Rapid7 Inc (RPD) 2025 Q4 法說會逐字稿

Today, we will be discussing Rapid7's fourth quarter and full year fiscal 2025 financial results. We've distributed our earnings press release over the wire, and it can be accessed on our Investor Relations website. With me on the call today are Corey Thomas, our CEO; and Rafe Brown, our CFO.

(Event Instructions) Before I hand the call over to Corey, I want to note that certain statements made during this conference call may be considered forward-looking under federal securities laws. Such statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include our outlook for the first quarter and fiscal year 2026, any assumptions for fiscal periods beyond that period and our positioning, strategy, business plan, operational improvements and growth drivers.

These forward-looking statements are based on our current expectations and beliefs and information currently available to us. While we believe any forward-looking statements we make are reasonable, actual results could differ materially due to a number of risks and uncertainties, including those contained in our filings with the SEC. Reported results should not be considered indicative of future performance. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events or otherwise, except to the extent required by applicable law.

Further information on these forward-looking statements and risk factors are included in the filings we make with the SEC, including the section titled Cautionary Language Concerning Forward-Looking Statements in our earnings press release. Additionally, over the course of this call, we'll reference non-GAAP measures to describe our performance. Please review our earnings press release and filings we make with the SEC or rationale behind the use of non-GAAP measures and for a full reconciliation of these GAAP to non-GAAP metrics. These documents, in addition to a replay of this call will be available on Rapid7's Investor Relations website.

And with that, I'd like to turn the call over to Corey.

Thank you, Matt, and welcome to everyone joining us on the call today. I'm excited to be joined by Rafe Brown, our new CFO, who joined Rapid7 in early December. Raf will offer some initial impressions on Rapid7 and the opportunities he sees in his prepared remarks.

Rapid7 exited fiscal 2025, delivering outperformance against our Q4 ARR revenue and profitability guidance. We ended 2025 with ARR of $840 million and total revenue of $860 million, both ahead of guidance. And in Q4, we saw a sustained new deal activity for our industry-leading MBR offering and encouraging growth within our exposure Command platform. Throughout 2025 and more specifically, during the second half of the year, we made strategic investments across key product growth initiatives to strengthen our position as a leader in AI-enabled security operations.

We did all of this while continuing to generate significant cash flow exited 2025 with $136 million of operating income and $130 million of free cash flow. These investments enhance our security offerings with AI and machine learning capabilities, consolidate customer environments on a unified platform with our managed AI SoC and enable our team to scale operations globally.

Additionally, we just concluded our sales kickoff with broader go-to-market team. It was our most impactful SK years and a great opportunity for Chief Commercial Officer, Alan Peters and his team to outline their priorities to be energized the Rapid7 growth engine. We expect to see tangible benefits of this organizational change throughout 2026 as we develop muscle memory with these new processes.

Before I turn to business updates, I want to take a moment to address the broader landscape because I think context matters for how investors evaluate our business. We are operating in a period of significant disruption across the software sector, driven by a fundamental reevaluation of what AI means for software businesses. I understand why investors are asking hard questions. The rapid advancement of agentic AI capabilities has created a real uncertainty about the durability of many software business models, particularly those built around per seat pricing. Data workflow layers are point solutions that can be replicated or disintermediated.

I want to be direct, not all software businesses are positioned equally in this environment. And cybersecurity is fundamentally different. Let me explain why we believe Rapid7 is on the right side of this divide. The security operations market is defined by three characteristics that make it structurally resilient and in ways are beneficiary of the AI transformation happening across the enterprise.

First, the threat environment is accelerating, not simplifying. AI is enabling attackers to move faster at greater scale and with more sophistication than ever before. This is not a theoretical risk. It's happening right now and it's driving an urgent reevaluation of security postures across the enterprise. The regulatory environment is simultaneously becoming more complex and more fragmented around the world.

This combination means that the need for comprehensive expert land security operations is growing, not shrinking.

Second, security operations cannot be reduced to software. Unlike categories when AI agent can trigger an API call or bypass user interface, effective security operations requires the integration of broad telemetry, proprietary intelligence real-world expertise and yes, human judgment, particularly to incidents where the stakes are the highest. This is a market where outcomes depend on the combination of technology and deep domain expertise, not one or the other.

And third, our business model is anchored on outcomes and value delivery, not seats. Our pricing is tied to the scope of environments that we protect and the outcomes that we deliver, which positions us well as the industry evolves towards outcome-based and usage-based models. This is a lens through which I ask you to evaluate Rapid7. We're not a wrap over a generic model. Without a point solution.

where a platform built on the broadest proprietary security data foundation in our market, continuously enhance AI-driven productivity and innovation and deliver through deep services and technical expertise that customers depend on to navigate an increasingly complex world.

Now turning to the evolution of our business. The cybersecurity market is changing, and that presents us with phenomenal opportunity. AI give attacks are escalating in both pace and sophistication, stretching security teams thinner than ever. At the same time, regulatory requirements continue to expand and fragment globally. From the EU's evolving framework to compliance mandates across Asia Pacific and the broad patchwork of US.

state level requirements. This is driving a reevaluation wave across enterprise security.

And the winners in this market will be the vendors that can deliver on three things simultaneously. First, a broad proprietary data foundation that provides complete situational awareness across the attack surface, not just what you connect lately, but the ability to integrate, normalize and contextualize data from across a customer's entire environment. With over 500 integrations, our Command platform provides the broadest data foundation in our market, and this data advantage compounds over time as we train our AI capabilities on real world security operation data that no competitor can replicate.

