Good day, ladies and gentlemen and welcome to the Fourth Quarter and Full Year 2018 Earnings Conference Call. [Operator Instructions] As a reminder, this conference is being recorded. I would now like to turn the conference over to Neeraj Mahajan, VP of Investor Relations. You may begin.

Thank you, operator and good afternoon everyone. We appreciate you joining us today to discuss Rapid7's fourth quarter financial and operating results in addition to our financial outlook for the first quarter and full fiscal year 2019. With me on the call today are Corey Thomas, our President and CEO; and Jeff Kalowski, our CFO. We have distributed our earnings press release over the wire and it is now posted on our website at investors.rapid7.com along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast and following the call an audio replay will be available at investors.rapid7.com until February 14, 2019. As a reminder, our discussion today contains forward-looking statements about events and circumstances that have not yet occurred, including without limitations, statements regarding our objectives for future operations and future financial and business performance. These forward-looking statements are based on our current expectations and beliefs, and on information currently available to us. Actual outcomes and results may differ materially from the expectations contained in these statements due to a number of risks and uncertainties, including those contained in the most recent quarterly report on Form 10-Q and subsequent reports will be filed with the Securities and Exchange Commission. The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call except to the extent required by applicable law. Our commentary today will primarily be non-GAAP terms and unless otherwise stated, we will be presenting results in accordance with ASC 606. Reconciliations between our GAAP and non-GAAP results and guidance can be found in today's earnings press release. At times in our prepared comments or in responses to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or quarterly results. Please be advised that this additional detail maybe onetime in nature, and we may or may not provide an update in the future of these metrics. With that, I'd like to turn the call over to Corey.

Thank you, Neeraj and good afternoon, everyone. Thank you all for joining us today on our fourth quarter and full year 2018 earnings call. Rapid7 had a great fourth quarter capping off a very strong 2018. We are particularly pleased with the acceleration in the adoption of our cloud-based offerings. For the sixth quarter in a row our ARR growth accelerated reaching 53%, driven by continued strong new customer growth, lower churn, and the success of our platform strategy. We again exceeded our growth targets and look forward to another year of ARR growth of over 30% with improving operating leverage. In few years ago, Rapid7 undertook the challenge of transforming the company. At that point Rapid7 was primarily, and on-premise perpetual revenue company with one main product, vulnerability management. Our vision was to build the leading comp-based SecOps platform to address a world where IT and security teams are stretched and complexity is increasing. And to do so in a way to make our solutions easy to deploy and easy to adopt, in order to drive upsell and cross-sell. To do this three years ago we introduced the Insight platform with InsightVM and InsightIDR. Since then we have launched InsightAppSec and InsightConnect creating a true multi-product platform. Along with this we transitioned our sales force, and more importantly, the entire organization to think and operate in terms of ARR. Today we are a leading SecOps company with four major cloud-based pillars for growth. We ended 2018 with more than 7,800 customers, an 11% increase but more importantly, our product customers grew at a much higher rate. Over half of our customers are now taking advantage of the Insight platform, up from 37% last year. Recurring revenue as a percentage of total revenue has grown over the last two years…

Thanks, Corey and good afternoon, everyone. We're very pleased with our strong performance in the fourth quarter with results that exceeded guidance on all metrics. As Corey mentioned, we believe Rapid7 has established itself as a high growth cloud software company on a path to sustainable profitability. Before I begin discussing our strong results for the fourth quarter and full year 2018, I want to remind everyone for the last time that as of January 1, 2018, we adopted ASC 606 on a modified retrospective basis; and therefore, we've been reporting each quarter's results in 2018 under both, ASC 606 and ASC 605. We've included all of these details in our earnings press release today. When discussing our year-over-year growth rates and other key trends in our business, we will be comparing our results on an ASC 605 basis as we don't have prior year operating results under ASC 606, and the comparison would not be meaningful. Moving forward, all results will be under ASC 606. We set a high bar for our operational and financial goals for 2018 and we exceeded them. With four key products on our Insight platform, we now have multiple levers for growth. We successfully transitioned to a recurring revenue model with over 83% of our total revenue that was recurring in Q4 2018, up from under 70% in Q4 2017 under ASC 605. Also 94% of our product revenue was recurring in Q4 2018, up from 81% in Q4 2017, again under ASC 605. At the beginning of 2018 we regarded for ARR growth of at least 30%, and we delivered 53% growth. We ended the year with revenue of $244 million under ASC 606, a significant feat despite a decline in services revenue. We also delivered on the high-end of our operating income…

