SecureWorks Corp (SCWX) 2023 Q4 法說會逐字稿

Good morning, everyone. My name is Bruno, and I will be your conference operator of today. At this time, I would like to welcome everyone to the SecureWorks Fourth Quarter and Full Year Fiscal 2023 financial results. (Operator Instructions) A supplemental slide presentation to accompany the prepared remarks can be found on the company's website. (Operator Instructions) At this time, I would like to turn the call over to Kevin Toomey, SecureWorks Vice President of Investor Relations. Mr Toomey, you may begin your conference.

Thanks, everyone, for joining us. With me this morning are Wendy Thomas, our CEO; and Paul Parrish, our CFO. During this call, unless otherwise indicated, we will reference non-GAAP financial measures. You will find the reconciliations between these GAAP and non-GAAP measures in the press release and presentation posted on our website earlier today. Please also note that all growth percentages refer to year-over-year changes unless otherwise specified.

Finally, I'd like to remind you that all statements made during this call that relate to future results and events are forward-looking statements based on current expectations. Actual results and events could differ materially from those projected due to a number of risks and uncertainties, which are discussed in our press release, web deck and SEC filings. We assume no obligation to update our forward-looking statements.

Now I'll turn the call over to SecureWorks CEO, Wendy Thomas.

Thank you, Kevin, and welcome, everyone. SecureWorks continues to deliver strong growth from our Taegis XDR solutions. Taegis revenue grew 120% year-over-year during fiscal 2023, with full year revenue reaching $188 million. 2,000 Taegis customers are now seeing the benefits of our XDR based approach to manage detection and response, up 400 from third quarter.

Taegis annual recurring revenue grew 58% year-over-year to $261 million. As an important indication of the acceleration of our business transformation, Taegis ARR now represents over 80% of our total ARR, up from 42% of the total at the end of the previous year, and we expect the mix of other MSS ARR to be minimal by year-end, approximately 5% of the total, primarily in Japan.

Reflecting on our business transition, when we began building Taegis, the XDR market didn't exist. We were building a technology platform to enable solutions that solved pressing customer needs, better security for their spend with fewer vendors to manage and a step function reduction in the SecOps burden on their teams from false alerts and a lack of automated containment.

As the possibilities of XDR become clear to the market, our vision remains to be the XDR platform that is fundamentally open, one that evolves seamlessly with customers' technology changes and one that provides superior detection and unmatched response to prevent damaging security breaches, all in an industry-leading return on investment.

And Taegis' unique approach to drive superior security outcomes is resonating with the market. Since launching Taegis in 2020, we've delivered a 3-year compound annual growth rate of 156% in Taegis ARR.

Let me dive in a bit more on what makes Taegis distinct in addressing customer security challenges across 4 categories. The first pillar that differentiates Taegis from other solutions is its superior detection capabilities. Detection is more than finding everything that poses a threat.

It's about finding and prioritizing the most potentially impactful threats. We refer to this as finding the signal despite the alert noise. Over the last year, Taegis filtered 99% of the high and critical alerts generated from third-party point security products as false positives.

And while Taegis is a powerful filter of noisy point solutions with a full coverage approach to XDR, Taegis regularly find malicious activity that other point products miss. Taegis' telemetry normalization techniques and proprietary algorithms detects threat actor behavior based on our proprietary knowledge of their tactics and techniques.

In fact, this past quarter, we shared details of our approach through the CTU Threat Graph, our proprietary data warehouse, with detection algorithms powered by more than 40 billion unique threat and knowledge nodes continuously updated by our in-house team of threat researchers.

Much of the industry threat intelligence is published in a way that is difficult for most organizations to apply to their protection with machine-readable threat intelligence updating our Taegis detectors every hour.

Taegis power superior detection with unmatched feed. To share a real-world example of how this resonates, a global manufacturing customer with a small in-house security team recently licensed Taegis. With their previous security services provider, they had no visibility into the effectiveness and they knew that their vulnerability management had not been keeping pace.