Second, AI power productivity and innovation that continues to improve the speed and accuracy of detection, prioritization and response. Our expert training agentic AI workflows are built on years of SoC expertise, trained online playbooks and we define through real-world analyst feedback. These are not generic models. They are purposeful engines that improve outcomes in real time. And critically, we view AI innovation as a continuous engine, not a one-time product release.

We're accelerating our pace of AI development and expect this to be sustained differentiator.

And last, deep services and human expertise to help customers navigate complexity that software alone can now address. With a decade of experience managing our own 24 by 7 global SoC and that of our customers, we have built an expertise layer that is essential, not optional for effective security operations. As attacks grow more sophisticated and regulations get more complex, this expertise becomes even more valuable, not less.

Our managed services don't just monitor, they investigate, respond and remediate with the context and judgment that only experienced security professionals can provide. The convergence of these three elements: data, AI and expertise is what defines a durable security operations platform of the future, and this is precisely what we're building. The framework guiding our investment in innovation is underpinned by a shift from reactive to proactive security postures combined with outcome-driven service offerings.

We are working to introduce more AI capabilities into our MBR and exposure offerings and evolving our platform to help customers get ahead of threat rather simply respond. And throughout 25 and particularly during the second half of the year, we made strategic investments across key product growth initiatives to accelerate our transformation into a leader in AI-enabled security operations, one that enables customers and organizations to take a preemptive posture towards security operations. These investments augment our existing security offerings with AI and machine learning enhancements, consolidated customer security environments under a common an and our leading managed AI SoC and position our team to drive scale across our global footprint.

In Detection Response, we have a significant opportunity to continue leading with our MDR offering. We made strategic investments to evolve, enhance and scale our solutions while building on our expertise as one of the only providers in the market with a decade of experience managing our own stock. In 2025, we expanded our coverage to an old management of third-party alerts in a vendor-agnostic fashion. We streamlined analyst workflows with our AI SoC for MDR and in Incident Command, and we started to expand our addressable market to larger enterprises by leveraging our AI-powered services.

We're also continuing to build on our partnership with Microsoft. Just last month, we launched closer integrations such as MDR for Microsoft that provides 24/7 expert monitoring and native response across the entire Microsoft openness suite. This collaboration also extends to exposure management by unifying Microsoft delivery with Rapid7 Command platform to proactively identify and close security gaps before they can be exploited.

In exposure management, our evolution is anchored around up-leveling our exposure Command platform with AI tools native telemetry and open data integration, curated intelligence and automation to deliver a unified system for risk remediation. Differentiating features such as AI-generated vulnerability scoring and active risk going combined technical severity with real-world threat intelligence, enabling security teams to begin patching zero-day threats before competitors who typically wait for official industry scores.

Attack Path analysis visualizes primary attack vectors and allow security teams to focus on patching critical vectors rather than low risk issues. And our remediation hub provides a single destination for remediation across both exposure management and detection response, reducing mean time to detect, respond and remediate.

When we combine our leading detection response and exposure management solutions with outcome-driven AI-enhanced services offerings, we address the core issues customers are facing in the market today. And when we do this, we're playing offense. In this quarter alone, a leading offshore drilling company, we selected Rapid7 as their SIEM provider of choice. After being unable to achieve business outcomes promise by competitor, this return customers saw real benefits from the investments that we've made in our products over the last few years. Our ability to effectively deploy coupled with the service level capabilities such as MTC and Vector Command, made this 6-figure competitive win back stand out.

One of the largest sovereign tribal governments in the country became a Rapid7 customer after a competitive deal cycle and displacement in which we showcased the benefits of consolidation and the integration into our MTC offering. This high six-figure deal underscores the unique value proposition we can offer, delivering service outcomes on top of leading technologies.

A strategic MSSP provider selected Rapid7 as they continue to expand within the state, local and education vertical. Our Detection Response solution provided the features and confidence they needed to deliver outcomes for their clients. We are consolidated in a mix of competitive solutions and in-house monitoring onto the Rapid7 platform.

These wins share a common trend; customers are choosing Rapid7 not just for the technology, but for the combination of technology, data breadth and expert-led services that delivers measurable security outcomes. This is our differentiation, and it's durable.

Turning to our go-to-market priorities. We're focused on operationalizing our strengths to accelerate growth. We just included our sales kickoff with the broader go-to-market leadership team, and it was our most impactful in years. Alan, have a completed leadership team built out has crystallized his vision of a unified market approach across global sales, marketing, partners, customer success and sales operations. With new leaders and plans in place, the team is executing a more focused sales motion with tighter alignment between marketing and sales to improve demand quality and conversion and a refined customer success strategy designed to improve retention.

Refreshed incentive structures are better aligned to drive net new growth, renewals and cross-sell. These initiatives are still early stage and our growth firewall will take time to build momentum. However, the groundwork is in place to improve execution and drive sustained performance across product, marketing and go-to-market and become a taker over the medium term.

In Detection Response, AR growth of 7% was driven by MDR ARR growth in the high single digits. As we drive product transformation to deliver increased value through our AI-enhanced stock, we are positioning to take share in MDR market evolves. We believe this market has significant runway and the combination of AI-driven efficiency with deep human expertise creates a compelling and defensible offering that is difficult to replicate.

In exposure management, we're focused on simplifying the migration of our core vulnerability management base to our exposure command platform. For our moving friction from the upgrade engine, we're helping our core VM customers migrate to a unified AI-powered view of the attack surface, a move that replaces fragmented tools with integrated contextualized risk visibility.

