Rapid7, Inc. (RPD) Q2 2019 Earnings Report, Transcript and Summary

Good day, ladies and gentlemen and welcome to the Q2 2019 Rapid7 Earnings Conference Call. [Operator Instructions] As a reminder, this conference call maybe recorded for replay purposes. It is now my pleasure to hand the conference over to Neeraj Mahajan, Vice President, Investor Relations, you may begin.

Thank you, operator and good morning everyone. We appreciate you joining us today to discuss Rapid7 second quarter financial and operating results, in addition to our financial outlook for the third quarter and full fiscal year 2019. With me on the call today are Corey Thomas, our CEO and Jeff Kalowski, our CFO. We have distributed our earnings press release over the wire and it is now posted on our website at investors.rapid7.com, along with the updated Company presentation and financial metrics file. This call is being broadcast live via webcast, and following the call an audio replay will be available at investors.rapid7.com until August 8, 2019. As a reminder, our discussion today contains forward-looking statements about events and circumstances that have not yet occurred, including without limitation, statements regarding our objectives and future operations and future financial and business performance. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the expectations contained in these statements due to a number of risks and uncertainties, including those contained in our most recent quarterly report on Form 10-Q and subsequent reports that we filed with Securities and Exchange Commission. The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by the applicable law. Our commentary today will be primarily in non-GAAP terms and reconciliations between our GAAP and non-GAAP results and guidance can be found in today’s earnings press release. And at times in our prepared comments or in response to your questions, we may offer incremental metrics to provide greater insights into the dynamics of our business or our quarterly results. Please be advised that this additional detail maybe one-time in nature and we may or may not provide an update in the future on these metrics. With that I’d like to turn the call over to Corey.

Thank you, Neeraj and good morning everyone. Thank you all for joining us today on our second quarter 2019 earnings call. Rapid 7 had another strong quarter, driven by the strength of our Insight Platform products. We again exceeded the high-end of our guidance. Year-over-year revenue grew by 35% and we generated non-GAAP operating profit. We, once again, demonstrated strong ARR growth of 46%, and remain confident of delivering over 30% ARR growth for the full year 2019. Our organic customer growth accelerated to 14%, one of the strongest quarters ever in customer additions. With NetFort, we ended Q2 with 8,400 customers, a growth rate of 16%. In addition, our customer economics remained strong as our platform strategy is working. Average ARR per customer increased by 25% year-over-year to over $34,000 and recurring revenue expanded to 87% in the second quarter. We are again raising our full year 2019 guidance for total revenue based on the strength of our cloud-based product business. We expect to generate leverage across our business and, as we discussed in the last quarterly earnings call, we have increased investments in our business to achieve higher long-term growth and sustainable profitability. These investments are well underway and we are focused on continued execution on these in the second half of this year. Therefore, we continue to expect non-GAAP operating income to be breakeven in 2019. We are especially pleased with the momentum in our international business where our investments are bearing fruit. We are seeing Greenfield opportunities in regions like EMEA and APAC where customers are increasingly starting to appreciate the ease of use, breath of analytics and automated remediation capabilities of our Insight platform products. Our business is also benefiting from the investments we have been making to improve channel partnerships. Our partners are embracing our Insight platform and regional partners are increasingly driving expansion in North America. Now, let’s review the quarter in the context of our 2019 goals. Our first goal was continue to focus on growth. We delivered strong growth in the second quarter with ARR growth of 46% and revenue growth of 35%. Our updated guidance for 2019 revenue growth reflects our confidence in the business and strategic initiatives. We are winning and retaining customers because of the investments we’re making in our business. Our big focus this year was our new customer additions and our sales incentives were aligned with this. We believe customer growth is the key to our long-term sustainable growth, because every customer we have today generate significant expense opportunities over time. In addition, as we have expanded both the number of customers and ARR per customer, our team has done a good job of maintaining strong renewal rates. Additionally, our product roadmap resonates with customers with more and more organizations adopting cloud technologies, the breadth of our Insight product offerings and the integration with cloud providers differentiates us. Our focus on constant innovation was evident at AWS’ inaugural cyber security conference reinforce, where we had the opportunity to be a key presenter. Here, we announced the integration of our Insight cloud platform with AWS’ new security hub. We also announced our cloud configuration assessment capability. As organizations migrate their infrastructure to the cloud, they need to understand the vulnerability risk as well as the configuration risk. Many solutions provide silo views and our customers have expressed dissatisfaction with such a non-integrated approach. Now, our customers with one solution can get visibility into traditional and cloud environments for vulnerability risk and configuration risk and can then automate the response to remediate. It is exactly this innovation and product roadmap that is helping us gain share in our key vulnerability management market as our customers appreciate Rapid7’s technology differentiation and deeper integration with the broader security ecosystem. Our results also reflect strong performance across other products on our Insight platform, especially InsightIDR, as our SecOp vision resonates with the resource constrained organizations of all sizes. It is helping us win customers. One such example is our recent win of a large local government customer. This customer was looking to replace its legacy SIEM solution, because of high renewal cost, fatigue – false positive alerts, and the time to investigate actual events. Their testers were impressed with IDR’s User Behavior Analytics, its ability to interrogate endpoints during alert investigations and response and predictability and pricing. What really resonated with this customer was the seamless integration of VM and IDR solutions, allowing them to collect data more efficiently and drive overall productivity improvements. As a result, we won not just a SIEM business but also the vulnerability management business. Our second goal is to continue to make it easier for our customers to adapt our platform and optimize our customer economics. This requires multi-year investment in systems and packaging to make it easier for customers to adopt, renew, and expand usage of Rapid7 product portfolio and are key part of our growth strategy. As I mentioned before, these investments are well underway and are already yielding results this year to set us up to deliver durable growth and sustainable profitability. Our third goal is to continue to drive leverage in our business. In the second quarter, we generated a non-GAAP operating profit of approximately $500,000. Jeff will talk about this in more detail, but while we feel confident about the path to profitability, we intend to continue investing for durable growth and profitability. Overall, the second quarter was another strong quarter for Rapid7 and we look forward to executing during the remainder of the year. With that, let me turn the call over to our CFO, Jeff Kalowski. Jeff?

