, they don't have the capacity to truly catch up and make a difference. That's why you see such a heavy customer focus on orchestration and automation. Our focus on the orchestration and automation market is to actually make it a mainstream solution where not just a narrow set of customers, but tens of thousands of customers can receive the benefits of a powerful, but yet simple orchestration and automation solution that allows them to really give a multiplicative effect on their overall technology and security workforce. And that's what we've been building up and that's what we've been extending. It does all types of workflows, whether you're looking about the automating parts of detection, automating parts of remediation, automating parts of containment, automating part of the IT management process related to security. There's lots of prebuilt both integration and workflows that come along today and will come along with our solutions in the future. But our goal really is to drive the productivity of our IT and security teams. And as for the timing, as I said in my prepared remarks, you'll hear more about that in the second half of this year. We have a big focus on that.

Great. And then, just as a follow-up. When we think about sort of the platform adoption that's happening, how often are you seeing customers maybe buy multiple elements to start out with? Is that increasing or about the same? And sort of their willingness to add onto the platform over time? Just wanted to get some maybe qualitative detail on what you're seeing there?

Yes. it's interesting because you saw that our total renewal rate, which includes cross-sell and upsells went up slightly to 122%. What's interesting is we're seeing an overall increase in the ARR per customer transaction that we had in the quarter and that's driven by a couple of things. As customers are wanting more visibility when they start off than they historically have, which is certainly a very positive thing. But it's also customers are starting to look at multiple solutions together and purchasing multiple solutions together. So it's definitely going up. It's going up in noticeable ways. It's just that we have a big customer base that you're looking at there. And so you continue to see ongoing improvement in that, but we've got more than enough positive feedback from customers that our consolidation platform that's based on best-of-breed technology is clearly a value.

Our next question comes from the line of Michael Turits of Raymond James.

Very good strong quarter. Question on the guide. It's a raise for the year and a raise for next quarter, but less so and actually it's pretty much where it was on EBIT EPS, et cetera. So you'll be getting operating leverage year-over-year, but not so much really out of the incremental raise here. So where is that incremental spend? It seems like some of that is certainly coming year-over-year in sales and marketing?

Yes, Michael, great question, and you're absolutely, right. It really comes in 2 areas. One is we got more customer visibility. We realized that we have the capacity to do growth and strong growth that was accretive to our long-term economics, meaning that, we're making investments this year that will grow the customer base, but because we understand the productivity and what it cost to get a customer and the value that customers provide over a longer-term time horizon, we're really investing in both growth and long-term and midterm profitability together. Again, we have a pretty clear line of sight into the overall customer economics. The second thing that I would say, which is it could be a good portion of what we're looking at there is we are having an increased investment in systems. And the reason for that is we have a very, very positive shift to the overall subscription and cloud-based subscription model, and we're really looking forward to think about how do we actually optimize the customer experience next year, but also how do we make sure that we continue to have strong renewal rates, but at the right cost leverage as we go forward, combined with the overall customer experience. So we are investing in our overall systems that are all off the scale because we have the higher confidence in our overall growth profile as we go forward.

Yes, Michael, you're right in that, we did -- we are investing the revenue upside, but I just want to point out that last quarter we were 33%-plus ARR, and we've raised that number to 40%-plus. So that -- those investments will help drive a higher exiting ARR growth than what we were seeing in the previous quarter based on strong demand and pipeline.

Right. And if I could a follow-up. There's been some -- obviously, there's been discussion -- discussing IDR and the SIEM market. Can you talk about the SIEM market from a competitive perspective? Are you seeing all the major SIEM vendors? Are you seeing primarily those who are cloud-based like yourself? How is it shaking up from a segmentation perspective?

Yes. So I would say from what we see in new deals, I mean, they are not sort of like a Rapid7 customers that are just looking to add on SIEM capabilities to the platform, it is across all vendors. And part of the thing to keep in mind that -- is that, we are really the only cloud-based vendor of scale that is focused on security, what the security analytics and SIEM offering. And so the people that we see there is the smartest, of course, there and they have a strong position there, but their cloud solution isn't their default solution and their sales force really isn't optimized around that. And we definitely see some legacy ArcSight and some legacy IBM there, but it's not as strong as it once was. And so that's a good thing for us. And then, there's a bunch of other smaller players in the market that we see occasionally.