I want to spend a moment on how we're thinking about growth because this is where the AI transformation of our industry creates real opportunity for Rapid7, and I want to be transparent about the work under win. We're actively pursuing three parallel initiatives that we believe will drive both near-term efficiency and medium-term growth acceleration. First, we're shipping significant portions of our operational services work to our AI layer and redeploying our expert talent towards higher-value customer engagement. Today, many of the repetitive pattern-based tasks within our SOC operations alogia, initial investigations and enrichment are being systematically transitioned to our agentic AI workflows.

This is not about reducing our commitment service. It's about freeing our experienced security professionals to focus on what they do best, helping customers navigate an increasingly complex threat and regulatory environment, providing strategic guidance to incidents and delivering the kind of expert judgment that no AI model can replace. The result is better outcomes for customers, improved unit economics for EFV and a services model that scales more efficiently as we grow.

Second, we're strategically redefining our portfolio of solutions by proactively integrating advanced AI models into our core offerings, we're ensuring our solutions remain at the cutting edge of efficiency and performance. Rather than maintaining the status quo, we're choosing to braze innovation over legacy making the deliberate decision to shift resources towards high-growth, future-ready prove areas. We believe this is the right trade-off except the near-term headwinds in parts of the portfolio that face structural pressure while concentrating our investment in energy on the areas where we have a clear differentiation and durable growth potential.

Third, and most importantly, our core growth engine is the extension of our AI-enhanced services layer. This is where we see the most durable opportunity. Customers need a partner who can bridge between the rapid pace of technology change and the operational reality of securing complex distributed environments under growing regulatory pressure. Our ability to deliver AI-driven efficiency alongside export led services integrated on a single platform with the broadest proprietary data foundation in the market is what sets us apart in what we believe will drive share gains over the medium term.

At the core, our growth will come from extending this AI services layer, delivering AI to help our customers keep pace with technology change, pair with the expertise to navigate a complex and rapidly evolving security landscape. Our anticipation is that the investments we made last year will begin to yield dividends in our AI orientation this year. But just as importantly, we're fundamentally transforming and upgrading our engagement models this year. to ensure that both our business and our customers are resilient in the face of regulatory and the threat environment we face today.

In closing, I want to leave you with this perspective. The increase in pace and substitution of attacks is driving a meaningful shift in how security budgets are allocated. Customers are looking for vendors who can deliver measurable business outcome, not just technology, but a combination of data, AI innovation and expert services that actually make their organization more secure. We believe this plays directly into rapid some of the strength. Our business is built on proprietary data that becomes more valuable as we scale and capabilities that continuously improve through real-world operations and a services layer that builds lasting trust and partnerships with security teams.

This combination data, AI and expertise is the foundation of a durable cybersecurity business and it's what differentiates us in a market that is increasingly skeptical of software-only approaches.

Rapid7 is investing across our platform to deliver security operations to give customers the ability to stay ahead of attackers. Our long-term strategy of integrated exposure management with detect and response is proven to be where the market is heading. Our Command platform, data mesh integrates more complete security data, including dresses into our AI engine for sure scale and efficacy and our services layer allows us to build lasting trust and partnerships with security teams, supporting them when they need us most. We're confident in this strategy.

We're moving with urgency, evidenced by our recent leadership additions and organizational changes to improve our execution and capitalize on the significant opportunity in front of us. I look forward to sharing incremental progress throughout the year. I'd now like to pass the call to Rafe to discuss our financial results and guidance in more detail.

Thank you, Corey, and good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers, except revenue and balance sheet items mentioned during my remarks today are non-GAAP. I want to begin by sharing how happy I am to have joined Rapid7. This is a great company, doing incredible work to protect its customers around the world. And moreover, I believe there is tremendous opportunity to build shareholder value in the coming years.

In this fourth quarter earnings call, I'm pleased to report that we exceeded our guidance across revenue, annual recurring revenue, or ARR, and operating income. For the quarter, we generated total revenue of $217.4 million growing 0.5% year over year. This brings us to a total of $859.8 million of revenue for the full year 2025, growing 1.9% year over year.

For the quarter, we recorded product revenue of $209.1 million, growing at 1.4% on a year over year basis. Professional services revenue for the quarter totaled $8.2 million compared to $9.9 million in the fourth quarter of 2024. Our year over year results reflect an intended shift in our operating model toward a greater utilization of our partners for professional service delivery, allowing Rapid7 to remain focused on its core offerings.

Our ending ARR of $839.9 million was approximately flat year over year as the business digests a mix shift towards our faster-growing detection and response business, which currently constitutes just over 50% of our ending ARR. On a year on year ARR basis, our D&R business grew at approximately 7% in total with the MDR portion of the business growing in the high single digits.

We continue to believe that the managed detection and response market is a significant opportunity for us, and we are focused on unlocking the value in this market with our AI-enabled approach to preemptive security. Within our exposure management business, there are encouraging signs that our investments in modernizing and upping our offerings are taking hold. For example, our Exposure Command offering saw a rapid adoption in Q4 by both new and existing customers.

Turning now to profitability. Our Q4 non-GAAP operating income of $30.1 million or a margin of 13.9% and was incrementally ahead of expectations. The sequential downtick in margin reflects the continued ramp of 2025 investments discussed in prior earnings calls across our global capacity center in India, our go-to-market teams product teams and new organizational leadership. It is worth noting that we will carry this higher Q4 expense base into 2026. However, as the investments take hold and the efficiencies they bring materialize, we expect operating margins to expand as 2026 progresses.

I will provide more context in a moment when we discuss our 2026 guidance.