[Operator Instructions] Our first question comes from Rob Owens of KeyBanc Capital Markets.

This is Liz [ph] on for Rob, thanks for taking the question. You know, really nice to hear the strength in IDR this quarter. Would love to expand on what percentage of new ARR deals include multiple products versus -- starting with VM and expanding there? Thanks.

I wanted to thank you for joining us, and Jeff and I can tag team it. We didn't give a detailed breakdown in the call. I think one of the key underlying questions that I think you're getting to is that are we growing the business outside of VM and the answer is absolutely yes, we are. One of this I think I just shared on the call, is that if you look at new ARR, almost 40% of our new ARR in Q4 came outside of vulnerability management, in a quarter by the way where we had very healthy growth with Insight of vulnerability management itself. And so from our perspective, the -- if you think about our IDR business has been the largest driver of that business, all the different product areas are performing well, we have a very, very healthy business both within VM and outside of VM.

Yes, I'll just point out that our platform customers grew again this quarter, and the products for customers are higher than our average, which is 1.5. Also, we have three drivers of growth; we have new customers, cross-sell and upsell, and all three segments group nicely this quarter, and also evidenced by our 120% overall rate renewal rate.

And then, I just quickly would love an update on how the tCell acquisition is being incorporated? And maybe how that factor is into expectations for 2020? Thanks.

One, we have a great traction overall in application security with our daft [ph] solution. As you pointed out, we acquired tCell at the end of last year to really position us as one of the leading cloud AppSec companies where we're actually looking at both, application and security testing, monitoring and in-app protection. tCell is in it's incubation and inclusion platform stage right now, we have not built a significant contribution to our overall model for this year. As per our habit, as we actually build out new product offerings, we really focus on the new [ph] and the customer used case building a strong value proposition and demand. So you'll see that come in at subsequent years but it's not back in heavily into our expectations for this year.

Our next question comes from Saket Kalia of Barclays.

Thanks for taking my questions here, and nice finish to the year. Corey, maybe starting with you; it's a question I asked last quarter but it's interesting to look at it again. Obviously, a lot a lot to talk about but one item that was nice to see was another quarter of 90% expiring renewal rate, and so -- so two consecutive quarters with a 9-handle not [ph] renewal rate. Can you just talk about whether you think that's sustainable? And what are the drivers of that slightly improved renewal rate in your view?

Yes, I think there is a couple of drivers. So the first thing is that we fully expect, and when you look at the underlying product line and product offerings, each and every last one of them will continue to improve their renewal rate for the foreseeable future in my mind, and we've seen consistent performance there. Now to get your question about what the drivers are, there is a couple of drivers. The first and I think the most important is what's the renewal rate of each of the individual product lines. The second one is what's the mix shift; as you can imagine, more established products have a much higher renewal rate than a product that would have just come out last year, so what's the mixed shift based on maturity product offerings. And the last one is; what's the tail from our historical perpetual customers that had 3-year deals into the mix there. When you look at the most important thing which is the underlying renewal rate, we're highly confident that ASCO [ph] continue to improve. When you get to the other two which are about really mix related, those are the things that we sort of like pay attention to after the fact but they are not really fundamental drivers. We want all of our businesses to grow quite well, and so, if one is growing at 30% and another is at 50%, we're still happy because we're actually growing and taking share in the market; but that can have slight impact on our overall renewal rate. So we really focus on the fundamental main [ph], and so to answer your question; the fundamental renewal rate of our products, as they come up for renewal; we see continued opportunity to improve that. The overall renewal rate is clearly going to have a lot to do with mix shift.