Our next question is from the line of Anne Meisner of Susquehanna Financial.

Congrats on the strong quarter, by the way. Corey, you had previously said that your target of growing ARR 30% through 2020 assumed underlying VM growth of 15% and that's the deceleration from what you've previously seen. Also it would represent slower growth than what it looks like the broader VM market is seeing. So would you care to maybe update that assumption now that it looks like your overall ARR number is coming in much stronger than you would have anticipated?

So -- Anne, I did say 15% plus.

Okay. That's fair.

It's clear that we're seeing very strong dynamic in the overall VM market and we think they're sustainable. The main thing I would say the tricky thing about the cost segmentation there is that what we are primarily focused on is both total ARR growth and how do we maximize both the value that we provide to our customers and the customer economics. It's really immaterial to me about which bucket it falls in. So if you look at both lots of our go-to-market strategy and lots of our pricing analysis, it starts with, one, how do we maximize customer value? Two, how do we maximize customer adoption and penetration? And then from that, that really drives how we actually think about our pricing strategy. And our pricing strategy really didn't drive to which buckets things go into. I just want to reiterate that because the VM market is incredibly, incredibly healthy. You have sort of like the 3 major players that all have growth of over 20% and that's really an outcome of the visibility-driven customer demand. As far as what we managed to, though we are managing to how do we maximize both the total ARR and the ARR per customer. And because we have a more fully flush portfolio, we are optimizing around our portfolio pricing and our portfolio go-to-market on our cloud-based platform. And so that is the primary driver that we have there. And so again we are consistent with what our total overall ARR growth rates are. You saw we raised the number for the second half of the year. We're extraordinarily confident about sort of what we committed to for '19 and '20. But we're not going to do the subsegment adjustments at this time because we're really focused on optimizing total customer economics.

Okay. That's fair. And then, maybe just a quick update on the attacker behavior analytics capability that you added back in April. Any impact so far that you can see in terms of customer success stories or win rate?

Absolutely. That was a very, very clear differentiator. Yes, for those of you that may not be aware is that we have the benefit of having extraordinarily talented consulting and cybersecurity adviser team that does everything from forensics to penetration testing to security program development to help organizations build their cybersecurity programs. One of the big initiatives that we actually have is to have that team become more and more strategic over time, really adding more value to our customers. And that's a big part of the reason that you see us focus less on the volume of services deals and more on the quality and the impact of the services that we're having on our customers. We are now able to take the learnings that we have from those customer engagements in aggregate from the talented team that we have. And we're able to include that knowledge in our products that help us do the same type of forensic analysis that we do for our customers to operationalize that in our products that helped our overwhelmed customers, who need some of this deep technical expertise really do a more effective job of finding and detecting threats in their environment. And that's the focus of the attacker behavior analytics. And as far as customer reception, it's been quite positive. Customers have a huge amount of respect for our services team and they were thrilled that we're taking the learnings that we get from those services engagement and productizing those and getting those to our broad customer base.

And our next question comes from the line of Alex Henderson of Needham & Company.

It’s [Daniel Park] on for Alex. So I know recently you announced the integration of the Insight platform with Microsoft Azure. I was just wondering, if you could just possibly expand on some of the details regarding the integration? And if you're seeing additional customers coming onto the platform as a result?

Yes. So the primary focus of the integration is to provide visibility into the Azure environment and also provide essentially the same vulnerability and risk assessment. The one thing about cloud environments, whether it's Azure or AWS, configuration matters a lot more than vulnerability in those environments, so it's about the visibility of what I have, because remember most organizations don't know what they have in their environment. And then, what's the vulnerability state as it's configured in the environment. And that's the ongoing investment that we have in the cloud and that's the investment that we have in Azure as well as monitoring those environments for indicators to protect just like we monitor all aspects of the IP environment, so that's the focus there. As far as the question about the customer demand, I'd say the earliest customer demand that we have is from our existing customers, which our customers -- we have a large base of customers is growing and our customers are like many customers all over the world, they have complex environments that expand their on-premise environments and their cloud environments. And so that's the primary driver that we have there. We have very few customers that are Azure-only. We do have some that are AWS-only, but not that many. Most of our customers have a combination of an on-premise footprint and that could just be their desktop, laptop and other things as well as a SaaS footprint that could be things like your CRM system, their human resources system as well as a cloud footprint that can be represented by the Microsoft Azure or AWS. And so we really see most customers falling into the category of having multiple complex environments that they need to have visibility into -- they need to be able to analyze both the risk and vulnerability profile as well as analyze for the risk of exposure. And then, we're also helping them really drive the work that it takes to remediate and correct those environments through our automation frameworks.