For the fourth quarter, we posted non-GAAP earnings of $0.44 per diluted share at the high end of our guidance range. For the full year, we delivered non-GAAP operating income of $135.7 million or an operating margin of 15.8% and drove non-GAAP earnings of $2.08 per diluted share. Our fourth quarter free cash flow was $32.3 million, bringing us to a total of $130 million of free cash flow for the full year 2025. We finished the year with over 11,500 customers, with an average ARR per customer of approximately $72,000.

From a balance sheet perspective, we ended 2025 with over $659 million in cash, cash equivalents and government securities. In addition to these resources, we have a $200 million undrawn revolver in place. Thus, our balance sheet position, strong free cash flow from operations and available undrawn credit capacity gives us confidence in our ability to settle our March of 2027 convertible debt upon maturity.

Before we turn to our 2026 guidance, I would like to share some initial observations. It has been an energizing first two months with Rapid7. The security market is in the midst of a dramatic change. Likewise, Corey and the leadership team are focused on taking Rapid7 to new levels. ensuring we meet our customers' increasing demands for excellence as we protect their businesses from an ever more dangerous threat environment.

As such Rapid7 is well positioned to take advantage of a growing market opportunity. Within the company, there are a number of areas where we must continue to improve both in terms of focus and execution. In addition to the go-to-market efforts, Alan is spearheading and which Corey discussed, we have the opportunity to improve our focus across our portfolio of offerings and in particular, to prioritize investments in the products and revenue streams that are core to our future.

In my role as CFO, I'm focused on the following key objectives: improving financial forecasting, driving measurement and accountability across the organization, focusing and shifting our resources to align with our core products and growth strategy, expanding non-GAAP operating margins as we move across 2026 and into 2027 and focusing on free cash flow as a core operating metric across the organization.

As we turn to guidance, I would like to begin by sharing that we have been refining our financial projection models over my first few weeks with the company. Our philosophy for providing guidance works to ensure transparency with investors while setting realistic meetable expectations for company performance.

I would like to note that while we continue to provide full year revenue guidance for 2026, we've decided at this time to not give full year ARR guidance. While we have a clear view of current trends across our business, we have several new leaders in place, and we are implementing key improvement initiatives across sales, marketing and our customer success and support organizations. As such, we believe visibility into ARR is best reflected on a quarterly basis at this time.

This brings us our first quarter 2026 guidance. In the first quarter, we expect ARR of approximately $830 million or down 1% on a year over year basis. While we are optimistic about the leadership changes and strategy that have been implemented in our go-to-market organization, we do not anticipate the benefits of these changes will impact Q1. The total first quarter revenue is expected in the range of $207 million to $209 million or down 1% year over year at the midpoint.

We expect non-GAAP first quarter operating income in the range of $19 million to $21 million or non-GAAP operating margin of 9.6% at the midpoint. As previously mentioned, margins in Q1 will be pressured by higher expense envelope entering the year in addition to seasonal expenses such as our global sales kickoff. Non-GAAP earnings per share is expected in the range of $0.29 to $0.32 per share on approximately 77 million fully diluted shares.

Turning to full year 2026 guidance. In fiscal '26, we expect total revenue in the range of $835 million to $843 million or a decline of 2% year on year at the midpoint. Non-GAAP operating income is expected to be in the range of $108 million to $116 million or a non-GAAP operating income margin of 13.3% at the midpoint. As stated earlier, we made a number of investments during the second half of 2025. As we move into the second half of '26, we expect these investments will yield improvements in the efficiency and operation of our business moving non-GAAP our operating margins into the mid-teens.

Non-GAAP earnings per share is expected in the range of $1.50 to $1.60 per share on approximately 78 million fully diluted shares. Free cash flow for the year is expected in the range of $125 million to $135 million, flat with prior year performance at the midpoint and a margin of approximately 15.5%. As a reminder, the company is focused on free cash flow as a core KPI in 2026. Please refer to our earnings release and SEC filings for any additional details regarding the presentation of our results and guidance metrics.

And with that, I'd like to turn it over to the operator for Q&A.

(Operator Instructions) Meta Marshall, Morgan Stanley.

Great, thanks. I appreciate the question. I guess just in terms of some of the changes that you were mentioning in terms of tighter marketing and sales, refined customer success for fresh incentives, just how would you measure or kind of expect where some of those changes to be seen first? And kind of what milestones are you holding yourselves to see evidence of those changes? Thanks.

Yes, great question. Look, I think there's a number of different areas but I think one of them, we're looking at sort of increased sales and marketing productivity and efficacy. We think we can actually grow faster while doing it more efficiently, that to clear -- that's a clear cut one that actually stands out and that's pretty opportunity and that aligns across frankly, product marketing and the go-to-market teams and the overall engagement.

Specifically, when you think about the customer side of the house, as one of the bigger opportunities we have is customers are frankly looking for more services, more customization, more depth, not less. And so scaling that leverage in both technology but also people and the expertise is a big focus area for us, so that we're actually able to do more work and it's greater levels for our customers, while still frankly maintaining or improving our gross margin profile.

That's one of our bigger pieces of investment and focus we've had over the last year. Customers have not been looking for less services less engagement, maybe looking for partners who can do more with less, and that requires both technology and some of the people, talent and expertise. Thank you so much for the question.

Jonathan Ho, William Blair.

Good afternoon, can you hear me okay?

Yes. We hear you just fine, Jonathan.

Okay. Perfect. So I just wanted to understand in terms of the segments of the market that you're prioritizing, can you talk a little bit about what you see as sort of the core growth businesses going forward? And what are some of the changes or areas of focus that you can implement to sort of drive that acceleration? Thank you.