Got it, that's really helpful. Maybe for my full-up for you Jeff; clearly, we've outperformed our expectations that we laid out here in 2018. And based on the guide that you're putting out for 2019, it seems like we're going a little faster as well. And so I want to bring it back to the original framework that we put out for the long-term model out to '20, open ended question, how do we think about that framework now that we've put a bow on 2018 and have put a better than expected guide out for '19.

Yes. So Saket, yes, we are exceeding our 2020 goals. At Analyst Day, I think we laid out a $350 million ARR growth which was a 30% CAGR and revenue at $350million. So it's clear that those numbers have to go up and will be exceeded. Rather than give a specific number. Our feeling is what we want to do is get through 2019, get more visibility and update those numbers in the second half for the year rather than giving anything specific right now. But you are correct, that those numbers have to go up.

Got it, very helpful. Congrats again guys.

Our next question comes from Gur Talpaz of Stifel.

First question here, a really, really great AOR number, 53% growth this quarter. My question is, if you look into next few years you're striking a confident tone here calling for 30% plus growth again in 2019. So what gives you the confidence you know as of today to kind of sort of say that -- especially after kind of delivering a very, very strong end to the 2018 number?

I think the first and most important thing is, we actually have strong and healthy end-markets. It's much easier if you have really, really strong and healthy end markets actually for your team's performance to actually make a difference, and we're in very, very strong end markets; and I would say that includes every aspect of what we're doing. The second thing is that we actually have established clear customer demand, so in those strong end markets we actually have clear customer demand and we're state increasing customer preference. And so that gives us the ability to look out and say how do we think about our pipeline; how do we think about the opportunities that we're seeing, and how do we think about the future. And I think [indiscernible] and this goes to the previous question, is that, we built a strong business last year and we've see great health in our overall customer environment, and that allows us to actually have a great foundation to grow our overall customer economics as we go forward.

Corey, another one for you. You talked a bit about InsightConnect on the call itself but something you said kind of picked my interest; how do you view InsightConnect as a pull-through if you will for additional solution adoption; meaning for VM customers that may adopt InsightConnect; is it easier for them now to go and adopt IDR and AppSec, and how do you think about that as a mechanism for upsell to products outside of both Connect and VM?

If you think about what our general message is around SecApps, it has summer pillars but one of them is bringing together different constituencies in IT the environment; so the IT people, the security people, the opps [ph] people -- what you're finding in most modern IT shops, it is moving from these big multi-year projects to this ongoing evolution and improvement. And we think that value of what InsightConnect brings to the table is it delivers immediate productivity value but it then allows people to organically expand and solve additional problems. So if you think about the combination of InsightConnect and what we're investing in our core systems and the platform to make it easier to cross-sell and upsell; we expect problem solving to be more organic and economical for our customer, and that's the way that opps customers behave, that's we how security customers behave, that's a lot of the way that customers increasingly want to be like -- I want to solve my problem at my pace and when I want to solve it, and InsightConnect are some of enhancements that we're making allow that to be the case. And so, yes, we do expect that as we go forward, not just this year but more importantly, over the next several years, we'll see increasing ability for our customers to adopt multiple of our solutions, and for our solutions to work tighter together, and frankly, for us actually integrate with other solutions in their environment. And again, our whole purpose is how do we draw productivity for our customers and make it easier for them to do their jobs.

And our next question comes from Matt Hedberg of RBC Capital Markets.

Corey, you talked about strong expectations for VM, more growth in 2019, that's great. I'm wondering, could you help us understand -- and I'm sure it's hard to generalize but just roughly speaking, what percentage of your customers networks aren't being scanned right now? Is there sort of a ballpark figure kind of that you guys kind of see in an average customer?