Okay, great. And just as a follow-up. I think in the past you sort of talked about 1.5 solutions per customer. I think at least that was a number in the first quarter of '18. Just wondering if you had any updates on that metric? And if you just talk about how much of the growth is driven by IDR versus Ops versus VM?

That's a great question. The day that we focus on the really show you the value of what we're doing is the ARR per customer, because the whole strategy about having multiple products on a common platform is that we're driving the customer lifetime value, which is what happens when you go from that 1.5 to the roughly 5-plus customers, 5-plus products that we actually have per customer. The reason that we focus less on the products per customer on a quarterly basis, of course, we will give you snapshot periodically, is because it has a numerator-denominator issue, where we're both adding new customers at the same time that we're increasing the number of products per customer. And so there can be some noise there. The thing that really provides the economic value though is how are we doing at growing the ARR per customer and that's what really creates the economic value.

(Operator Instructions) And our next question comes from the line of Melissa Franchi of Morgan Stanley.

Corey or Jeff, actually, you mentioned the percent of revenue that was recurring, but I'm wondering if you could give us the percent that's actually coming from Insights today? And then, I guess, how we should think about the margin profile for Insights versus sort of the traditional term and maintenance, particularly around gross margins?

Yes. So let me just sort of go through those, and Jeff can provide some specifics there. We're seeing very sound growth on our core platform, especially in the new sales. So the simple qualitative way to think about it is that as we add new customers, the great majority especially in the U.S. customers that we are adding all on our cloud-based platform. We do have sales to both the federal government and international customers outside of the U.S. that are on our sort of on-premise platform and that's expected and natural. But the number of customers and the rate of customers on our total platform is much more positive than we could have hoped for or expected. It's not quite, but I believe it's approaching roughly that half of our overall customer base is -- has at least one product on our Insight platform. And so that's great progress, not quite happy there, but from where we -- from considering the fact that where we actually launched these things in the recent time frame, we made a lot of progress very, very fast in getting customer adoption on the overall platform. The second thing as far as the margin, I'll talk more at a strategic level is really what we're optimizing at a strategic level is one, the ARR per customer; and two, the total margin profile of the company because we have puts and takes. We have lower services mix as we indicated in our prepared remarks. The highest margin things you always have are the on-premise because the customers are running it -- and then you have our cloud-based products. I think our margin outlook is aligned with what we actually previously communicated and that's really what we're managing to even though there's lots of puts and takes. We're really managing to that overall margin profile that we previously outlined for you.

We're not -- okay. What we were going to say is we don't break out the specific product lines by revenue, but you see that the increasing amount of revenue is from our platform customers.

Right. Okay. And then just one quick follow-up on professional services. So you mentioned that you expect that revenue to be flat to down in FY '18. But is there a level at which it starts to normalize and you'd see growth? Or do you expect it to kind of continue to underpace total revenue growth?

Well, I think -- and so it's definitely going to underpace so revenue growth especially as you go into outyears because it's just difficult for a services business to actually keep up with the recurring revenue model in general. The second thing that I'd say around that is that we're really not -- I mean, we have the luxury of having expanded our product portfolio and having warm customer reception to our overall product portfolio. And so we have both the benefit and the luxury to really focus our services on things that are high strategic value for our customers, a strategic asset and part of our overall business and that's the focus. So really we've oriented both our services team and our product team to focus on the quality of the work that we're doing for customers and less on the volume that's there. So I personally am not nor are most of our teams focused about what's the services number on an individual yearly basis, we're really focused about, one, how do we make sure that we have enough visibility, so that we can do an accurate job forecasting for you all as we go into a quarter, but really we want to focus on what's the high quality business that we're doing for our customers.

And at this time, I'm showing no further questions. I would like to turn the conference back over to Mr. Jeff Bray for the closing remarks.

Great. Thank all for joining us today and looking forward to seeing you all over the next couple of months. Thanks.

Thank you.

Ladies and gentlemen, thank you for your participation in today's conference. This does conclude the program. You may now disconnect. Everybody, have a great day.