Thanks, Corey and good morning everyone. We are very pleased with our strong performance in the second quarter with results that exceeded our guidance on all metrics. Total revenue for the second quarter was $79 million, above the high end of our guidance and an increase of 35% year-over-year. This strong revenue growth was driven by better than expected product revenue growth offset by a further decline in professional services revenue. In Q2, we also benefited from an existing customer expanding the scope of their term license, which resulted in approximately $1 million of upfront revenue recognized in Q2. Total ARR grew to $290 million at the end of the second quarter, a 46% increase year-over-year. ARR growth was primarily driven by strong new customer growth. Our customer count increased by 16% year-over-year and we ended Q2 with 8,400 customers globally. This includes a benefit from the NetFort acquisition that we closed in April of this year. Without NetFort, our organic customer growth rate accelerated from 12% to 14% in Q2. The quality of our customer base continues to improve as higher growth in our product customers more than offsets the decline in service-only customers. Our customer economics remain strong with average ARR per customer increasing to over $34,000, up 25% year-over-year. Strong growth in ARR over the past year drove 50% growth in recurring revenue. Recurring revenue now constitutes 87% of total revenue compared to 79% a year ago. Our focus on recurring revenue drove a 62% increase in our product revenue year-over-year. This was partially offset by decline in maintenance and support revenue as Nexpose customers migrate to the Insight platform, resulting in reclassification of maintenance revenue to product revenue. Therefore, it makes sense to look at product and maintenance and support revenue together, which collectively grew at 46% year-over-year. Our professional services business experienced a further slowdown and revenue declined by 27% year-over-year. This decline is primarily driven by the continued churn of transactional services only customers, as our sales team gains momentum with our Insight platform. For the remainder of 2019, we expect professional services revenue to continue declining on a year-over-year basis. Looking at the business geographically, revenue from North America grew by 34% year-over-year and comprised 84% of total revenue. International revenue grew by 42% year-over-year and comprised 16% of total revenue in the second quarter. Contract length for Q2 2019 was 14 months, down from 17 months a year ago, and it declined from an average contract length of 15 months we reported in Q1 2019. Our overall renewal rate was 116% in Q2, 2019, and as projected, declined from last quarter. Our retention rate remained strong and the decline in this rate is a result of a lower forecasted ARR growth rate from 53% last year. Additionally, our increased focus towards new customer growth also contributed to the decline. As Corey mentioned, we are incentivizing our sales force and adding new customers, and we plan to continue with this strategy as it maximizes our long-term sustainable growth. As a result, we expect the overall renewal rates to stabilize around 110% by the end of 2019. Turning to margins, total non-GAAP gross margin in Q2 2019 improved to 75% up from 73% last year. We continue to benefit from a shift towards a more favorable mix of higher margin product revenue. Our product non-GAAP gross margin was 80%, up from 78% last year. Professional services non-GAAP gross margins declined to 19%, when compared to a margin of 38% in Q2 2018, due to lower revenue, as part of our continued focus on ARR and more strategic professional services. During the second quarter, sales and marketing expense decreased to 45% of revenue when compared to Q2 2018 expense of 50%. This improvement reflects the operating leverage inherent in our