SecureWorks Corp (SCWX) 2023 Q3 法說會逐字稿

Good morning. My name is Kelly, and I will be your conference operator today. At this time, I would like to welcome everyone to the Secureworks Third Quarter Fiscal 2023 Financial Results Conference Call. All lines have been placed on mute to prevent any background noise. A supplemental slide presentation to accompany the prepared remarks can be found on the company's website. (Operator Instructions) At this time I would like to turn the call over to Kevin Toomey, SecureWorks Vice President of Investor Relations. Mr. Toomey, you may begin your conference.

Thanks, everyone, for joining us. With me this morning are Wendy Thomas, our CEO; and Paul Parrish, our CFO. During this call, unless otherwise indicated, we will reference non-GAAP financial measures. You will find the reconciliations between these GAAP and non-GAAP measures in the press release and presentation posted on our website earlier today. Please also note that all growth percentages refer to year-over-year changes unless otherwise specified.

Finally, I'd like to remind you that all statements made during this call that relate to future results and events are forward-looking statements based on current expectations. Actual results and events could differ materially from those projected due to a number of risks and uncertainties, which are discussed in our press release, web deck and SEC filings. We assume no obligation to update our forward-looking statements.

Now I'll turn the call over to Secureworks CEO, Wendy Thomas.

Thank you, Kevin, and welcome, everyone. I am pleased to report that Taegis ARR grew more than 80% and to a record $222 million in the third quarter. We doubled our Taegis customer base over the past 12 months, ending the third quarter with a total of 1,600 customers. Our Taegis ARR and customer count growth rates continue to be among the highest in the XDR and MDR space, and we've only just started to scratch the surface of the emerging market opportunity.

In addition, our business model transition is accelerating. Taegis represents 65% of our overall subscription ARR and is now expected to be approximately 80% of ARR by the end of this fiscal year. We extended the reach and performance of our platform in third quarter with the launch of a localized version of the Taegis platform in Japan, a significant step in both the global expansion of Taegis and the strategic repositioning of our business. Since our initial market entry into Japan nearly a decade ago, we've had the privilege of securing some of the most innovative multinational organizations in the world. The launch of Taegis marks the next era for Secureworks and its customers across the Japan market. Bringing access to unified prevention, detection and response in a single localized and global platform with an added layer of support available to customers and partners via managed XDR.

It was an honor for me to meet so many prospects and customers, top companies and their CEOs, while in Japan for the launch as well as to invest time in forging new partnerships. In the short period of time since the launch, we've seen great traction with a growing pipeline and key new logo wins. For example, I spent time with the security leaders of a $9 billion multinational retail company headquartered in Japan, and they were looking to create global consistency and streamlined management of their security operations teams across regions, and they selected Taegis to consolidate stock management of more than 170 business applications and to align global security teams across time zones with the ability to secure regional systems with multiple service providers. The open and collaborative design of Taegis to work seamlessly across global teams and disparate technologies mean then they could secure their organization at the speed of their digital transformation.

We also recently announced our partner-first go-to-market approach. Customers want choice and the ability to work seamlessly with trusted partners and advisers. Since launching our partner program in mid-2020, we have established strategic relationships within the partner community to support customers' preferred buying approach and to widen our access to market opportunities. Year-to-date, more than half of the new Taegis business was sold through partners and the scalability of the Taegis platform and operating efficiency enables us to deliver growth with a sound partner-led business model.

So the time was right to take the next step in the evolution of our partner-led go-to-market program to capitalize on the momentum in our partner relationships and sales, a milestone we've been building towards since we began our journey to a SaaS company. Prospective customers come to us with a consistent set of security pain points, the need to consolidate sprawling cyber estates, moving away from disparate point solutions that are costly, don't work together and overwhelm their short staff teams with noisy alerts. The first principles behind the design of the Taegis XDR platform address this challenge from the perspective of customers in 4 areas: an open platform approach that meets them where they are and can evolve seamlessly with their technology transformation and one that provides superior detection and unmatched response to prevent damaging security breaches, all at an industry-leading return on investment.