Yes. Look, I think our biggest growth area is still going to be Detection Response, which is still growing. We think it has capacity to grow faster. That said, as you think about like our core addressable market is at mainstream enterprise. Think about like employees from organization having employees from 1,000 to 20,000 employees.

For there, we're focused heavily on making sure we can provide the depth and quality of the service experience. We think we're only addressing part of the total addressable market there. So our big focus right now is unlocking the full addressable market.

Now that said, lots of the competitors we have are especially a private are actually doing a lower total gross margins, and we're very focused on bringing quality service and quality experience at the right gross margin profile. So that's the first one is that detection response market, of which does include assess. But exposure management is an important part of the puzzle there. And so I would just say that's another focus area.

We do think about that being an integrated part of the stack, not a stand-alone focus. And so if you think about where our focus is, it's about how do we actually bring together security operations. that bring together exposure management and detection and response. So we think about that flowing into a single integrated offering. Some of the things that we're less focused on are some of the legacy on-prem, much of which has been upgraded to our Command platform.

but we're still working through the upgrade of those technologies and capabilities to the Command platform.

When you look at the core market that we're focused and tied on, it's that mainstream enterprise that is, frankly, our historical base. we have, I would just say, moved slightly out of that over time. And I think one of the things that Alan and the team are bringing back in is a tight focus on our core customer and our core customer profile, which we did a good thing for both acceleration and win rates.

Got it. And then just as a quick.

Yeah.

Yes. Just as a quick follow-up. So when we take a look at your decision to not offer the full year ARR guidance, can you maybe walk through the rationale for that? And what maybe has to happen for that visibility for you comfortable to bring that back? Thank you.

Yes. Thanks, Jonathan. As my prepared remarks mentioned, first and foremost, we thought it's really important to put out guidance that is meetable and clear to align everyone. And so that's why we have confidence on the near-term ARR guidance. For the longer term, we felt that revenue was the best metric for the current time.

And this is largely because of all of these changes that are way in our business across whether it's the sales organization, marketing, customer success and support. And so the total of all of those factors coming together that led us to this decision There's a number of us that are new, including myself in the organization. As we see the trends establishing themselves as we see these investments begin to bear fruit, we will reconsider giving full year ARR at that time.

Yes. I would just say, we just said, look, this is not a moment where we can be slow. And so we decided that we had to actually move fast but what we didn't want to do was attempt to be overly precise when we actually have a new team that's actually coming in driving execution fast. We're holding ourselves accountable for driving improvement, both in growth and in the cost structure as we go across the year. The cost structure is a little bit easier to focus on, especially when you look at free cash flow, I would just say the growth piece of it, because of the last couple of years, we were just really focused on actually just starting out with where we have clarity.

And then as we actually show the improvements, we'll update you, of course. And then as the new folks that are on board to get situated in place, my expectation is we'll be able to continue to provide comparing visibility. Thank you so much for the question.

Rob Owens, Piper Sandler.

Great. Good afternoon, everyone, and thanks for taking my question. I guess I'll pick on the guide a little bit, too, and I can appreciate that there's a tremendous amount of uncertainty both with the changes that are going on within Rapid7 that you talked about, Corey, but also just where the market is. But the Q1 ARR guide does lend to significantly more churn, I think, than you've probably been seeing. And so would just love a time frame when I realize it's hard to commit to an ARR number, get all the moving parts right now but when would you hope that some of these investments that you've put in place will start to bear fruit, and you can see some stabilization in that number? And I know that historically, you do see some seasonal weakness here in the first quarter, but obviously, you're giving us accelerated churn in the numbers here. So I appreciate the thoughts. Thanks.

Yes, it's a very fair question. Look, I think part of what you see, I think you're referring to both the net ARR, which sort of indicates that churn is went faster than new. What you see there is that, look, we clearly -- if you look at D&R, it is a positive contributor in the environment. We need that to grow faster, frankly. There are some aspects of the business that we've broken before in the other category that are negative.

We've had pressure on parts of the traditional EM business. We need the DR business to grow faster.

The biggest thing that we're actually doing on that is we're actually focused on the growth being in line with our gross margin expectations. And we're taking a fairly disciplined approach to that. which means that we have to be aided somewhat still, even though we're starting to take in and increase our adjustable bar TAM. We are unlocking that now. So we started unlocking that late last year.

and we expect that to improve over the course of the year and for that to actually find out. The exposure management piece, we are in the middle of upgrade cycle.

What I would just say is we saw good unit trends exiting Q4 were very slow year overall, but we did not want to straight-line some improvement that we saw in Q4 throughout the whole year. But I would just say we have positive indicators there. So to answer your question, Rob, is D&R, we actually have pretty strong confidence that you'll see that continue to improve over the course of the year. So we'll have a good mid-year check in on the D&R side, where we'll provide commentary and discussion about what's happening overall there. The exposure piece was definitely slower last year.

It did improve in Q4, just to be clear, I think that was in some of the early comments but it's not where we want it to be.

And so again, there, we don't want to actually straight-line some of the early improvements that we saw in Q4. I hope that helps with a little bit of how we're thinking about how we're looking at.

No, that does. I appreciate the color and obviously, given the software-mageddon or whatever we want to call it, that we've seen recently, I appreciate your comments earlier around the defensibility of cyber and the domain expertise and couldn't agree more. But that being said, I'm curious what are conversations with customers right now relative to AI, the potential threat of AI? And what are they asking of Rapid7, if anything?

