Rapid7, Inc. (RPD) Q1 2016 Earnings Report, Transcript and Summary

Ladies and gentlemen, thank you for standing by. Welcome to the Rapid7 first quarter 2016 earnings call. [Operator Instructions] As a reminder, this conference is being recorded. I would like to now turn the conference over to the company. Please go ahead.

Thank you, operator, and good afternoon, everyone. This is Steven Gatoff, CFO of Rapid7. I wanted to take a quick moment to introduce you to Mark Donohue who recently joined Rapid7 in the newly created position of Vice President of Treasury and Investor Relations. We are excited to have Mark join the team here and he brings a terrific background and skill-set to the company and to our stockholders. We also want to take the opportunity to thank Anita Gopalan, our Controller and VP Finance who did an excellent job building and running our Investor Relations function from scratch through to our IPO. Now that she has taken on additional responsibilities for FP&A, she too is thrilled to have Mark here on the team. Mark?

Thank you, Steven. I appreciate the warm welcome I've received a Rapid7 from both you and Corey, as well as the rest of the company. I'm honored and excited to be part of the strong team and I see many great things ahead for Rapid7. It is an exciting time in the security market and I believe our positioning and product portfolio in the security data and analytics space is both impressive and compelling. I look forward to working closely with the investor community to share our story and long-term vision. Now on to the business of our call today. I'd like to thank you for joining us to discuss our Q1 2016 financial and operating results. I am on the call today with our CEO, Corey Thomas and as you've already heard, our CFO, Steven Gatoff. We distributed our Q1 2016 earnings press release over the wire and have posted it on our website at investors.rapid7.com. We have also posted our Q1 2016 results earnings presentation along with an updated company presentation on our investors’ website as well. This call is being webcast at investors.rapid7.com and a replay will be available on our website. We would like to bring the following to your attention. The date of this call is May 11, 2016. Our discussion today may contain forward-looking statements about events and circumstances that have not yet occurred including, without limitations, statements regarding future market conditions and management’s plan and objectives for future operation and Rapid7’s future financial and business performance. Statements containing words such as will, expect, anticipate, believe, plan, intend, should and other statements in the future tense are intended to identify such forward-looking statements. Actual outcomes and results may differ materially from the expectations contained in these statements due to a number of risks and uncertainties, including those contained in the risk factors section of our Annual Report on Form 10-K for the year ended December 31, 2015 and filed with the Securities and Exchange Commission on March 10, 2016 and in our future filings. The information provided on the conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements and reported results should not be considered as an indication of future performance. All information provided on this call is as of today May 11, 2016 and Rapid7 does not assume any obligation to update the information presented on this conference call except to the extent required by applicable law. On this call we'll provide and talk about our results using non-GAAP financial measures and provide non-GAAP guidance. The presentation of non-GAAP financial information is not meant to be considered in isolation or as a substitute for the directly comparable financial measures prepared in accordance with GAAP. We provided a reconciliation of the historical non-GAAP financial measures to the most comparable GAAP measures in the financial statement tables included in the press release announcing our results. The press release announcing our financial results is available on our website at investors.rapid7.com With that I'd like to turn the call over to Corey.