Our results show that Secureworks is delivering on these priorities. Let me share some of the proof points in the voice of our customers. First, Taegis offers superior detection. Detection is more than finding everything that poses a threat. It's about finding the right things so that the headline is not buried in the noise. Taegis now ingests nearly 550 billion cybersecurity events daily, including events across hundreds of purpose-built integrations. We are able to use these events, combined with our proprietary threat intelligence to better train our machine learning models to detect known and unknown threats. Our renowned counter threat unit tracks more than 175 active threat groups and handles over 3,000 incident response and adversarial testing engagements annually.

The threat intelligence and the hunting and detection techniques distilled from their work are infused into the Taegis platform to accelerate detection efficacy and efficiency. Year-to-date, Taegis XDR has filtered nearly 99% of point security product alerts, which would have been noise to our customers. This difference was clear in a deal we recently signed with a large auto parts manufacturer, who was facing an overwhelming number of alerts from a leading endpoint provider. This company's security leader has been challenged to improve the level of security visibility and effectiveness to be in a better position to support the constant competitive innovations and new technologies this company was introducing, all while showing cost savings.

After a short proof of value deploying Taegis, we were able to quickly show the ability of Taegis to sort the signal from the noise in a way that demonstrated the business case for their teams improve SecOps scale and effectiveness and the ability of Taegis to work across their OT and IT environments was critical to protecting their revenue and reducing their business risk from ransomware and other attacks.

And Taegis regularly finds malicious activities that other products miss with our unique capabilities to detect threat actor behavior based on our knowledge of threat actors' tactics and techniques. For example, Taegis recently identified a business e-mail compromise in a third-party cloud environment and e-mail application. Threat actor was able to steal credentials and create a malicious inbox rule to high malls from the primary owner. The security controls of e-mail application and cloud provider did not alert around the compromise of the user nor around the creation of the malicious rules.

The second way our XDR platform solves a key customer pain point is through unmatched response. Our vision remains to automate detection, threat hunting, security investigations and response actions to the greatest extent possible, always moving the line forward to free up security talent to focus on the things only humans can solve. The store capabilities native to Taegis enable this. And this is not a bolt-on that customers have to build and tune, but rather are designed and curated by our security experts and software developers.

Automated response matters so much because the pace required of security has accelerated. The median dwell time for ransomware attacks is about 4 days compared to 55 days just 3 years ago. Taegis prevents threat actors from lingering and blind spots and by enabling rapid response key to preventing costly breaches.

In third quarter, a multibillion-dollar holding company with numerous operating units in the sports and entertainment industries asked us to assess all of their disparate systems to determine if a threat was lingering in their environment. Leveraging the capabilities of Taegis, we've demonstrated the value of the speed to visibility of compromising their environment and of capabilities for automated response actions in real time. With the additional benefit of the ability to access a security expert in less than 1 minute via the Taegis UI chat feature, the customer subscribed to Taegis XDR to maintain their security posture going forward and added managed XDR to complement their team with additional security expertise.

Three, we are open without compromise. Why is this important? Because the one constant in technology is change, and security has to stay ahead of the curve while being a business enabler. Transparency and open interoperability have always been first-order principles for Taegis, and this is resonating with our customers and our partners. For example, EDR technology choice is one of the differentiators of Taegis. Unlike with other XDR providers, Taegis customers can leverage leading third-party endpoint solutions, or our own endpoint agent included natively with Taegis, but EDR or EDR-centric XDR is insufficient for holistic security visibility and effectiveness.

Year-to-date, less than half of the investigations on Taegis leveraged any endpoint telemetry. Point security solutions are no longer the answer to holistic visibility and effective security.

Another important difference in our open-without-compromise approach is that we design Taegis to be used collaboratively and transparently across customer teams, our MSSP partners, and security experts at Secureworks, all have the same visibility into the efficacy and actions in the platform, the detection sources, threat contact, investigation steps and more, working interoperably in real time.

Black box MDR solutions make it difficult for organizations to hold their vendor accountable because it's opaque as to how they are making decisions about threats in the environment. You'd never let your investment advisers send you only occasional reports with your returns without access to your underlying investments in trades. Why would anyone accept that from their MDR security provider?