Yes, that's the one that's actually clears and this is where -- this is also the time where on one hand, you never love as you're seeing some of the growth things that we have for last year for us, they can investments in retrospect I feel great about the investment because we are moving on the AI. The #1 that customers are asking for us is they want us to do more, they help them do more or less, like we think about AI crowding out budgets, but it's also crowded out staff and customers are dealing with increasingly complex environments, they're absolutely demanding that their providers be able to tap more and they do more with less. So that's why I say that they're looking for us to actually leverage AI.

Now there's a lot of customers that want to actually -- they want transparency in the AI. So part of what we're working with our team on is not just solving the problem, but it's showing you work on how you solve the problem because security folks are skeptical. And so we're not missing complete until we actually both deliver the AI velocity of the customers want, but that we're actually doing it in a way that's trusted. So that's one thing that customers want.

But then they actually want you to actually do more. So we have lots of customers that are looking for us to actually take on more of their operational workloads. And frankly, we can't quite rest all of that right now. That's why we are upgrading and investing in sort of like getting richer deeper expertise even as we sort of like deliver more AI solutions to take on hard the work that actually some of our people used to do. Customers want to scale their security operations.

And it's not just their technology book eat they're trying to figure out how to get the most out of they also for their teams are being asked to do more or less. Thanks for the question, Rob.

Brian Essex, JPMorgan

We can come back to Brian in a second, when he comes back home.

All right, Joseph Gallo, Jeffries.

Hi. This is [Grant Starling] on for Joe Gallo. I wanted to ask first just about outside of AI, customer consolidation trends. How are those impacting your win rates and deal sizes? And then in the conversations with customers, what is most important for you to be a beneficiary of this trend?

Yes, it's a great question. It's interesting. So we are benefiting from it. I would say we do have to actually improve the delivery of how we actually simplify that for customers. And so we see this as an area -- it's our biggest area of winning.

It's also one that we actually have some improvement to go. I think one of Alan's focus areas is to simplify the proposition, the store talent and the packaging about how we actually deliver the consolidation story.

Rapid7 has traditionally been because we're a security company, we tend to believe in not overpromising. And so within the under-promise open deliver, which isn't always the greatest thing in a hypercompetitive sales cycle. And so part of that is how we actually tell the story the thing that we're focused on the more substantive level, though, when it comes to consolidation is how do we actually be the best at actually integrating into the rest of people's technology and security.

Look, if you look today, we're able to essentially integrate the four biggest parts of security operations in, which is a big deal, who are asking us also to actually take on even more of that work. And we're doing that increasingly through partnerships. So we announced not just a partnership with Microsoft. We announced the partnership with another company that extended some of our capabilities. And you'll see several more of these key partnerships coming up a little bit later this year.

as a key part of our strategy. That allows us to stay tight on our R&D-focused budget which is -- and sometimes in the past, we will just actually spun up team to do that.

So it allows us to stay focused but it also allows us to apply best-of-breed technology deeply integrated within our security stack to get more of that share of wallet for the consolidation budget, and that's a big focus that we have as we move to the year. That said, is that we're not assuming in our initial guidance that we gave any material improvement there. I would say we are managing to that with the strategy of both expanding our addressable market and exposure and D&R and demand services that go along with it. And we're quite aggressively investing in embedded partnerships that deliver the consolidation experience and budget that folks are looking for.

Got it. That's very helpful. And then maybe going back to MDR, like, when does that get big enough to drive growth acceleration? And maybe how do we think about that dynamic there?

So I think it's pretty close. It's actually -- it is actually big enough. We need to be ungated in our ability to actually go sell it and drive it. I do think we crossed that threshold this year. To be clear, we won one of the most profitable, highest quality MDR businesses.

But that does mean that we are pretty clear about what we do and don't do. And we are actually increasingly unlocking that business. That does require technology that does require AI and it requires to shift where the services go. But I think that we're on the track this year to be able to unlock that, and then that would compensate for the growth.

I think this is part of our -- Rafe's comment earlier is that look, we don't want to be over precise in predicting timing. We're unlocking it this year, then how fast can -- as we unlock that, can we actually take that to market, tell the story in a noisy market. that's where we are actually just being very direct and open with you. But we do see us unlocking that this year, which we think the profile moves over the course of the year.

Very helpful. Thanks again.

Adam Tindle, Raymond James.

Okay, thank you. I just wanted to kind of circle back to Rob's lineup questioning. And just double click on what's driving the ARR decline in Q1 based on guidance. It's just a little bit more meaningful in the past, down $10 million or so on net new ARR. And I wouldn't think Q1 is necessarily a big renewal quarter, so I was confused if the churn comments just maybe double-click on why that is happening in Q1. And if you could tie in the color on investments and strategy to potentially reverse this decline in net new ARR?

For example, if it's a churn issue that you're seeing? Are you creating or investing in a retention team? Just a little bit more, Corey, some qualitative comments on strategy as well.

Yes. So Rob was the one that framed it as a churn thing. But to be clear, I do think that the -- if you look at the biggest driver is growing, but it's not enough to compensate for the negative -- for the rest -- for the other parts of the business that are growing. But I will ask you turn questions, too, about what we see around churn is we see -- if you think about DR, and you think about exposure. Exposure was stable last year, so it was in line with expectations.

We think it could be better. We have a number of major releases coming out that make it easier to do the vulnerability management to exposure upgrade. And so we think we have upside there.

But again, it was slower last year. And so we're not baking that into the core assumptions and outlook and it's not -- that's not a ton thing either. And so that is something that we're actually looking at in the middle of the year, but we accept good visibility there. And the D&R on, we're actually doing D&R, I would just say that for customers that say, we love what you're doing, we need you to do more and we want more systems or we want more customization. We're not set up right now to fully unlock that right now.