Thank you, Mark. Good afternoon, everyone. I'd like to start by thanking you all for joining us today on our first quarter 2016 conference call. We are pleased to report that we had a strong first quarter with revenue growth of 48% year-over-year. Importantly, we are focused on running the business and we are continuing to make good progress on the three key objectives that I discussed last quarter, expanding the threat exposure management opportunities, disrupting the traditional sale market and driving scale and leverage as we build our business. During the first quarter we generated strong demand for our threat exposure management offering as customers focused on improving the productivity and efficiency of security teams with better analytics. We saw particular strength in the mid-market in driving customer data to transition Intel, MBM customers to Rapid7 solutions. However, our biggest focus for the first quarter was successfully launching our new InsightIDR platform as the primary replacement for SIEMs which are undergoing a major upgrade cycle. In addition to the strong revenue growth, the results of these efforts is that our whole portfolio has been very well received in the marketplace resulting in the strongest and highest quality pipeline in the history of the company. This sets the foundation for strong billings in the second half of the year as we expected. Exiting the first quarter 2016 we have confidence in our ability to execute during the rest of the year and generate positive operating and free cash flow. We continue to see positive trends in the security, data analytics market that are driving the momentum in our business. For organizations of all sizes, in all areas of the world, the risk of compromise continues to proliferate as IT environments become increasingly distributed and complex and cyber crimes remains highly lucrative. Work-related situations, many security professionals have deployed point solutions over the years that have created silos in the IT environment and ultimately blind spots that attackers can exploit. A core issue in today’s IT environment is that traditional security programs primarily reflect static rules to identify threats. These rules are based largely on compilation of historical observations which continually need to be updated. This is an expensive and tactical undertaking that is only as good at the last known attack. This approach can also generate thousands of alerts placing a great burden on IT organizations. For instance, if an employee accesses the website with multiple services and advertisements, sends or sees an email with multiple recipient attachments, or utilizes cloud-based applications, each of these normal business activities could trigger hundreds of security events. Currently across our customer base an average employee might generate upwards of 100,000 security events per day which translates into tens of millions of security events per year and rising. What is becoming increasingly clear is that the evolving IT environment leaves organizations exposed to security risk that are too cumbersome to make through traditional means. Security risk has garnered increased attention at the highest levels of organizations including the Board of Directors. Spencer Stuart recently published their 2016 Board of Directors Survey and cited cyber-security as one of the top of three issues on board’s minds in 2016 along with the economy and the regulatory environment. This lends credence to the wallet shift we are seeing in overall security spending in favor of a consolidated approach focused on data, analytics and automation. We believe the key to successful security programs is to deliver a differentiated solution that identifies anomalies, require an investigation or immediate action as quickly and actively as possible. Rapid7’s core value proposition is manifested in our ability to leverage multiple types of enterprise-wide data to dynamically protect the IP environment. Log data endpoints are very important but are far less helpful in isolation. Rapid7 brings vast amounts and types of data together through a single, well-integrated platform designed to handle high volumes of contextualized data, perform behavior analytics and achieve actionable results with fast search. Our customers continue to tell us that they see this as a game changer for the traditional static and rules based solutions in the marketplace today. While some competitors try to capitalize on the volume of data, we believe that the pay per volume provide approach driving customers to use their own data and tools that have scale and will eventually lead customers in the predicament of deciding between increased security risks overpaying to secure their environment. We have designed an architecture that leverages the power of high volumes of data that drive customer value in a cost-effective way. We’ve seen our solutions display as many as three legacy competitive products at once as organizations recognize the need to eliminate the fragmented security models of the past. With ever-changing attack surface, our threat exposure management solutions continue to evolve to provide industry-leading vulnerability management with ongoing attack simulation, deep risk analytics and web application testing. This approach help security professionals to quickly detect and prioritize the most critical vulnerabilities upon which to execute remediation to reduce business and operational risk. In particular, our AppSpider solution has seen strong demand as security professionals look to ensure that they are addressing their own web application risk. Web application attacks remain the most common attack vector representing 40% of all reported security incidents. According to 2016 Verizon data breach investigation report, the threat of invalidated inputs remains a critical problem for web applications which are evolving at very fast pace. Rapid7’s AppSpider solution specializes in testing complex and dynamic applications leveraging sophisticated automation techniques to effectively test inputs. This is a prime example of how we are strengthening our threat exposure management offerings and why we're winning market share by expanding the scope of traditional vulnerability management. We don’t design our solutions simply to identify every possible risk. We focus on the outcomes. We employ analytics to ensure business can focus on what will have the most impact. We also continue to see and make significant progress in our goal to both disrupt and expand the traditional SIEM market. This past quarter we launched our InsightIDR solution. InsightIDR uses next-generation behavioral analytics and fast search to address challenges faced by SIEM offerings. Traditionally SIEMs have built and been built for compliance based on static rules. That can overwhelm security professionals with alerts and make it difficult to hone in on the key indicators of compromise. InsightIDR eliminates the noise of heavy alert volume and greatly improves the effectiveness of IT teams. Our solution quickly identifies key compromises as they occur and provides the endpoint forensics and search, which security teams need to investigate so they can move to containment in hours versus days or months. With the SIEM market on the cusp of an upgrade cycle, we believe Rapid7 is well positioned to take advantage of this significant market opportunity. We have already seen great traction for InsightIDR with new customer wins including the following. A financial advisory firm headquartered in the mid-Atlantic deployed InsightIDR in Q1 as an alternative to their existing and inefficient SIEM solution. The capability of our product was immediately recognized by their Chief Information Security Officer who had been accustomed to traditional products that require significant time to mainly write and fine tune rules. They applauded the breadth and depth of our prebuilt detection analytics as well as the fast time to deployment, which helped get their team up and running in days versus their typical experience of weeks to months. We also signed a three year deal with a company in Central Europe that specializes in technology for the healthcare industry. This customer has extensive experience in deploying security programs. We set up, deployed and completed the rollout in just a few weeks, resulting enhanced speed back on the customer. Their Chief Information Security Officer informed us that InsightIDR had given him everything he ever wanted to get from his SIEM, but had never managed to get. Finally, in terms of driving scale and leverage. We remain focused on closely managing our spend to ensure we're building our business to achieve profitability. Our key initiatives are in support of product innovation, relentless focus on customer success and revenue generation. I'm very pleased with the progress we've made executing against our objectives this quarter as well as the strong pipeline we're building across our entire portfolio. With that, I'll turn the call over to Steven.