Finally, customers choose Taegis for the measurable and superior return on investment. We demonstrate return on security investments across 3 primary areas: streamlining of security vendors and spends, the value of uptime of business operations and revenue streams and the ability to optimize investments in internal security teams. To make this point concrete, we recently won a global aviation manufacturing customer that was looking to reduce their overall risk with a more effective cyber defense program. This customer was able to reduce total direct security spend by approximately $500,000 annually by leveraging Taegis to drastically reduce false positive and by implementing a road map to rationalize other vendors and unify their security operations functions.

They had the added benefit of another $1.8 million in reduced cyber insurance and recovery costs, all while demonstrating for the first time a security posture protecting all of the 75 product lines driving their revenue. While it's clear that the market cannot solve security challenges with either people or point solutions alone, the XDR and even MDR markets are still early in the emergent stage, but awareness and momentum are accelerating. A recent study by Forrester showed that 47% of buyers were actively assessing and planning for an XDR implementation, while another 25% were interested but needed to further research XDR's capabilities. Taegis XDR is the unification and automation answer to today's security challenges, but the majority of the market lacks the security expertise to fully manage XDR independently.

We see customers choosing managed XDR as the better MDR solution, putting them on a path to achieve the benefits of XDR while addressing their security talent challenges. With the Taegis platform, Secureworks and our partners are delivering the most transparent, interoperable and open XDR and MDR solutions. Customers will increasingly demand better security at the same or lower total spend levels with fewer vendors to manage and fewer operational burdens on their team.

Taegis is well positioned to accomplish this for customers. As we keep our customers secure and do this at the highest possible ROI for them, our customers in the broader market will continue to choose Secureworks.

I want to thank our customers and partners for joining forces with us and thank our teammates for their hard work and commitment to realizing the Secureworks' mission to secure human progress.

With that, I'll turn the call over to Paul Parrish, our CFO, to discuss our third quarter results and the outlook for the fourth quarter and fiscal year 2023.

Thanks, Wendy. Taegis continues to gain traction in the market. ARR increased $99 million year-over-year to end Q3 at $222 million, representing year-over-year growth of 80%. We've added 800 customers since Q3 of last year, doubling over the prior year to end the quarter at 1,600 total Taegis customers. Taegis subscription revenue was $47.9 million for the quarter, up 100% year-over-year. And average revenue per Taegis customer was approximately $139,000, up sequentially from $136,000 in Q2 and remains a premium to our non-Taegis revenue per customer, which averages $77,000 per customer.

As we continue to grow our new business and re-solution other MSS customers on Taegis, we ended the third quarter with 65% of total ARR on Taegis, and now see Taegis expanding to nearly 80% of total ARR by the time we exit this fiscal year as we accelerate the transition from nonstrategic services to our Taegis-led business model.

On an overall basis, total revenue was $111 million in Q3, which was in our guidance range despite an approximately $1.5 million FX headwind. Overall, Q3 gross margins, at 63.3%, were roughly flat from the prior year Q3. We have been raising our voice and profile in the market this year with targeted investments in sales and marketing as we repositioned the company in the security market.

Sales and marketing costs have increased to 35.8% of revenue, up from 25.1% in Q3 of FY '22 and 33.8% in Q2. We also continue to differentiate our Taegis platform through innovation, working closely with our customers to deliver new features aligned to their security needs. R&D was 29% of revenue, up from 22.8% in the third quarter of last year and 26.7% of revenue in Q2.

G&A expenses were down in dollar terms compared to Q3 of the prior year as we continue to manage G&A in relation to our revenue. Adjusted EBITDA loss was $17.2 million compared to a $4.7 million gain in prior year Q3. The overall change of $22 million was driven by a combination of reduced other MSS revenue as we actively exit nonstrategic services and make targeted investments in support of our growth strategy.

Cash flow used by operations in 3Q fiscal '23 was $27 million compared with $11 million provided by operations in prior year Q3, and primarily reflects the impact of lower adjusted EBITDA. CapEx was $1 million for the quarter, relatively flat with the prior year.

We finished the quarter with a strong balance sheet, $139 million of cash, no debt and an untapped credit facility.