They were concerned about the risk of a breach. After deploying Taegis, the platform quickly detected suspicious remote access activity to a specific device. This immediate detection, coupled with proactive monthly threat hunts included in the Taegis subscription, quickly demonstrated the value of our integrated approach, the detection of malicious activity that other solutions miss and customer confidence in their ongoing security with Taegis.

Second, we continue to hear from customers that Taegis provides an unmatched level of response. The majority of security response actions across cloud, identity, network and endpoint infrastructure occur automatically through the native store capabilities in the Taegis platform.

These capabilities are augmented and curated by our team of SecOps experts on behalf of partners and customers and are informed by the thousands of incident investigations and responses performed at the Taegis platform each year. As an example, customers benefit from automated workflow that can simultaneously disable user logins in AWS while isolating relevant endpoint hosts when a critical risk is detected.

SecureWorks has been using machine learning to maximize the performance of our detectors for several years. We found that over time the quantity and quality of data drives machine learning model performance. The good news is we have more than we need with 650 [billion] real-world events per day and thousands of incident responses each year.

The proven combination of Taegis' holistic detection and automated response capabilities led to a deal recently won with an international health care company that was frustrated with their existing SIEM solution. With the burden of maintaining integration for security monitoring and a lack of automated investigations, their small team was stretched beyond capacity.

Taegis enabled them to focus on real cyber threats without adding to their security team while addressing their log management needs for less total spend. The added capability of the platform to help them proactively and continuously understand and optimize their security posture in comparison to industry peers was a key selling point to their executive team.

Three, Taegis is open without compromise. We designed Taegis to address the reality and complexity of customer technology environments. Many customers come to us with endpoint technologies from multiple vendors deployed simultaneously across their organizations. Additionally, we see teams who manage across hybrid and multi-cloud environments.

Unlike other XDR or EDR platforms, we design Taegis to excel in detections across these mixed environments with the proven ability to automate sophisticated response actions, all from a single pane of glass. This means better, faster protection with scaled use of security resources.

And we continue to make investments to protect even more customer attack services. For example, we recently announced enhanced integrations with Google Cloud Platform and Google Workspace. Extended support for Google environment enhances alert visibility and traceability delivering a simplified workflow for SOC analysts.

I'll share a story from a recently signed deal with a financial services firm, who had found gaps in their endpoint-centric solution during a security assessment and also had a small in-house IT team that was overburdened with alerts.

Taegis not only provided better protection for their entire technology estate, including endpoint network and cloud, but also answered their need for retention and centralization of log data with the ease of deployment and the valuable MDR partner that SecureWorks brought to the table, they were quickly able to optimize their spend, provide relief to their team while delivering better security outcomes to their business.

Finally, customers choose Taegis for the measurable and superior return on investment. To help customers demonstrate the value of security investments to their leadership team, SecureWorks launched a new Security Posture Dashboard in Taegis. The dashboard is dynamic, enabling customers to regularly monitor, maintain and improve their readiness in the face of ongoing security alerts and do so in real-time comparison to others in their industry.

Let me share a customer story. We recently signed with a global provider of insurance and reinsurance solutions. This customer needed to defend itself and its clients' data by proactively anticipating cybersecurity threats, protecting their brand from reputation damaging breaches.

But they were also excited about the opportunity to drive new revenue opportunities by developing safe and secure cloud applications offered as a service to their existing customers. They shared with us that Taegis enabled them direct savings of at least $750,000 per year and potential cost avoidance of up to $100 million from a breach and that their productivity was enhanced by approximately $375,000 a year due to an increase in their team's productivity.

And as a provider of cybersecurity insurance, the customer is looking ahead to the benefit of increasing revenue and reduce cyber breaches from Taegis-based offerings they will license to their customers. As we look at the security challenges that organizations face, we see that technology alone cannot solve all of the challenges.

Many organizations struggle with a shortage of security talent and the diversity of skills needed to effectively manage security programs. Our product, Taegis XDR, was created to address these challenges.