Thanks, Corey. Good afternoon, everyone. We appreciate you joining us. We’re glad to provide you detailed color around our Q1 financial results and walk you through our guidance for Q2 and the full year 2016. As always, we’ll wrap up by opening the call to your questions. Reviewing our Q1 performance, three highlights stand out. First, we delivered strong revenue and deferred revenue growth year-over-year. Second, we continued to successfully execute our land and expand strategy with strong renewal rates. And third, we continued to make progress on our path to profitability through thoughtfully scaling the business and disciplined cost management. Diving into the numbers, Q1 total revenue came in at $34.8 million, a strong increase of 48% year-over-year and above the high-end of our guidance. Products revenue also increased 48% year-over-year, driven by increasing demand for our unique security data and analytics offerings. Maintenance and support revenue grew 45% year-over-year and our professional services revenue increased 52% year-over-year, largely driven by our differentiated security advisory services, which continue to generate strong demand. Looking at our business geographically, North America revenue grew 48% year-over-year and represented 87% of revenue on continued strong growth and customer adoption. Internationally, we delivered solid results as well, growing 45% and contributing 13% of total revenue in Q1. Our channel partners continue to play a nice role in our ecosystem and contributed a fairly consistent 37% to total revenue in the first quarter. With 86% of Q1 revenue already on our balance sheet as of the first day of the quarter and 61% of our revenue being subscription-based recurring in nature, we continue to have very high visibility into our revenue forecast. With that context, total deferred revenue grew 49% year-over-year, coming in at $131.9 million at the end of Q1. Implied billings for the first quarter contributed to the strong result, with growth of 34% [ph] year-over-year in range with our expectations given the seasonal trends in our business. And, so far as the business metrics driving these results, weighted average contract length was 22 months in Q1, a modest change compared to 24 months in the year ago period. As we've discussed, average contract length fluctuates a bit primarily due to some lumpiness and large deal sizes. With regard to billing seasonality, we’ve typically seen about 40% occur in the first half of the year and about 60% of billings occur in the second half. For 2016, we expect billings to be 1 to 2 points higher in the second half of the year, largely as a result of our Q1 launch and strong pipeline of InsightIDR as well as the good traction that's building with Intel MVM customer migrations. On the customer front, we had another quarter of strong year-over-year new customer growth with our total customer base increasing by approximately 37%, as we added Q1 with more than 5,300 customers globally at the end of the quarter. This includes the addition of approximately 350 new customers from the Logentries’ IT search business that we acquired in October 2015. We continue to see large enterprise adoption and now have 36% of the Fortune 1000 as customers of Rapid7, up from 33% a year ago on their rebalanced definition of the index. In Q1, revenue from enterprise accounts grew 41% year-over-year. As I mentioned, one of the highlights of our performance during the quarter was our continued success, executing on our land and expand strategy. We saw this in Q1 across both our enterprise customers and the midmarket. This expansion was reflected in our very strong renewal rate, which increased to 126% in Q1 compared to 112% a year ago and nicely consistent with the seasonally strong performance in the prior Q4 quarter. This increase in customer adoption was driven by the ongoing theme that we’ve been seeing for a few quarters now, where customers are buying more of the products that they initially deployed and they’re purchasing other Rapid7 products, as we demonstrate the value and effectiveness of our offerings and continue to introduce new products on our technology platform. We clarified products, because these renewal rates do not include the upside and increased revenue for customers who are also buying professional services from Rapid7, which provides additional upsell and cross-sell opportunities. We believe that our track record of generating material customer cross-sells and upsells further validates the return on our investments that we’re making in newer areas like security, behavioral analytics, search and the whole SIEM upgrade cycle, in which we now find ourselves really well-positioned and garnering good pipeline traction with customers. Importantly, our baseline customer retention is also strong as our expiring revenue renewal rate, which measures the renewal of the prior year’s revenue run rate increased to 89% versus 85% in Q1, 2015. Moving on and looking at our cost structure and path to profitability, we’re pleased to deliver another good quarter of non-GAAP gross margin, with Q1 coming in at 77%, an improvement from 74% in Q1, 2015 and from 75% in the prior Q4 quarter. Our professional services profitability continues to complement our strong products margin and grew to 30% gross margin in Q1 on a non-GAAP basis, compared to 11% in Q1, 2015. This is the result of our sales and professional services team's continued success in driving higher margin services like incident response and security program assessment, scaling the business and managing implementation spend well. We continue to take a disciplined approach to managing