Turning to our guidance for FY '23. As both Wendy and I detailed earlier, we saw healthy growth in our Taegis solutions, which are helping drive better outcomes for customers on their most urgent security challenges, and our business model transformation continues to accelerate. We experienced incremental FX headwinds of $1.5 million in Q3, which, assuming it repeats in Q4, will be a total impact of $3 million to revenue for the second half of FY '23. In addition, nonstrategic revenue for our other MSS and other professional services revenues have transitioned slightly faster than previous guidance.

Given these combined impacts, we now expect full year revenue to be in the $456 million to $460 million range. Regarding Taegis ARR, we now expect to end FY '23 at $245 million or higher, reflecting the longer sales cycles and scrutiny on spending that has occurred with the macroeconomic uncertainty. We have updated the other MSS ARR component to now end FY '23 below $65 million. Of the approximately $65 million of ARR remaining at year-end, we continue to expect re-solution to be largely complete in FY '24, enabling us to eliminate duplicative costs to support other MSS platform and services.

We are holding our full year non-GAAP net loss in the $55 million to $59 million range, with EPS loss in the $0.63 to $0.69 range. Additionally, we have narrowed the following guidance ranges from our previous guidance. Full year adjusted EBITDA in the negative $64 million to $68 million range, which includes our investments in sales and marketing and R&D, reflecting our continued management of spend to revenue.

We now expect cash flow and operations to be in the $64 million and $68 million range. Regarding Q4, we expect revenue of $108 million to $112 million and an EPS loss in the $0.24 to $0.28 range. Please recall our fourth quarter of fiscal 2023 contains 1 extra week this year worth approximately $8 million of revenue.

I expect you have questions around FY '24, and while we will provide guidance with our fourth quarter results, I will highlight some of our current high-level thoughts.

We expect ongoing global macroeconomic factors, including slowing economic growth, inflation, rising interest rates and currency pressure to weigh on our customers, and, as a result, potentially their security spending intentions. These dynamics are creating a broader range of financial outcomes for our upcoming fiscal year. With what we know today, we will enter next year with a beginning overall quarterly revenue run rate not too different from our exiting Q4 run rate adjusted for the extra week. We expect Taegis and other MSS to continue to diverge from an overall revenue component perspective as Taegis grows while we wind down other MSS and nonstrategic parts of our professional services portfolio.

We are committed to actively managing our cost to proportion to our top line growth. We are making changes to our cost structure to align with our go-forward lines of business as we reach end-of-life for the majority of the other MSS business in February 2023.

In closing, FY '23 was a year of significant milestones in the company's expansion of its Taegis XDR platform and the acceleration of our business model transition. And our customers are clear that Taegis XDR is the right answer to address today's security challenges with an open platform approach that evolves seamlessly with their technology transformation, provides superior detection and unmatched response to prevent damaging security bridges and does so at an industry-leading return on investment.

Wendy will now join us again as we begin Q&A. Operator, can you please introduce the first question?

(Operator Instructions) The first question comes from the line of Saket Kalia from Barclays.

Okay. Great. Wendy, maybe just to start with you. I was wondering if you could just talk about how customers are approaching their MSS engagements in this macro. I mean, clearly, right, the re-solutioning effort there is going well. We mentioned the February 2023 end of life. But I wonder if the macro backdrop is affecting that decision at all to adopt solutions like Taegis just given the uncertainty around macro and the ease with solutions like MSS. Curious if you have any thoughts.

Sure. It's a great question, and we definitely see the market shifting. I sort of view it as both a challenge that turns into an opportunity for us, in particular, given the way Taegis is structured for customers. So what we see is that there are many more consolidation conversations that we view as an opportunity for us. And that's in terms of consolidation of vendors, where there are elements of Taegis that are inherent features and capabilities that don't require a secondary spend, and therefore, don't require secondary management.

And the other piece is clearly around operational efficiency and being able to create some optionality around their team as they can see through proof of values, the ability for them to drastically reduce the time wasted on sort of false positives and wasted alerts. Their ability to optimize their investment in talent, whether through a partner or on their own team on Taegis is pretty powerful. So the environment, while it is not great in terms of a lot of prospects and customers are seeing budget pressure just across their entire organization, all functions, it is an opportunity for us to demonstrate an accelerated road map toward security savings with higher efficacy that we think Taegis plays into nicely.