Taegis has embedded orchestration and a collaborative interfacing workflow designed to enable transparency and collaboration across customer teams, our partners and our security experts. This allows everyone to work together in real-time to the same information making the security program more effective no matter how it is delivered.

Our unique open approach allows us to bring customers XDR-based MDR across multiple go-to-market paths. First, we partner with solution providers to sell Taegis with SecureWorks provided MDR.

Second, managed services providers sell and deliver Taegis-powered MDR to their end customers under their brand. We now have multiple MSSP partners who are building their business on Taegis because we have demonstrated a compelling return on investment. This is a growing opportunity for our business and a focus of our long-term strategy.

Third, enterprise customers who have their own SOC capabilities or who intend to grow their teams over time to a full-time SOC, use Taegis to filter the signal from the noise, automate investigations and response capabilities, hunt and manage the workflow.

These customers know that Taegis list them automate the mundane and focus on adding value in security experts. In summary, our strategy is for our XDR platform to power industry-leading MDR capabilities, allowing us to grow our customer base and be the platform of choice as the XDR market matures.

Let me change gears and talk about our path to profitability as we near the end of our business model shift. For the past few years, we have effectively been managing 2 distinct businesses. Making investments in a growing higher-margin SaaS subscription business while winding down our other MSS and outsourcing services lines of business.

With the acceleration last year in our transformation, we have also been actively managing down our cost structure as we sunset those lines of business. With the end of life and other MSS services outside of Japan effective February 3 of this year, we announced a workforce reduction of approximately 9%, a key step in aligning our expense base to our go-forward business.

With the continued growth and scale that our Taegis platform brings, and our ability to reduce the remaining duplicative cost structures over the course of this fiscal year, we expect to exit fourth quarter of fiscal '24 near breakeven EBITDA, setting us up for growing profitability in our go-forward business in fiscal '25.

I want to thank our customers and partners for joining forces with us, and I thank our teammates for their hard work and commitment to the SecureWorks' mission of securing human progress. In addition, I'd like to thank Paul, our CFO, who last month announced his intent to retire from SecureWorks.

Paul joined SecureWorks shortly after we launched Taegis, bringing highly relevant experience in the SaaS space, leading similar business transformations. He's led our finance and accounting team with absolute integrity in our financial reporting and business operations with a lasting impact on our transformation team that we can all be proud of.

We have an active search underway and expect to announce an appointment prior to Paul's retirement to ensure a smooth transition. Paul has been a valued partner, and I'm grateful for his leadership.

And with that, I'll turn the call over to Paul Parrish, our CFO, to discuss our fourth quarter results and outlook for the first quarter and fiscal year 2024.

Thanks, Wendy. After nearly 41 years in the industry, I made the decision to retire, and I'm looking forward to the next chapter in my life. It's been an honor to have served as CFO of SecureWorks during such a pivotal time in the security industry, and I thank all of my teammates and peers at SecureWorks for this opportunity.

Taegis showed continued strong growth in the quarter. Taegis subscription revenue was $60.2 million for the fourth quarter, up 106% year-over-year. For the full fiscal year 2023, Taegis revenue was $188 million, growing 120% year-over-year. ARR increased $97 million year-over-year to end Q4 at $261 million, representing year-over-year growth of 58%.

Taegis ARR was driven partly by stronger resolutioning, upsell and cross-sell. We added 800 customers since Q4 of last year to end the year at 2,000 total Taegis customers. An average revenue per Taegis customer was approximately $132,000, a meaningful premium to the overall industry average.

It is important to note also that ARPC is similar for new Taegis customer additions and resolution customers. An important milestone we set out this year to achieve ARR from the Taegis platform, contributing more than 75% of total subscription ARR.

We're happy to report that we ended the fourth quarter at 82% of ARR from our Taegis platform, up from 42% at the beginning of FY '23. Approximately 5% will remain by the end of FY '24, enabling us to address our duplicative cost structure over the course of the year.

Total revenue was $115 million in Q4, which was above the high end of our guidance of $110 million to $112 million, driven by outperformance in both subscription and professional services revenues.