business model. R&D expenses were 20% of revenue in Q2 2019 as compared to 23% in Q2 2018. This lower percentage of revenue partially reflects an increase in capitalized software to account for increased investments in our Insight platform. G&A expenses in Q2 2019 were stable at 10% of revenue, compared to Q2 last year. For Q2 2019, we generated non-GAAP operating profit of approximately $500,000, well ahead of our guidance. Non-GAAP operating margin was 0.6% compared to a margin of negative 10% in Q2, 2018. This improvement is primarily driven by the over performance in revenues. Adjusted EBITDA for the second quarter was $2.7 million and diluted non-GAAP net income per share was $0.02; also well ahead of our guidance. We ended Q2 with cash, cash equivalents and investments of $264.4 million compared to $285.1 million, as of Q1 2019. The reduction from Q1 primarily reflects the cash outflow related to our acquisition of NetFort, which we acquired in April for approximately $15 million in cash. During the quarter, operating cash flow was $2.5 million as compared to negative $9.1 million in the prior year, driven by strong collections, which brought our days billings outstanding back to a normal level. Given the decline in contract lengths and decline in professional services billing, we are projecting operating cash flow for the full year 2019 to be approximately breakeven. In Q2, our assets and liabilities increased $58.6 million, as a result of our new corporate headquarters lease. And our property, plant and equipment increased $25.8 million, due to the build-out of the corporate headquarters. While we moved into our new corporate headquarters in July, the build-out will continue to impact our free cash flow in Q3. Now moving on to the guidance, for Q3 2019, we anticipate total revenue to be in the range of $79.2 million to $80.8 million. This guidance reflects the strength of our product revenue growth, which is offset by a decline in professional services revenue. We anticipate non-GAAP operating loss in Q3 2019 to be in the range of $2.5 million to $1.5 million. We anticipate non-GAAP net loss per share for Q3 to be in the range of $0.04 to $0.02, which is based on an anticipated 49.2 million weighted average shares outstanding. For the full year 2019, we are raising our guidance and now anticipate total revenue to be in the range of $318 million to $321 million, which is 31% growth over 2018 at the midpoint. While we’re again pleased to report non-GAAP operating income for the second quarter, we still continue to see plenty of investment opportunities. As we stated before, we will invest any upside back into the business, and as a result, we are still guiding to breakeven non-GAAP operating income for 2019. We anticipate non-GAAP net income per share to be $0.05, which is based on an estimated 52.3 million diluted weighted-average shares outstanding. The weighted-average shares outstanding for the third quarter of 2019 represent basic shares outstanding, given our projected non-GAAP net loss. The weighted average shares outstanding for the full year 2019 represented diluted shares outstanding, given our projected non-GAAP net income. Non-GAAP net income for the full year of 2019 largely represents interest income on projected cash and investments. On a GAAP basis, we expect a full year net loss for 2019. As a reminder, we recently moved our global headquarters and are consolidating facilities this year and hence in Q3 and for the full year 2019, our free cash flow will be negative as a result of significant capital improvements, but these expenditures will decline substantially in 2020. In conclusion, Rapid7 had a strong second quarter and we look forward to delivering ARR and revenue growth of over 30% while significantly improving non-GAAP operating margin compared to last year. With that, I want to turn the call back over to Corey for a few closing comments.