Yes. So it's tricky because we're doing a very good job of actually adding new customers which if you think about -- new customers actually come in at a lower number of assets under management, and so the rate to add those fluctuates. What I would say is that we've seen a steady increase. Right now our rough estimate is, it is a rough estimate to have it on average at roughly 30% of assets under management. So we're currently being managed in our customer environment but that's a mix of some very mature customers. And frankly, we've done a tremendous -- our team has done a tremendous job of continuing to add new customers.

That's great, that's fantastic to hear, it seems there is a lot of upside to that. And then I guess as a follow-up, we continue to hear really good things in the channel about AppSec; I mean, obviously IDR has been doing great but I think AppSec continues to resonate with some of the partners that we talked to. Can you talk a little bit more about what's driving that strengths? Are there higher tax rates in certain customers or maybe just a little bit more detail on kind of what you guys are seeing from AppSec?

I mean, one of the things that we just love about AppSec; and there is many things that we love about is -- but the most important thing is that underlying fundamentals are great, people are just adding applications at an extraordinary pace and an extraordinary rate. The second thing is, it is -- has lagged historically the awareness curve that you actually have to secure those applications, but the awareness curve is catching up fast. So you have lots of applications being added, people increasingly aware that they need to secure those applications and we're steadily building out our applications security portfolio; that's a great combination and mix. And we actually started from a space where we have one of the best ranked dash [ph] platforms, and that's the application-security-testing platform in the world. So we started from a place of strength and we continue to add great capabilities overtime, and I think that's where you see lots of the demand and the momentum come from. The last thing I'd say is that, we actually think we're very well positioned to actually become a strong leader in the overall cloud applications security space which is where people are deploying out in the future and that's a big part of the reason why we bought G-sale [ph] and make lots of investments in that general area.

And our next question comes from Michael [ph] from Raymond James.

First of all, can you drilldown a little bit more on InsightIDR in terms of who you're competing with, who you see and where you're winning? And I would assume that you're growing faster, in percentage with ARR and the rest of the business, I just wanted to check.

Yes, so generally I'll tag team it, so I'll talk about the qualitative and Jeff can talk about some of the growth dynamics over there. Qualitatively, we did a big innovation with InsightIDR, and our overall goal was to disrupt the SIM [ph] market by making it much more easy, much more approachable, and to really drop productivity efficacy of the ability to detect and respond to attacks. The obvious first place if you look back a couple of years with that value proposition resonated was of course in the mid-sized enterprise and we've actually continued to have great traction there. What we've seen is that like it has happened with VM and it's happened in our broader market is that, that suddenly consistently expanded and now we're actually managing quite a number of actually very large and complex customers. And so we expect future growth to happen both, in the mid-size enterprise space and a large enterprise space and we're seeing significant evidence of that, especially if you look at the last quarter and the last year that we've actually had which has been a steady increase in that area.

So Michael, we have reported IDR growth as being triple-digit in the past, and it continued to grow triple digits on ARR year-over-year.

And then, if I can just get a follow-up on that on the investment side. You're going to be breakeven, you say for next year. Can you talk about where -- prioritize where the incremental investments are that keep you at that level high right now?