our spend and moving down the road to profitability, with our gross margin just shy of what we would see as a steady-state gross margin in the 78% to 80% area. We take confidence by the fact that we see ourselves delivering profitability through higher operating margin contribution to the bottom line and not from some new product line or structural cost reductions down the road. We get to profitability, specifically from growing sales efficiencies as we continue to scale and continuing to benefit from our already lower marginal R&D costs. With that perspective, let's look at our Q1 non-GAAP operating expenses. Let's start with sales and marketing. The non-GAAP expense to revenue ratio was 57% of revenue and improved significantly on a sequential basis from 64% in Q4, 2015. We expect to continue to see marginal improvements in sales and marketing expense ratios as we move through the year and we will also note that there is some variability in the timing and magnitude of transitioning Intel’s MVM customers to Rapid7, which could potentially affect the timing of royalty payments. Overall, we’re being thoughtful and disciplined in our approach to our go-to-market spend, pacing our sales and marketing expenditures on what we’re seeing increases in pipeline, sales rep productivity and customer traction. Turning to R&D, our non-GAAP R&D expense was 31% of revenue in Q1, reflecting the investments we’re making across our technology platform. In particular, both operationally and strategically, a big shout out to our product and engineering teams who, in four short months, took the core search technology from our acquisition of Logentries, integrated it into our platform and launched our new InsightIDR offering this February. Our team is delivering great and timely technology into the hands of our sales force and customers and they are doing it at a lower marginal cost. This is due in large part to our talented offshore engineering teams in Belfast and Dublin and as a result, we expect continued marginal decreases in our R&D expense to revenue ratios in 2016. Finishing now on OpEx, non-GAAP G&A costs in Q1, 2016 were 16% of revenue, consistent with Q1 of last year and down marginally from Q4, 2015, as we’re already showing leverage improvements in our operations as we scale the company. Like the improving leverage and support of our path to profitability with our R&D spend, we expect to see continued marginal improvements in G&A expense to revenue ratios as we move through 2016. Putting this all together, Q1, 2016 non-GAAP operating loss was $9.5 million, squarely within our guidance and non-GAAP loss per share was $0.23 at the top of the range of our guidance. Turning to cash and cash flow, we ended Q1 with cash of $83.5 million. As expected and communicated, our companywide annual bonus and sales commission structures have higher cash outlays in the first quarter. Our operating cash flow, while a negative $1.6 million for Q1, was better than expected on strong customer collections. As we've discussed previously, we expect to generate meaningfully positive operating cash flow in 2016, a particularly important metric and leading indicator demonstrating our success on our path to profitability. With that let's now turn to our outlook where we have set a dual mandate of continuing to drive strong revenue growth while making sure we’re delivering on improving profitability. With those two criteria, we believe we are taking balanced approach to investing in our product platform, growing our sales force responsibly and supporting our marketing programs into these customer awareness and adoption. Our guidance therefore for Q2 2016 is as follows, we anticipate total revenues to be in the range of $35.4 million to $36.8 million this equates to strong year over year growth of 40% at the midpoint. We anticipate non-GAAP operating loss for Q2 to be in the range of $9.4 million to $10.4 million and we anticipate non-GAAP loss per share for Q2 2016 to be in the range of $0.23 to $0.25 this is based on an anticipated 41.5 million weighted average outstanding. Looking at the full-year 2016, we are encouraged by both our strong Q1 results and our pipeline build. We’re therefore raising our guidance for all three metrics, revenue growth, an improving non-GAAP operating loss and an improving non-GAAP EPS loss. So for the full-year 2016 we expect total revenues to be in the range of $149 million to $154 million representing 35% to 39% year over year growth respectively. We anticipate non-GAAP operating loss for the full-year 2016 to be in the range of $35.5 million to $39.5 million this equates to a meaningful improvement on our path to profitability as the non-GAAP operating loss margin for 2016 improves by about 500 basis point versus 2015. And we anticipate non-GAAP loss per share for the full-year 2016 to be in the range of $0.86 to $0.96. This is based on an anticipated $41.7 million weighted average shares outstanding for 2016. And finally, we continue to anticipate generating approximately $10 million of operating cash flow in 2016 and being free cash flow positive for the year. In closing, we are extremely pleased with the start to the year and we are particularly excited with the customer reception and uptick for our new InsightIDR offering and its disruption at the SIEM market in which an important upgrade cycle is now underway. And of course, we continue to be very bullish on the overall growth profile and customer adoption that we’re seeing with our unique security data and analytics platform. With that, we appreciate your time and support, and we are glad to open the call for any questions. Operator?