Thank you, Jeff. Before I open up the call for questions, I want to take a minute to welcome our newest Board member. We are pleased to announce that Christina Kosmowski, who was the Global Head of Customer Success and Services at Slack has joined Rapid7’s Board of Directors. Christina has an impressive track record of operational excellence and has helped high growth software companies scale to the next level. With that, we appreciate your time and support and we’ll open the call for any questions. Operator?

Thank you, sir. [Operator Instructions] Our first question will come from the line of Rob Owens at KeyBanc Capital Markets. Your line is now open.

Great and good morning guys. Corey, I wondered a little bit on the strength in customer acquisition and you mentioned InsightIDR and as we look at the SIEM space overall, it’s become noisier. So, what’s helping you cut through that, what’s driving this and maybe an update on the InsightVM as it relates to customer acquisition as well?

Yes, I mean we are really hitting our stride. You can think about us as being roughly 4 years in. We have a compelling product capability with InsightIDR that we continue to expand. We are getting very comfortable on our go-to-market motion. So we know how to target our customers. And at the core of it, we actually have a solution that is fairly unique in the market. Again, most of the SIEM products are designed for customers that have unconstrained resources. What we find is, if you think about most of the market, whether you think about the mid enterprise or even when I think about the margin constrained large enterprise companies, you know retail companies, your healthcare companies, they have to figure out how they actually have the most productivity and the most impact with limited resources. And for us, we really deliver a strong solution for that market and that’s allowed us to continue to actually aggressively grow and gain share in the overall market. And more and more our strategy and our value and our success in customers will feed on itself, what customers are telling other customers and even industry analysts like Gartner and others are recognizing the value and the leadership that we’re providing.

Great. And then for my completely unrelated follow-up question, given we’re entering the third quarter here in what’s typically a strong federal quarter. Maybe an updates or a reminder as to where you guys are relative to the U.S. opportunity and percentage of sales, things of that nature?

Yes. We’re still very early stage in the overall both opportunity and it’s a relatively small percentage of our overall sales. The way that we think about federal is massive upside, if you’ll look over the next 5 to 10 years. And we will be a major player in the overall federal market. But at the same time, is that when you think about us having launched a pervasive cloud platform for security a few years ago and the federal government still being in the earlier stages of their adoption, our strategy is really to continue to grow our overall commercial presence. We are aggressively going in the overall state and local and education market that are highly receptive to our cloud-based platform and strategy. And as the federal government standardizes its approach to the cloud, you will see us play an increasing role there in the future. But again, our expectations are that federal is not a major contributor this year, frankly, even for the next few years.

Great. Thank you.

Thank you very much. I appreciate it.

Thank you. And our next question will come from the line of Saket Kalia with Barclays Capital. Your line is now open.

Hey guys. Thanks for taking my questions here. Hey first, maybe for you, Jeff, obviously another nice ARR quarter. On the renewal rates, you mentioned that they ticked down from – I think a 120% down to 116%, and we said that maybe it will stabilize as we get into the back half at around 110%. You talked to some of the drivers there around customer acquisition and such. But could you just go a little bit deeper into those and talk about how the expiring renewal rates are doing, how the up sell cross sell component of it is doing, just to understand that dynamic a little bit better?

Sure. And it’s a good question. So first off on the expiring renewal rate. Those are still strong and they were in the 90% range. So there’s no change there. I think as you heard Corey talk about. Our focus this year is really on acquiring customers. So while up-sell and cross-sell is still healthy, we’ve had a shift towards more new news, which drives the rate down. Also, we’re forecasting an ARR growth rate from 53% to over 30% plus, right. So you can’t assume that that rate will stay the same given the decline, that’s just not the way the math works. So overall, our rates are strong, so there is nothing negative in that expiring renewal rate whatsoever.

Okay, got it. That’s really helpful. Corey, maybe a little bit of a higher level question. A lot of success here so far in the first half of ‘19, I know it’s early to start talking about 2020, but just given the ARR upside that we’ve seen pretty consistently over the last few quarters, how do you think about that 2020 framework that you provided at the last Analyst Day?