In Q4, our total gross profits decrease due to the revenue declines associated with the end of life for our nonstrategic services. We were able to keep gross margins relatively flat by continuing to scale Taegis as the other MSS business descales into sunset.

Subscription gross margins, including both Taegis and other MSS, were 69.4% better than Q3 subscription gross margins of 68.3% with the mix shift to Taegis. Q4 Professional Services adjusted gross margins of 42.8% were down slightly from Q4 in prior year.

As we continue to focus our Professional Service offerings on Taegis adjacent services, our Professional Service's revenue now represents only 21% of our total revenue, in line with our revenue mix objectives.

Sales and marketing expense in Q4 was similar to the prior year quarter. The increase to 35% of revenue from 29.9% in Q4 of FY '22 is due to the change in total revenue associated with the end of life for our nonstrategic services.

Our investments in sales and marketing have increased our recognition as a leading XDR platform and MDR provider and supported our transition to a partner-first model. R&D expense was 29.8% of revenue, up from 22.6% in the fourth quarter of last year.

Our Taegis investments reflect the launch of integrations, capabilities and features aligned directly to feedback from our partners and customers. Total G&A expense as compared to the prior year Q4 reflects the impact of the benefit realized in Q4 FY '22 from the timing of expense accruals during FY '22.

G&A was 17% of revenue, up from 12.3% in Q4 last year, which also reflects the decline in revenue affecting the percentage. Adjusted EBITDA loss was $19.7 million compared to a $2.1 million gain in prior year Q4.

The overall change was driven by a combination of lower gross profits of $8 million and the remainder is related to operating expense items I've just discussed. In Q4 of FY '23, adjusted EBITDA excludes $15.5 million of onetime reorganization cost consisting primarily of severance and other termination benefits and real estate reduction related expenses.

Cash flow provided by operations in Q4 FY '23 was $6 million compared with $19 million provided by operations in prior Q4, which primarily reflects the impact of lower adjusted EBITDA. CapEx was $1 million for the quarter, relatively flat with the prior year. We finished the quarter with a strong balance sheet, $143.5 million of cash, no debt and an untapped credit facility.

Turning to our guidance for FY '24. We expect Taegis ARR to end FY '24 at $300 million or higher. We expect other MSS ARR to represent approximately 5% of total ARR at the end of FY '24. We expect full year total revenue to be $380 million to $400 million with the first quarter revenue of $96 million to $98 million.

Keep in mind, we had a 53-week year in FY '23 compared to 52 weeks in FY '24. We expect full year Taegis revenue to be $270 million to $280 million. Taegis subscription gross margins are expected to increase in FY '24 and beyond. The benefit of that within total gross margin will be offset by the duplicative fixed and transition cost as we sunset support for our other MSS services.

Full year adjusted EBITDA range is expected to be between negative $29 million to $39 million. This guidance reflects the following expectations. Sales and marketing as a percent of revenue is expected to decline modestly in FY '24. Our investment in R&D will remain flat as a percentage of the lower revenue base as we continue to lower our engineering support cost for our other MSS business.

G&A spend will decline and expected to remain flat as a percentage of revenue year-over-year. Operating expenses in FY '24 should decrease on an absolute basis as we manage the cost in proportion to the revenue opportunity. We estimate there is approximately $25 million of duplicative fixed and transition-related cost that we are incurring with $15 million in cost of revenues and $10 million in OpEx.

As we turn down our other MSS services, we will manage the related cost out, positively impacting FY '24 and FY '25. As we accelerate the sunset of other MSS and benefit from scale in our Taegis-centric go forward business, we expect to be near breakeven EBITDA in the fourth quarter of FY '24. As we exit this year, our business will have the transition behind us with a path to EBITDA profitability in the following fiscal year.

Finally, EPS loss is expected to be in the $0.26 to $0.35 range.

In summary, FY '23 was a year of significant milestones in the company expansion of its Taegis XDR platform and FY '24 is the year that we will begin to reflect a shift in our business mix and growth potential from our go-forward business.