So I mean, to take a step back, the primary data we're actually focused on is we've come to the hard parts of the cloud SaaS migration. We think we have the opportunity to be a high-growth and profitable cloud SaaS security company. And so where we really focus our investments on are continuing to actually focus on the customer experience, which will actually make our customer economics better and better, which will drive profitability over time. So simply there are three areas that we're focused on. The first one is systems investments that allow us to more seamlessly have customers' cross-sell and up-sell. We want them to get our technology when they want it and when they need it. And the real benefit of this is that it provides more flexibility for the customer, giving them a better experience, and it will lower our overall costs of sale into the future, that's a great overall investment that actually drives growth and profitability in the future. Similarly, we actually are investing in the overall customer engagement and customer management. The way to think about that is that makes it easier for customers to achieve outcomes and be successful. And by focusing on systems and processes around that, it allows us to address a much larger customer base and have better outcomes in that customer base at a lower cost that we've experienced in the past. And then the last thing we're focusing on is the pricing and packaging ecosystem at the systems level. We're continuing to grow geographically around the world, we're continuing to grow through the channel, both specific channel partners and the range and types of channel partners and we're just selling lots of products to customers. What we want to enable is every customers can get the product that they want, at the time they wanted, at a price point that's compelling for them to expand and grow in the business. We look at those overall investments is really maximizing our customer economics and our ARR per customer and our customer lifetime value that allow us to maintain the momentum that we have of actually growing quite well by continuing to improve profitability.

Thank you. Our next question comes from Jonathan Ho of William Blair.

Hi, good afternoon. I just wanted to start with sort of the non-VM products and whether or not you're just trying to see them as serve as entry points to win new customers, or is this primarily still sort of add-on to existing VM customers as part of that cross-sell and up-sell motion?

It's a great question; what I'll say is IDR has always been an entry point. Early on, even IDR was sort of like half entry point to the new customers and half of them installed base. I would say, right now, all of our products actually effectively serve with entry points into new customers, at a slightly different rates, but all of our products whether there's is AppSec, security orchestration automation, which we recently introduced SGA or IDR, they all service, many have so actually acquiring new customers. And the nice thing is that we're starting to see momentum where we're going with the IDR customer and add VM or we'll go in with an AppSec customer and add VM or IDR. And so it's a very, very effective overall customer adoption strategy for us, which is why we have lots of visibility and confidence in our model to actually continue to expand ARR per customer.

And just given some of the uncertainty out there in the global macro, whether it's from the fed or from various regions like Brexit, I mean, are you as concerned at all about any of that noise maybe filtering down to either security spend or your areas of the market?

I mean, you all will be much more experts on the globe. I can tell you what we see and we pay attention to it tightly because we know how economics work and that's being careful to down at the time. What we see right now is a recognition that there is broad demand for security, and for the SecOps offerings that we actually have. So all customers, we're going to have budget today or whether they're trying to get budget, recognize that there's a strong need out there. And the second thing that we see is that right now, people are actually funding or finding ways to actually fund that need. So it's a fairly healthy environment now. What I would say is that we are lucky to be in a space where people see this as a need. So even for organizations that may be budget constrained, they're saying, how do I get to this over time, which is exactly -- I've been doing this for a while, that's exactly the kind of space you want to be in is what people are finding ways to actually fund your solutions over time because they had value.

Our next question comes from Alex Henderson of Needham & Company.

This is actually Dan Park on for Alex. Thanks for taking my question. So I know it's still early innings, but could you maybe provide an update on the automation and orchestration features, implementing within inside VM and IDR, and if this is starting to drive some additional customer interest?

Yes. So the -- for those of you who may recall, our InsightConnect, which is the evolution of demand, really had two primary strategic benefits for us. One is actually establishing a new market that was a value add. The second benefit was a differentiated, significantly our existing solutions, specifically inside VM and InsightIDR. And third, it actually made our products a lot more sticky for customers. I mean, those are three really big things. So I'll talk about each of those in turn. And so one, we have launched Insight -- we have launched InsightConnect, and we're seeing good momentum pipeline, via adoptions early, but we're seeing healthy ASPs and good adoption, and we're very optimistic about the future even though it's still in a very, very early innings. The second, it has been a clear differentiator for both InsightVM and InsightIDR because these are two areas where people are just under-resourced and under-constrained. We've had many conversations with customers about how can I go beyond 30% of my environment for assets under management with VM, but I don't have the resources or the capability to manage the vulnerabilities and the threats I actually have today. What it turns out, that you can actually automate more of that, the customer is happy and then they actually take on the next stuff in the environment and that can move to 40% or 50%. The value proposition is resonating quite well overall. Likewise, with InsightIDR, the whole focus that we continue to evolve and continue to add capability to is how do I make it fast just to investigate things, and how do I make it faster to respond and immediate things. We're seeing very, very strong demand in the InsightIDR space, and it is a meaningful differentiator, increasingly of why we win. The nice thing that we expect, and it's still early just because when we released it, is that for each of these capabilities, for the customers that we've seen will deploy these capabilities, it actually is extraordinarily sticky in their environment, far better it used to reflect in the fact that our platform customers have a much higher renewal rate, but we make that our platform increasingly is a much, much more sticky proposition than the offerings that existing with SIM-VM market a couple of years ago.