And so that does cause more complex customers to come out in the near term.

That one, we have a lot more confidence in clearing the visibility in because we've been specifically retooling around that. And that, we actually think improves both on the addressable market TAM side, but our ability to say yes to customers go forward. So Again, the biggest driver is D&R growth isn't enough to compensate for the other. But I also want to make sure I explicitly address your questions on churn dynamics. Did that get to your core questions?

Yeah, that's helpful. Thanks. Maybe just a follow-up for Rafe. I was curious in looking at the guidance here. You do have that improving EBIT margin I know you talked about, but in dollars, it's also improving $20 million or so in Q1 and EBIT dollars has to go to 30-ish to hit the annual guide on EBIT. And I'm noticing that revenue growth is not accelerating.

So it's not necessarily an operating leverage dynamic going on here. Maybe just what's driving the improvement in EBIT? I know you talked about investments. I wonder if maybe there's also some cost-cutting restructuring or something that drives that trend of EBIT dollar improvement on revenue declines? Thanks.

Yeah. Thank you. As we move across here, part of where we're at is we have been investing throughout 2025. Of course, that run rate comes into the early parts of the year. But those investments start to bear fruit, right?

Some of the things that I called out in my prepared remarks, our investments that help us build efficiency, whether it's investments into the product, investments into the India team, it gives us greater capacity as we move through the year, and that bears some fruit for us. that will help us build those margins as the year goes on.

Shrenik Kothari, RW Baird.

Hi, Guys. This is Zach Schneider on for Shrenik. So I just wanted to follow up to some previous questions. If you could just help us understand where are we really in the monetization curve or Exposure Command and Incident Command and maybe which upsell levers offer the highest probability of lifting net retention meaningfully maybe without relying on broad pricing increases over the next 12 months? Thanks.

Yes. I'll hit both of them. So one, Internet Command is relatively easy. We haven't -- we launched initially in -- last year. I will say the primary focus initially was on the AI managed services around it.

and to support some of the cost of demand again because we have not addressed the full addressable market there. So I would just say, listen, we're in the first inning of incident command. And frankly, it's not even a big priority right now for our sales team. It will be a later priority as we actually go through the year. But we actually think there's plenty of upside there.

especially with what's happened in the SIEM market. So it's something we're prepping for and looking at.

There's a couple of things that we want to do to make it brain-dead easy and simple for folks to do. And so we expect to actually do that. But I think we're in a good position. It's not a core focus. I would say, first inning but it's something that we're looking at.

And I think that upgrade does not require a lot of complexity in terms of proxy there.

On Exposure Command, I would just say, listen, it's a big disappointment last year because we did not really sort of like get that go into Q4. That said, in Q4, we actually saw a unit uptick of starting to get the upgrade motions. And if that continues, but even in Q1, we're starting to see a little bit of continuation of that. we feel quite good about what that means for both growth of expansion and what that means for retention over the course of the year. as that goes along.

But this is a classic one where we missed the timing last year. And so that's where we're not baking that into the -- it's not in the core Q1 assumption.

It's not their -- but I do think that is one that I feel like we're in the -- I would just say, fourth or fifth inning to keep using baseball analogies, but we're further along. We see it. We know what we've gotten good feedback there. We just want to see the uptick I do think more of this is operational. And so I feel more confident that we'll continue to see it, and we've already seen some of the initial progress there.

Kingsley Crane, Canaccord Genuity.

Hi, thanks for taking the question. Entering last year, I think we felt like we had a stronger pipeline at the beginning of the year than fiscal '24. And of course, this has been somewhat of a challenging year. In retrospect, I mean, was the quality of the pipeline lower than original valuations? How do you feel about that evaluation methodology and just the quality of the pipeline heading into '26? Thanks.

Yes. I mean, look, I think clearly, if you look last year, our assumptions on deal cycles, especially in the pipeline were off significantly, which is why we've actually revised how we look at things, how we think about things. as we actually come into this year were conservative but I would just say we have a much more thoughtful approach around the learnings from last year and how they apply coming to this year. The way that I would frame last year's pipeline is that on the D&R side, we actually built a backlog of larger deals faster than we could actually consume them and deliver them and execute them in the market.

And I think that spot and it represents customer demand. And so we have a lot of urgency on responding to that sort of like customer demand that we actually see there. I do think that this year will match up the demand and supply of capabilities. to actually do the more customized accounts. I think it's the right thing to be gated on that.

But to be clear, is I think that will be more matched and in line this year. We also just need lots more transactions in singles and doubles was the other quality. So one of the big things that Alan is focused on is not just doing the big deals, but also getting -- keep using baseball analogy, singles and doubles, but that matters hugely.

Now again, this is one of the things that kind of worked well coming out last year. We did start to see that mentalities of the singles and doubles starting to hit. We need to see that system with is across a few quarters. But if you look at the recipe for growth acceleration, which is what we all want is it is the single and doubles Think about that as the mid-market AI MDR, it's incident demand, it's the exposure command, which includes the upgrades of those, which we have plenty of capacity and room for. It is continuing to deliver the pipeline, but they're actually being able to convert and service.

I would just say the larger deals not say large deals, as are the customers that are with somewhere between 5,000 and 20,000 employees, which is sort of in our core sweet spot and unlocking that. And I think that, that is a big focus area.

Those are the things that actually unlock growth is I mean we look at how we're actually looking at the pipeline and the planned assumptions this year is, one, look, we're factoring in that we need a multiple of the coverage ratios that we actually did last year. So we actually are taking the learnings from last year and applying them in to this year as we actually think about the pipeline overall. And certainly, as we actually think about sort of how that related to guidance. But again, there's a couple of tailwinds that I would just say in our team's ability to go get the singles and doubles, which should improve things over the course of the year, but we won't see that evidence done, and then we'll actually communicate that and we'll give you updated guidance.