Wendy will now join us again as we begin Q&A. Operator, can you please introduce the first question.

(Operator Instructions) Our first question comes from Saket Kalia from Barclays.

Okay. It's Saket from Barclays. Paul, congrats on your next chapter.

Thank you.

Sure. Wendy, maybe I'll start with you. You had an example or 2 of SIEM displacements in your prepared remarks. Maybe the question for you, Wendy, is how do you think about the velocity of SIEM displacements in the industry right now? And related to that, do you feel like that Taegis is getting enough reference customers here where the sales cycles are maybe getting a little shorter or at the very least, more predictable?

Yes, it's a great question. I think we're just at the beginning edge of this opportunity of transition and displacement. I think there's 2 questions that we've seen with customers as they're going into this.

The first 1 was, well, is XDR a better solution? What is this? How does it work? And I can talk a little bit about that. And the second one is how do I transition smoothly with no risk, no gaps, no bad experience for the end user.

And so on the solution front, obviously, as the XDR market is getting much more recognition, attraction sort of third-party validation, the elements of better economics, better security effectiveness and better efficiency of SecOps teams has proven true, right?

Log retention included in the base price of XDR without any surprise. Data overages, those types of things really hit the economics and predictability. The tune detections and the filtering of noise of Taegis in particular speaks to the effectiveness. And then the embedded orchestration, investigation, hunting response in the workflow to really drive the SecOps efficiency. So I think that part is becoming pretty clear.

The second part is where we have a unique advantage and that's because we have been resolutioning customers to Taegis for the last couple of years. And the playbooks, the customer referenceability, the eye towards either the end user experience or in the case of MSSPs, their customer experience, we can demonstrate the ways that we make that an incredibly smooth and risk-free and good experience transition has played well not just with SIEM customers, but particularly with MSSPs who want to make that transition. And that's where we are uniquely positioned in terms of those referenceable customers and frankly, tactics (inaudible) that the customers can get comfortable with.

Got it. Got it. That makes a lot of sense. Paul, maybe for you. I think you touched on this a little bit at the end of your prepared comments, but just to maybe ask the question slightly differently. Can we just talk about how big MSS revenue is expected to be in fiscal '24? I know we said it's going to be about 5% of ARR. But just remind us how big MSS revenue should be here in fiscal '24? I think it's primarily going to be Japan. And maybe as part of that, I know you talked about sort of the -- I think, a gross margin sort of trajectory, right? But if you just look at the gross margins on Taegis versus other MS -- or actually, if you just look at the gross margin on Taegis, if MSS were to go to sort of 0 right over time, what does that gross margin look like just in the Taegis business?

Yes. Thanks for the question. As I pointed out in the prepared remarks, Taegis revenue is going to be $270 million to $280 million for the year and our overall revenue is $380 million to $400 million.

So think of Taegis being about 70% of our overall revenue and our Professional Services are running somewhere close to 20%, plus or minus a couple of percentage points. And so that leaves the other MSS in that 10% range, plus or minus a couple of percent during the year. And see that ramping down that revenue during the year as nonstrategic services, other MSS rolls off. And gross margins in there, Taegis is running higher than other MSS, but we have the drag on our other MSS of duplicative services as well as just the descaling of our other MSS as it rolls toward the tail end of this.

So you're going to see the true impact of our Taegis revenues as we excel out into FY -- the following year, FY '25. So we're not providing specifically that individual guidance around gross margins between Taegis and other MSS, but see the benefit as we roll into FY '25 of having Taegis margins.

We have our next question from Mike Cikos from Needham.

Great. And I had a question, really, first on housekeeping, but can you give us what the MSS customer count and the total subscription customer count was exiting fiscal '23?

Yes. So total customer count is 4,500. Taegis customer count is 2,000. Other MSS is 700. Subscription customer is 2,500.

Got it. One of the things that I'm trying to back into here, I guess, if I look at the $96 million that Taegis just generated the net new ARR over the course of fiscal '23, is there a way for us to think about how much of that net new ARR was from migrating existing customers versus landing and addressing new customers that previously weren't on the SecureWorks platform?