[Operator Instructions] Your first question comes from the line of Rob Owens with Pacific Crest Securities. Please go ahead.

First off just want to touch a little bit more on InsightIDR, in terms of when you guys go to bake-offs, who you’re seeing in terms of competition, what legacy vendors are you displacing. And then relative to either ticket size with customers or monetization, what type of expansion is this driving within that customer opportunity?

It's a great question, so in comparison to the same customer size to same customer size, so addressing the first question about what's the opportunity. These deals are typically larger than the comparable threat exposure management deal which is very positive tailwind for us and it gives us a lot of optimism about what we're seeing in the business in the first half of the year from a pipe perspective and also from early conversion perspective. As far as the customers that are we’re displacing it is a number of traditional vendors that have deployed technology in the last three to five years and it’s just not meet the needs as they’re trying to get more responsive to the data that they need. And they tend to actually have data that's consolidated in logs, just in the enterprise. And what they're missing is a wider range of perspective on the data in their business and more importantly they are missing a dynamic ability to actually figure out which attacks are happening today. So as far as the competition what we see for those deals, the primary competition that we see for those is splunk, which actually has both behavioral analytics and search. We have that approach; we think that’s the modern approach to that. LogRhythm has also made some good investments in that place but we are seeing a shift to companies that are shifting away from static rules and reporting focus to much more focus on behavioral analytics and a search focus. And we think that's extremely positive for us.

Steven relative to the billings number in the 34% growth, I think you mentioned there was a compression duration of about 10% or so. Help us understand how the quarter played out, the 34% number, while still strong, is one of the slower growth rates you've seen over a couple of years. So just curious in terms of how that played out and as we look forward the confidence in an acceleration or more of the new business as it should help the back half of the year? Thanks.