[Operator Instructions] Our next question comes from Lisa Franchi of Morgan Stanley.

Corey, you talked about being underpenetrated into your customer base. I'm wondering to what extent you're starting to see customers extend vulnerability management or InsightVM into maybe more what's called modern ITF, it's like IoT OT? And do you feel like you have the technology today to well address those use cases?

So one, we actually have wide deviation customers who come in. We do a great job of adding new customers. So customers, who come in, come in with a lower rate. What we also find is that customers expand and can expand to a very high rate. So we're seeing high levels of penetration in customers that have been with us for a while and of course, customers coming lower. We also see great adoption across the landscape. So customers priorities is we actually see them are, their core network data center assets, their end points, their applications, then the rest of their environment and that includes the IoT environment. We're actually excessively focused on actually operating in a way that actually customer see. So what we see adoption today in and where we have great products that deliver on today is that, one, we feel the way the strongest solution for actually covering core infrastructure. Two, we actually feel that we have the strongest solution, we're actually covering cloud environments, and we see great uptick and greater adoption in overall cloud environments. Three, applications are where the gain is in the future, it's strategic, it's important, is what we were exposed. We have of the traditional VM competitors, the most mature and advanced operating and application security, and we're there. And in the IoT space, we have coverage today, and we're actually in the process of having -- and the process of continuing to expand our efforts to look at IoT and OT.

And then just as a follow-up, you've talked about you're focusing on resource constrained enterprises, but it seems like you're also having some traction in large enterprises as well. Can you maybe talk about what sort of adoption you're seeing in larger enterprises? And to what extent are you investing in that opportunity versus this -- that opportunities are coming to you?

So first and foremost, we're actually seeing a significant traction. We still have roughly 40% of the Fortune 100. We have some great brands that actually have enterprise-wide coverage, that a large enterprise across all sectors, frankly, whether you look at sort of like the finance sector, the technology sector, where we have an amazing footprint, the oil and gas industry. So we actually have the track that and has been growing steadily over time. The marquee in that segment, which is continue to get more and more enterprise adoption and of course, our InsightVM solution, and we're seeing rapid adoption right now with the InsightIDR. And oddly enough, InsightConnect is actually started in different parts of market. And in the last area is our application security offering, which frankly, started off with a heavier enterprise bias than any of our other offering. So we actually have traction and momentum across the enterprise segment. To your question about the sort of the focus, from a products perspective, we have been and we are always focused on actually ensuring that all of our customers are successful, and we'll continue to make sure that we're meeting the needs and exceeding the needs of the large enterprise as well as the midsize enterprise customers. Now when we introduce new offerings, we always, just like anyone who's actually really good at something like building our product up, is just start with the target customer, we get successful with recurring customer and then you expand. And we're extraordinarily disciplined about that because that what allows you to build a sustainable long-term business. We're at the stage now with InsightIDR where we have a great core customer and now we're rapidly expanding that customer and we're adding capability, and that's working out quite well.

Thank you. And ladies and gentlemen, this does conclude our question-and-answer session. Thank you for participating in today's conference. This concludes today's program. You may all disconnect. Everyone, have a great day.