Got it. Got it. That makes a lot of sense. Paul, maybe for you, a bit of a minutia question. Clearly, the shift to SaaS ARR and away from MSS, I mean, speaks for itself. But I wonder, from a billings and invoicing perspective, as the shift to Taegis continues, can you talk about how that profile changes, if at all, between the 2? I'm just curious if that's different from a billings and invoicing perspective for Taegis versus MSS as we maybe model billings and deferred and cash flow?

Yes. Thanks for the question. And as you're describing what does billing becomes simpler, is it better under Taegis versus MSS and it is somewhere. Our customer is excited about how simple we present the invoicing now. Our percent collected upfront is better now. Customers are more willing with a product such as Taegis to pay upfront. And our overall average customer life remained roughly the same on the -- not the customer like the billing term, invoicing term between the 2 and the contract term -- average contract term for our sales disclosed in our 10-Q, 10-K is roughly 2 years. So that -- we're seeing that still play out for Taegis. So from a back office standpoint, we're pretty excited about it. And customers, how they look at our billings and invoicing, say it simpler and understandable.

The next question today comes from the line of Mike Cikos from Needham.

I wanted to circle up on the ARR guidance here. I know that we're taking down the Taegis ARR for the year as well as the other MSS ARR. And I know that you guys don't guide to it on a quarterly basis, we have those annuals, right? But can you provide some additional color for us? How much of the ARR guidance reduction that we're seeing for both Taegis and other MSS is coming from 3Q not meeting your internal expectations versus what you're seeing in 4Q, versus layering in any additional conservatism when we think about 4Q. Can you help us separate those 3 buckets as we look at the ARR guidance that we have today?

Yes. So as we laid out the original $265 million for Taegis, and we've laid that out with our Q2 call, and now as we're positioning at the end of Q3, there is a portion relates to a little bit less performance in Q3. We saw as we ended the -- toward the tail end of our end-of-life for other MSS decisions being made that are somewhat being delayed by customers, may end up with some exiting of those customers versus decisions made to re-solution or move over to the Taegis product. So there's a component of this that is made up of our existing customers, the willingness to move given the dynamics of what's going on in the economy, CapEx, FX continues to be an issue, and that becomes a component of this. So it's roughly $5 million of this $20 million change is FX. And then just for new logos, that piece of this equation, which we're all focused on, we're growing that piece of the business. We just see that reluctance given what's going on in the economy, customers delaying decisions. And so that's a chunk of those, too. And that's accelerating as we get further into the calendar this year.

Great. And I appreciate the color on Taegis here. Just want to make sure I'm doing the math right, and would be interested if you have the metrics handy. But for MSS specifically, so to exit the year, MSS ARR was, call it -- I'm sorry, to exit the quarter, MSS ARR was around $119 million. So I wanted to sanity check that. And then second, do you have the MSS customer count handy?

Yes. So it's roughly the same number of customers at the end of Q3, 1,600 for other MSS and 1,600 for Taegis.

Okay.

The average revenue per customer is $77,000 -- the average revenue per customer for other MSS is $77,000 and for Taegis is $139,000.

Our next question today comes from the line of Hamza Fodderwala from Morgan Stanley.

Paul, maybe to start with you just said the clarification, and I'm sorry if I missed this earlier, but of the guidance cut, could you just clarify how much of that is FX, macro or any other factors that I may have missed?

And let's make sure the guidance you're referring to is our ARR guidance? Is that what you're focused on?

Yes.

Because on our revenue guidance, the narrowing of the band on that.

Yes. Yes.

So ARR of $245 million and we have previously said $265 million we'd exit greater than $265 million, so we're now at $245 million or greater. So that $20 million reduction about half of it relates to the existing migration of customers off of other MSS to the product. So there are some delays, some of the hesitancy some customers deciding not to from our previous projections. Then there's FX and put that as maybe $5 million-ish for FX impacts because as we know from what's going on in the world, FX continues to have some drains in the certain geographic areas of the world. And then the last piece of this is our focus on new logos. And we believe we have momentum, but there's delays caused by what's going on in the economy, and that's another $5 million-ish of that delta.