Yeah sure thank Rob, so to your point we feel, A, we feel good about their trajectory through the year for sure. The nature as you know, I talked about it a moment ago for the seasonality as it tends to be 40-60 if you will kind of front end to back end of the year. And so that’s something that’s consistent and know, so that’s comforting. And the reason for the acceleration if you will for the even stronger performance in the back half of the year is really two things that Corey is just talking also it’s the traction of MDM and having higher conversion potentially though then we perhaps anticipated as well the whole launch of IDR in February in Q1 gives us good runway for the latter part of the year. And so that's where that acceleration and higher growth comes from.

Our next question comes from the line of Gregg Moskowitz with Cowen & Company. Please proceed with your question.

One follow-up to start on one of the ops questions relating to IDR, so Corey you kind of pointed out a couple of unit wins early on, in those two cases, are they companies actually displaying your SIEMs or they running at IDR in parallel?

So what we find is that in the midmarket we find new deployment, in the larger customers we find that they are displacing SIEMs, although the one comment I would make is that I would say most of them today are poorly utilized and under adopted in the environment even when they have been purchased. And so we are able to go in and show a very strong value proposition around the technology that we’ve built and its ability to not just protect attacks but to speed up the investigation in the forensics process.

And have you begun to see a benefit from MDM from the [indiscernible] vulnerability management end-of-life program or is it too early?

I would say that it's exceeding our expectation in terms of potential timing, it’s still too early to tell definitively but one of the things we have observed is that more customers are interested in both having discussion and mapping out their process to migrate at an earlier path than we expected. And that's the positive, it consumed our sales force time lines to go through but we’ve had a number of opportunities that went into the pipeline earlier than we expected in Q1 and we consider that a positive both for this year and as we actually think about moving into the next year.

And if I can ask this last one for Steven, just getting back to the billings, the quality of billing if you will does seem to be a bit higher than it maybe first appeared, just because your long-term defers were slightly down sequentially whereas they have been growing at a strong clip on a sequential basis for each of the prior five quarters and I’m just wondering if you had any commentary on long-term defers this quarter as well as what you expect going forward?

I think the nature of the long-term deferred is simply a math exercise Gregg where as you said it’s a function of change in duration of, call it two month off of the long end, which is, what we mentioned earlier really a function of the lumpiness of the large deals that we have had and as we talked about in the past, we are very pleased that we did let’s say a million-dollar deal once a year two years ago and picked up to once a quarter and now we are at a point where we’re executing multi-hundred thousand dollar deals throughout the quarter. Having said that scallop function and so you have lumpiness in the larger end and when you have larger deals that are longer duration that pushes it out and so far the duration of deferred and long-term. To your first point though on the quality of bookings, one of the metrics that we feel really good about so far is the growth profile for the quarter and really for the last two or three quarters and our expectation for the rest of the year is that all of our lines of business are contributing to growth meaning whatever growth profile we’re posting 30 plus to mid-30s for this quarter it really a function of being evenly dispersed there is no one product that’s driving the growth that you said, oh it’s all VM, it’s all AppSpider, it’s all IDR, it’s all SAS and so it’s a very balanced growth profile across all cylinders and it’s nice when those are marginally producing well each quarter going up a little bit and it really has a strong leverage effect on continuing to grow bookings as we go through the quarter.

Our next question comes from the line of Jonathan Ho with William Blair. Please proceed with your question.

Just wanted to understand with the higher I guess up sell opportunity that has come with some of the renewals, can you tell us maybe what product you’re seeing drive that and is there – has it happened more in the enterprise side and midmarket, just want to get a sense for a little bit more detail in terms of what's driving that effect?

It's happening across the base of line, you do see it more biased towards larger customers just because smaller customers have left them an environment to expand into, in some cases it was primarily cross sell when it comes to smaller customers and you have the up sell and cross sell phenomenon with larger customers. So at the larger end of the section, you see companies that might start out just looking at a North America region for example, and they may expand globally from a direct source and management perspective or to multiple subsidiaries around the world. And on the cross-sell perspective, we see adoption not just within direct source and management of moving from just Nexpose to either the Nexpose Ultimate, which includes the AppSpider or AppSpider on to that. Likewise, we are seeing healthy adoption of our InsightUBA, which is our User Behavior Analytics solution and just recently, we saw some adoption, it’s early, but we also saw lots of pipeline build around InsightIDR. So the thing that Steven just mentioned, that actually gives us great confidence is we are seeing all agents operate efficiently and effectively and that’s exactly the thing we want to see.