That is really helpful, Corey, and I do appreciate the baseball analogies. Maybe one for Rafe. How are you thinking about the net debt balance moving forward? And then just the general philosophy around cash balance, uses of cash as you wrap your hands around the business? Thank you.

Yes. Thank you. Well, first, we've been very, very focused, as I touched on in my prepared remarks, about making sure we're in a strong position for that maturity that comes in March of 2027. And on our balance sheet, a lot of our investments are still classified as long term, but all of those treasuries going to securities mature before the bond does. So what we anticipate as next quarter the bond maturity moves from noncurrent to current, so too will the investments and really just lay out for everybody First and foremost, we're in a very strong position to be able to take care of that debt maturity with the cash and the investments we have on hand.

I think beyond that, we're looking to make certain we have the liquidity to obviously fund the business, make sure we've got good headroom there. But also, we need to be liquid enough to take advantage of any opportunities that come up through the course of the year. So very much evaluating that now and continuing to have discussions around that. But first and foremost, we want to just share with everybody our strong position to take care of the debt maturity, take that off the table for everyone, and then we'll go forward from there.

Thank you very.

Much. Your next question comes from the line of Mike Hikos with Needham. Please unmute to ask your question.

You may have to unmute operator. What's the instructions to unmute if someone's on the phone?

To unmute if you're on the phone, it's just six. And it looks like we're not getting a response from Mike, so we'll go next to Rudy Kessinger. He's unmute to ask your question.

Hey, great. Thanks for squeezing me in, Ray. Kind of back to -- have questions, some other questions on just the ramp in op income. I guess on gross margin, it was down sequentially in Q4. That took lower for the full year here. And again, just if I'm modeling it right, you assume a gradual rate on that op income, we've got to take OpEx down by like $10 million a quarter by Q4.

So do we have that right? And you're saying it's driven by efficiencies, but are planning to hedge anything? Or how do you get to that level of improvement on the operating income side?

So I think, first and foremost, remember that we did touch on Q1 is inherently has some extra expenses that just hit Q1, right? Not only have the usual stuff like all the tax rates resetting and that always hits Q1. But also sales kickoff falls in Q1. And as Corey called out, we got the whole team together. We really had a great chance to get together with the new leadership and really set that strategy for the year.

So that that is one unique aspect that obviously shows up the Q1 guidance.

Across the board, these investments that we're making, the gradual shift in D&R does come with a little bit lower margins. We still think they're very good margins. We've talked about it in the past, making margins in the low 70s. We feel good about that. But as that mix shift continues, it does pressure cost of goods sold a little bit.

But again, these investments are around AI, investments in across the business and all the different changes we've called out. I think that will bring efficiency as we move through the year.

Yes. I mean, keep in mind, I think I do want to reflect one thing, I think it's a core part of it is that, one, Rafe is completely right about the managed -- the MDR that customers are looking for, just to be clear, it's a big demand dropper Also, you can see why because of the gross margin profile, why we have to do it in a technology-oriented way. And so that's the first thing.

The second thing I'll remind you is that this was planned for last year. What we committed to you all last year was that we were kind of make an investment. But we were planning out the investment such that the benefits of it would sort of like peak at the end of the year, but then come down. I would say we're completely aligned with the plan. So yes, I think that you're right on the profile, the how it flows but this profile and this investment structure was planned out last year, and we are on the plan.

And so it's not a major derivation of the plan. Now I think Q1 is probably not the right baseline to think about the Q1 expenses. But the efficiency gains that we have, we're playing out as we actually went through the increased investment last year.

Gray Powell, BTIG.

Great, yeah, this is, [Trevor] on for Gray Powell. Just one quick one for me. You touched on it a bit earlier, but can you just talk more to the mix of enterprise versus mid-market deals you saw in the quarter and how that compared to Q3? And then where are you seeing the most traction between these deals heading into 2026 and then the mix there? Any color there would be helpful as well? Thanks.

In pipeline, I don't have the specific numbers of pain right now. But in pipeline over the course of the year, we saw, I would just say, a pretty significant shift towards larger ASP deals in pipeline, which is, frankly, again, a little bit ahead of our capacity to deliver on all of those. And so that ended up being a pressure, which is a site we have to have the singles and doubles of mix in there. I do think it will be more balanced this year.

Now I can't comment about where the current line sits. I look the have the enterprise. And it's not really enterprise versus midmarket, it's more the deal size and complexity and customization that really that drives it more than anything else. I am expecting, based on conversations with Alan and the customer team and the go-to-market team that we'll see a more balanced mix this year coming in. We'll still get a reasonable share of the larger deals, but we are planning for it to be a more balanced mix.

We think that was one of the things that we just did not quite nail the execution of last year. so we do one of our balance, even as we actually continue to now convert some of those larger deals. Just to be clear, that is the goal, that is the focus in both our customer orgs for our existing customers that are asking for more and for new business. Lots of customers are looking to upgrade their capabilities and get partners on how they actually execute operations. But we can say yes to more of those, but we do want more of the singles and doubles, to speak.

And so I do think the mix is going to shift to be more balanced this year.

There are no more questions at this time. I would now like to turn the call over to Corey Thomas for closing remarks.

All right. Well, thank you so much for joining us on the call today. And I really do appreciate the folks that are actually on the journey with us. Rafe and I look forward to updating you on the next call.