It’s a very good question. It’s one that we actually get a lot. Of course it’s actually too early to actually give guidance for 2020. But if you think about the backdrop, in Analyst Day, we actually talked about a 3-year CAGR of 20% revenue growth and 30% ARR growth. We clearly performed well in excess of that so far and we actually have started off this overall year on a strong base. The thing that I think is the most important is we are extraordinarily both optimistic about the market and the performance of our teams. And so while it’s too early for us to actually give specific guidance, what I will say is that we’re very – we’re confident in the fact that we’ll continue to be a growth company. We’ll be growing revenue over 20% next year. We’ll be growing ARR over that amount also. And I think about that as that we’re a company that’s centered on the large opportunity that’s in front of us. We have a strong and healthy team, and we’re going to be pursuing that aggressively. That’s it. We are going to come back with actually guidance later. It’s just way too early to actually provide any guidance at this stage.

Got it. That’s really helpful. Thanks guys.

Thank you. And our next question will come from the line of Matt Hedberg with RBC Capital Markets.

Hi, guys. Thanks. Well done on the quarter. Corey, even backing out NetFort acquisition, you guys still had a big quarter of new customer additions. Obviously you talked about that. When you think about sort of this focus on the land, I think you said you guys feel confident that you can expand longer term. How do you think about adding the right number of sales headcount to support that level of customer growth?

Yes, it’s a very good question. So, the simple way that we think about it, the reason that we’re focusing on land right now is that, in my mind, it’s always easy to expand. It’s always easy to monetize the base and so as long as possible, we want to have a sales team focused on actually acquiring new customers. When we think about how we grow our sales, our sales engine overall, the thing that we’re in a good position right now, especially as we go into 2020 and forward, is that we have the ability to actually add salespeople and still grow our leverage and profitability in the overall business. And so if you think about what we’re really optimizing around is, how do we have sustainable growth? Which you hear us talk of repeatedly about while still expanding the leverage in the overall business and we actually think our sales leadership and our operations team has done a good job in setting us up for that.

Got it. And then maybe as a follow up, obviously the Capital One breach was in the news this week and it looks like it was perhaps a misconfigured WAF. Can you talk about that as an issue, and I believe you have a product called the Cloud Configuration Assessment that may help prevent a similar situation. Could you talk a bit more about that as an issue?

Yes, absolutely, I mean, I think the thing about firewall. So the first thing I’d say is Capital One is well regarded and has an extraordinarily talented cyber security team. So I would say, more than I mean an issue specifically to them, it just shows the complexity of managing cloud-based infrastructure. The second thing is, when you think about cloud-based infrastructure, cloud-based infrastructure is extraordinarily complex with a massive number of permutations, which is why you have to automate your ability to really understand what you have in environment and how it’s configured and that’s why we have such a massive investment in cloud configuration assessment and the analytics of understanding people’s cloud exposure which is different than traditional vulnerability exposure. This is clearly a problem set that we’re targeting aggressively. We believe our CCA offering is relevant and will be more and more relevant in the future. We just introduced the first version of that. It’s on an aggressive expansion path in terms of capability. And I think Capital One just demonstrated, more than anything, the complexity of today’s technology environments.

Super. Helpful. Well done guys.

Thank you. And our next question will come from the line of Gur Talpaz with Stifel.

Hi, this is actually Chris Speros on for Gur. Congratulations on another great quarter guys. For Corey, when you acquired NetFort, you noted that it would provide you with the technology to better service some enterprises and use cases. Can you speak to the degree to which the acquisition – the decision has better enabled you to you to push up market?

Yes, it’s a good question. So when we acquired it, we talked about really 3 things. The first focus we said out the gates is going to be on focusing on enabling a higher level of enterprise use case in SIEM and then we talked about – the VM visibility and in IoT long term. So all of them, we are in the technology integration phase. And so, it had no material impact on our go-to-market engine. It even in that context, our go-to-market engine for IDR has continued to expand and we think that this will just the additional capabilities that make it easier and easier for us to expand in the out years. But as of today, we’re still in the technology integration phase.