Got it. And then, can you talk a little bit about sort of the international growth, are you seeing a pickup or strength in any particularly regions, are there any sort of compliance drivers that might be pushing faster adoption in any area?

Yes, we are seeing – we remain and feel confident in international and the great growth opportunity, we are seeing ongoing growth, so actually you’ve got a longer time horizon in the international segment. You do have lumpiness internationally because it’s coming off of a small base, but we see strong growth prospects and we would continue to deliver good growth there. What I would say is that security awareness and prioritization outside of the US is still less than it is within the United States. But that said, it’s still a good growth opportunity and we are very focused and we are seeing good conversion there.

Thank you.

Our next question comes from the line of Saket Kalia with Barclays Capital. Please proceed with your question.

Hi, guys. Thanks for taking my questions here. So firstly, maybe for Corey, can you just talk about the go-to-market strategy for InsightIDR? I know it’s early, but is this something that requires more of a direct sales touch or is it something that can go through the inside sales machine?

It’s something that we believe can go to the inside sales team. As you know, we have a small team of direct sellers, but we got off to a very strong start and we didn’t take the time and we spent a lot of time this quarter, both training and enabling the sales team and ramping up our sales specialist, and our SCs who have expertise around this, and aligning them with the product groups. But we are seeing momentum in our inside sales team and we do believe that it can be sold via the inside sales team in addition to our outside sales team. And we are increasingly working with channel partners who are seeing the success that we are having on expanding our penetration and footprint of InsightIDR.

Got it. And then to stay on InsightIDR, you mentioned – obviously the alert fatigue is something that InsightIDR is going to address, but you also mentioned sort of a lower total cost of ownership. So can you just give us a sense for what you’re seeing again realizing it’s early, when a customers is evaluating InsightIDR versus a legacy SIEM, for example, what’s sort of savings could that customer expect to see?

Absolutely. I will talk about three broad ones. So one, you actually talked about the alert fatigue and that’s just a factor of the static rules versus behavioral analysis that’s there and we are able to demonstrate that to customers and they actually see the value and proof-of-concepts very effectively. The second piece is really the productivity of security teams, because they still have a lot of things to investigate and respond to. And what we found out is that our contextual search model of being able to process and search through and relate and contextualize large amounts of data very, very fast, makes incident responders just much more effective and efficient in how they investigate in research and do forensics around events, and that’s valuable. If you think about traditional SIEMs, they are much more geared towards being a single pane of glass into reporting versus contextualized search and investigations. And so that productivity driver just allows our customers to be a lot more efficient and that really resonates well, because lots of security teams are just strapped for resources and they are undermanned. The last part of it that actually is resonating very well, I talked about this earlier, is we are seeing that customers have higher scrutiny and they want to consolidate lots of their aspects of their data and that have three to five different products that look at different aspects of data, and they want to work with one company that has pure solutions to be able to process and manage their data and their solutions, and that’s both what our platform and our SIEM and IDR offerings are offering customers.

Got it. Very helpful. That’s it for me. Thanks.

Our next question comes from line of Michael Turits with Raymond James. Please proceed with your question.

Hi, guys. Just a quick question really, if you’re seeing anything from a macro perspective? It’s a tougher year, stock market, macro, and things like that, how that is, if at all affecting the core TEM business? And then I’ll ask something else.

No, we expect TEM business to still grow as we discussed with a multiple of the vulnerability management market. We are seeing strong demand in that business. And by the way, we are very aware of what’s happening in the environment. The primary macroeconomic context that we see is customers have higher scrutiny and there is lots of things up, there is lots of solutions and customers want to make sure that they are getting the most impact of what they are doing and that’s extremely, extremely positive for us. And the reason for that is that we are able to demonstrate that customers can consolidate their security and data analytics that they need to have across their organization, which means that they actually can go from multiple product solutions and partners now to a single partner and actually get better efficiency and effectiveness out of that. The other thing that we are seeing is we are seeing purchasing partners, purchasing departments take a lot more scrutiny as they look at deals, which could have some impact on timing, but we are seeing them still actually buying products as they move forward. But those are the two things that we are seeing that affect our business directly.