Makes total sense.

Does that makes sense?

No, no, it makes total sense. And it's being seen across the board pretty much everywhere. So on that point, Wendy, just on the budgetary pressures, I'm curious, as you talk to customers and your partners, what sense do you get about security budgets for next year? Do you see them still growing at a healthy rate? And is this sort of macro pressure that we're seeing right now, just a function of perhaps projects taking longer? Or is it outright, maybe reductions in security budgets?

Sure. It's a good question. And while I don't have a crystal ball and, frankly, a lot of these prospects don't either, I'll sort of characterize the -- what we're seeing right now, which is Interestingly, kind of the pipeline, the front end. The pipeline remains healthy in terms of that growth. The time period of the sales cycle to get to the technical win, the perspective of security teams that they want to make the transition toward a kind of centralized XDR approach, those pieces haven't moderated.

As we talked about last time, and we saw this increasingly this quarter, what we see is it's more in the back end of the sales cycle, additional layers of scrutiny. And I think what we're really seeing in the market now is sort of budget absolutely freezing up kind of right towards the end. And that reflects, I would say, more uncertainty as different businesses are sort of trying to sort through what their growth opportunities are, and therefore, what they can invest next year.

And so the answer is, I couldn't say for certain with a great deal of evidence that those budgets are disappearing permanently. Right now, it feels more like they're kind of in a holding pattern as they sort out their own broader budgets. But that is where, as we lean into sort of the economic calculators of Taegis and help them with road maps around vendor consolidation and operational efficiency, that's the opportunity for us is to really lean into that aspect to give them that visibility to a better answer -- that's a better answer for us as well.

(Operator Instructions) the next question today comes from the line of Tal Liani from Bank of America.

You have Madeline on for Tal this morning. Just 2 quick questions for me. The first one, the average age of contract going up sequentially to $139,000 and just wondering in terms of the pipeline that you're seeing and macro deterioration across the board in security, how is that number changing throughout the pipeline? And then I have one follow-up question as well.

Sure. That number has remained strong and consistent, and it is higher than on average than a lot of our peers in the space. What we see there is that our approach to total coverage has helped us start with a higher average revenue per customer. And then as we've been increasing the number of modules that they take on the -- the customers take on the platform, we've seen our cross-sells actually be a bright spot of customers who know us and trust us see the opportunity and the risk reduction in their business have been increasing their existing spend with us. So the -- we don't see that moderating materially in the near term relative to our business model remains the same.

Got it. That leads me to my next question as well. So if we just break out the growth in Taegis, any chance you could break it out between new customers versus upsell, and also how you're thinking about modeling that out for next year as well?

Yes. So as we've referred to in the past, the upsell on existing customers moving over have been in that 20%-ish range, so we get 20% more from customers when they move from the other MSS to Taegis, and those numbers are continuing to hold. And as we continue to work our way through that bottom half or bottom end of this, a portion of that other MSS is moving. Of course, that's always the hardest part of the move, the tail end, but we don't see a dynamic playing out any different than we've already talked about. So it's playing out the same way. So we haven't put together a full thought channel next year, but we still see it playing out at least through this year and into next year playing out the same way.

And then as we look at the average between re-solutioning and what's coming from new logo, we've talked about it's slightly heavy to the customers moving for other MSS to Taegis right now versus new logo, but we're focused on that new logo being the go forward and the growth area of the Taegis.

And as we finish the re-solutioning, not quite done done, but largely complete outside of Japan at the end of this fiscal year, the account executives who have been working those customer transitions turn towards -- actually, they already have new territories to start to build a pipeline there. So that is part of that transition is just a focus shift for experienced Taegis sellers to move towards new patches as opposed to moving existing customers. So that mix will shift as we head into next year.

There are no further questions at this time. Mr. Toomey, I turn the call back over to you.

Okay. Thank you. That wraps the Q&A and today's call. A replay of this webcast will be available on our Investor Relations page at secureworks.com, along with our Q3 web deck and additional financial tables. Thanks again for joining us today.

This concludes today's conference call. You may now disconnect your lines.