Okay, that’s great. And as a follow-up again for you, Corey, your international business grew quite nicely in Q2, how should we think about your long-term international opportunity and the degree to which this market currently remains Greenfield?

Yes. And so we think of our international as having a massive opportunity. We all know that it’s lagged the U.S., in terms of both the awareness and the willingness to invest heavily and in mainly – in the main capabilities of cyber security. What we’re seeing is a pick-up in both interest and awareness, some of it is driven by regulations and compliance, some of it is driven by the international, the connections that companies have around the world, but we are seeing a steady pickup. The way that I think about our international business performing is, it should continue to actually increase the percentage of our business. If you think about what’s happened recently, it’s gone from 15% to 16% overall of our business. We expect that to continuing to go up over time. But I’d say, our international team has done a very good job. I think the [indiscernible] is that our largest business from a geography perspective is North America and that’s continuing to grow well, which just makes it a slower path that actually international becomes a larger and larger share of the business, but we expect those numbers to continue to go up steadily over time.

Great. Thanks guys and congrats again.

Thank you very much.

Thank you. And our next question will come from the line of Michael Turits with Raymond James.

Hey, guys. Good afternoon, Michael Turits. I’d like to focus on the vulnerability management market, first, not exactly clean quarters from your key competitors here. How would you characterize the level of demand and growth in vulnerability management right now any slowing there? And are you – is your focus on net customer adds an increasingly aggressive attempt to gain share there?

It’s a great question, so – both questions. First one is, we see the vulnerability management market is overall healthy, and we believe that we’re both growing our share of the market. And so, to your second question, yes, we absolutely are focused on both the short term and long-term, being the share taker in the overall vulnerability management market and other evidence and data we have suggests that we’re doing an effective job of that. On your question on the overall market, we believe it’s a healthy market and it’s a sustainably healthy market. The backdrop I actually provided at our Analyst Day, we said that the long-term growth rate was a roughly 15% CAGAR for the long term. We still believe that. We’ve clearly gone well above that rate today. But we think about the vulnerability management market as a strategically long term and healthy market.

Okay. And then can you comment on InsightIDR as a percentage of new ARR, you’ve talked about that in the past non-VM as percentage of new ARR?

Yes, Michael, so we have commented on IDR and it’s again over 30% of the new ARR that we added in Q2. What we said is we’re not going to comment on specific product lines, but with IDR, it is becoming a bigger portion of the total ARR revenue mix. So when it was 20%, we said we’d tell you when it’s 30% and it’s still over 30% and we’ll update when it gets over 40%. So it’s still very healthy.

Great. Thanks a lot guys.

Thank you.

Thank you. And our next question will come from line of Jonathan Ho with William Blair. Your line is now open.

Good morning. I just wanted to see if you could give us a little bit more color on, maybe what’s driving the increase in ARR per customer? I just wanted to get a sense of is this you guys are going after larger deals or is this more multi-product. Just any additional color would definitely be helpful.

It’s a good question, especially since we are coming out of the period, where you had the fast transition period. The primary drivers of the overall potential and one way to think about it is that, if customers are fully deployed and they have all of our products. We’ve said before there is roughly a $200,000 ARR for customer opportunity. The focus that we actually have internally is really a deep – in fact our biggest investment this year was on customer adoption and customer experience. And our fundamental belief is that, if customers have a good experience, if they’re adopting the technology, then they will expand the technology because we have plenty of natural expansion opportunities. And what we’re seeing that the increases are a combination of customer’s adopting more of our other products. That’s indicative of our overall InsightIDR, InsightAppSec, the offerings that we actually have available today. They’re adopting more of our product offerings. At the same time they’re actually covering a broader range of their environments with those overall offerings and that combination of things about what’s the percentage of the environment is covered overall and how many of the products are people using, that’s actually driving overall expansion in the ARR per customer.

Got it. And then just regarding the competitive landscape in the SIEM space, like are you guys starting to see Microsoft Sentinel or Chronicle show up I guess more on the competitive side?