And then Steven, back on the duration question, I know you said it's volatile, big deals go up and down. But where do you think we are if you're down a couple months at this point, is that the right new normal, or do you expect it to bounce around, or any trends we expect over the next year?

Yes, we would expect it Michael to bounce around for a pretty tight – we are within 10% band, while you’re talking two months of bounce on a what’s classically been a 24-month – 22 to 24 month metric for the last two years that’s gone between 22 and 24 pretty consistently. And so to your point, as you have more larger deals that tend to be further out and it’s more towards the 24 and when you have fewer in the mid-market practice, the bulk of the growth for that quarter is more towards the 22. But as I mentioned earlier, it feels like it’s a bit of a scallop function, right, it’s moving up into the right in a scallop chart, not a linear straight line.

Yes, which is why we look at large deals on, not just a pipeline on an annualized basis and see how they come in and we are seeing good traction in adoption across there. And that’s why that’s our focus just because Steven indicated, we are still scaling into that mega and a large scale business.

Okay. Great, thanks. Thanks, good for me. Thank you.

Our next question comes from the line of Melissa Gorham with Morgan Stanley. Please proceed with your question.

Hi, guys. I just wanted to dig into InsightUBA a little bit because that has been on the market for obviously a little bit longer than IDR. So I am just wondering what you’re seeing in terms of customer adoption, if you’re seeing good growth and whether it’s meaningful from a revenue perspective today.

It’s a great question. So there is two comments about it, one, we are seeing amazing customer retention and we are seeing good customer growth. Although the thing that I would say is that InsightIDR is the lead product in the category, and so just like with TEM, our Nexpose Ultimate is the lead product in the category. The shift that actually happened last quarter is that InsightIDR became the lead product in that category and because of that we are able to have a few deals that actually we were able to upsell in the process, we continue to close, we saw very, very good growth in the category of our technologies and our products around incident detection and response. But we also had some additional deals that we decided it was better economical with us and the customer for them to evaluate InsightIDR, and so we actually went along with those customers and those deals may take longer. We think that’s a healthy construct, because we would refer customers to be on our full solution and have an experience. InsightUBA right now is positioned as a complement to SIEMs, where customers can get the detection capability and some level of investigation and forensics, but not the full search experience, but allows them to get some of the behavioral analytics if they want to keep their SIEM in there. And we do find that message resonates and we are seeing adoption in larger enterprises that know they have to move from their legacy SIEMs over the longer term time horizon. But it’s not the right time right now and so they find the InsightUBA allows them to go down the path to get some of the benefits in a way that’s complement here, and that’s great for us.

Okay, that’s helpful. And then just, Steven, on the full year, you brought up revenue by $3 million, which is great and then operating income is up more modestly, I am just wondering if there has been any sort of change in the level of spending or your expectation or maybe there is an area in which you feel like you need to put more investment dollars?

Yes, good question, Melissa. Thanks. No, there is definitely no view towards changing our spend for the upside. If anything, it’s the opposite where we expect to continue to deliver higher marginal returns, the bottom line for increasing revenue, and you’ll see that as I think we talked about first and foremost in our R&D that’s really starting to come down nicely and we will really benefit from greater efficiencies and in sales. So the commitment is to return greater amounts of revenue growth through profitability and while we do that, the important leading indicator of that profitability is the operating cash flow profile, and so that’s why we continue to be pretty bullish on delivering meaningful $10 million of OCF this year 2016 as that kind of key indicator of the effectiveness of the expense management and continued profitability. So thanks for asking a good clarification.

Okay, thank you.

There are no further questions at this time. I will now turn the call back to you.

Thanks, everyone for joining us. We look forward to connecting with you soon.

Thank you.

Ladies and gentlemen, that does conclude the conference call for today. We thank you for your participation, and ask that you please disconnect your line.