Yes. So it's somewhere in that 40-ish percentile was the new logo cross-sell-type activity. The resolutioning side of that 60-ish percentage points, a little bit less than that, was resolutioning as we exited Q4. And we've talked about that in earlier quarters that, that mix was slightly off of that 50-50 that we were projecting for the year, but slightly high on resolution in Q4, but very similar to Q3.

And as we project out into FY '24, we're seeing 85% of our growth coming from our new logo cross-sell, organic growth. And so we still have a small portion, mainly Japan, to resolution, and that's going to be what making about 15% of that growth.

Got it. And I think you're probably answering my next question already, but I just want to stress test it here. So if I think about Taegis ARR guidance in the out year expected to be at least $300 million and we're seeing -- which implies that at the low end $40 million in net new ARR over the course of fiscal '24. If I compare that $40 million in fiscal '24 to the $96 million in fiscal '23, the reason for that delta is really just because we've done a good job resolutioning a large chunk of the customers. And really, the focus now is going to be much more on landing new logos with Taegis. Is that a fair characterization? Or is there anything else that I should be thinking through there?

No, you're right. We're focused on new customers and cross-selling our existing customers, selling more additional features and functionality to existing customers.

Got it. Got it. And then 1 more, if I could. But on the revenue, I guess you guys have delivered this outperformance in Q4. If I go back a quarter, you guys had said you were expecting about a $1.5 million headwind from FX. Can you just remind us, did that $1.5 million essentially play out or was there any movement there to think about when trying to diagnose the upside you delivered?

Yes. FX actually swung a little bit in our favor. Wasn't the big headwind we expected going into Q4, but it's continuing to blow the directions on FX. So we don't see it as a big tailwind coming into this year, but I'm not guessing what FX is doing.

Our next question comes from Madeline Brooks from Bank of America.

Just 2 here for me. I guess the first with the restructuring and then thinking about how we try and reaccelerate growth once the transition is complete, do you feel comfortable that the staff that you have now, especially from a go-to-market perspective, we'll be able to deliver on growth once we do get past some of these economic headwinds?

And then my second question to you is just a follow-up on the net new customers. Is there any chance that you're providing complete net new customers outside of cross-sell?

Let me take the first one, and then I'll let you take the second one. So in terms of the restructuring, think about -- and then I'll answer the sales kind of headcount. We have essentially 2 businesses that we are managing through. Obviously, the restructuring is related to the end-of-life date for our other MSS business outside of Japan, February 3, and so the -- obviously, the staffing and the cost structure related to that. We had a set of restructuring actions related to manage our cost structure down relative to the sunset of many of those lines of business.

And we will continue to manage that process as we end this year with, as Paul said, less than 5% of the ARR on the other MSS revenue line. When you then separate that out, there's other parts of the business, of course, where we are growing the organization, a different set of field sets, sales is certainly 1 of those.

One of the key things for us on the sales and marketing side is that we had a number of sales professionals who were focused on resolutioning. So not quite 1/3 of our quota-carrying headcount, and we transitioned those at the end of the year, again, outside of a handful in Japan to hunting to new territories where they also can benefit from cross-sell and upsell opportunities as well, but their primary role is focused on new business from new customers.

So we get sort of a lift, if you will, in terms of hunting new from that transition as they ramp their territories, but in total, that's remaining about the same as it was before the total sales quota-carrying headcount.

And then for the split of new logo and cross-sell, we're thinking about half and half between the new logos and cross-sell and that's how we get our sights set for FY '24.

We currently have no further questions. I would like to hand back to Mr. Toomey for final remarks.

Great. Now that wraps the Q&A on today's call. A replay of this webcast will be available on our Investor Relations page at secureworks.com along with our Q4 supplemental deck with additional financial tables. Thanks again for joining us today.

Ladies and gentlemen, this concludes today's call. You can now disconnect your lines. Thank you.