Not in any material way. I mean we’ve seen snippets of it. My expectation is that it will show up more in the SIEM market is it’s a competitive market. It always has been a competitive market, and always will be a competitive market. We think we’re extraordinarily well positioned in the market, but we will see increased competition, especially from Microsoft there, while we still partner with Microsoft in other areas too. And so, we feel quite good about the overall competitiveness of our solutions and our offerings, even though we expect the market to stay competitive, we do not think this gets any easier over time. We just think that we’re well positioned in the market from a technology perspective and we have an extraordinarily talented go-to-marketing.

Thank you.

Thank you.

Thank you. And our next question will come from the line of Gregg Moskowitz with Mizuho. Your line is now open.

Okay, thank you. Good morning guys, and I’ll add my congratulations as well. So industry analysts have been talking more frequently about risk based VM and Gardner actually says that only 1% of enterprises will have adopted a risk-based approach to vulnerability management by the end of this year, but I guess my question is, can it really be that low, and so Cory, I’d love your perspective on this as well as how customers are now approaching risk mitigation through VM?

Yes. So, one, I don’t believe it’s that low today and I don’t think it will be that low. We see you think about the primary driver of customer is by InsightVM. It is to operationalize VM. So, while I may not fit to Gartner’s model of it, customers are becoming more and more both risk and remediation centric over time. I think the trick in one of the misnomers there is that risk today does not mean that you cannot actually remediate key parts of your environment. And so, the way that we actually sort of engage with our customers is you should understand your risk so that you’re remediating in the right order. But you have to remediate all material issues and risk in your environment. You cannot have, say like, I just got the most critical risk in the environment. I can leave all the moderates and I’m fine. In fact, that’s been proven that basically you’re going to be a highly likely to be compromised there. So, what we’re seeing is our matured customers are taking a risk-centric approach to making sure they’re making the right investments in the right order. But they’re also taking a comprehensive approach which says, how do I actually drive remediation overall and the velocity of remediation and that feedback from our customers is what’s really push our investments and integrations in automations and an alignment with IT teams to actually drive the pace of remediation overall.

Okay, that’s really helpful color, Corey. Thanks for that. And then for Jeff, can you elaborate on where you are making incremental investments also when we see companies step up investment level to drive more growth, it’s typically a multi-quarter event before we see margins normalize and yet you have reiterated your full-year operating margin and EPS targets. What gives you the confidence that you can still achieve those?

Yes. So, as we said in our prepared comments in the prior quarters that we continue to reinvest the over performance in revenue and so while still achieving breakeven this year. The nature of those investments, as we talked about in prior calls, is really to improve our efficiency with systems, to enable customers to order easily more multi-product SKUs and systems to accommodate to make it easier for them to order, and we feel pretty good. It’s not short-term. It’s going to be over the course of a year or 2, but we are making good progress.

And the thing that I’d add is the reason that we are confident that you will see those investments show up in the P&L and why we’ll still be breakeven for the year is that most of those programs and most of the people were successfully hired and launched in Q2. And so, they’re tuned on you go into Q3 and Q4, and so we have a good deal of visibility overall into the investments and the impact on the P&L. And so that’s why we’re still confident in the breakeven for the overall year.

Terrific. Thank you.

Thank you. And our next question will come from the line of Alex Henderson with Needham. Your line is now open.

Great, thank you very much. I was hoping you could delineate a little bit between what you’re seeing in the middle market and what you’re seeing in the small or large enterprise market, if that’s not a Jumbo shrimp comment, the particularly where you have clients that don’t have a SOC that and in some cases, may not even have a CSOC. Can you talk a little bit about the rate of growth between those 2 segments and delineate some of the go-to-market differential there? Thanks.

Yes, I would say both I’d say the long-term rate of growth in the markets we expect to be pretty aligned and pretty similar. I mean, one thing to think about us is that because we have a broad product portfolio, we actually have the ability to actually meet customers where their existing needs are. And if you look and you think about the mid-market customer, lots of them are starting cyber security programs around vulnerability management, incident detection response or application security for the first time. And so that’s its own motion there, but there is lots of people that are starting programs. If you think about the enterprise motion, there is really 2 dominant things. It has something that ask you for either upgrading their programs or overhauling their programs and so like I have something that I actually need to actually extend it and do more. And you can think about us actually adding a bunch of capability to complement. So, like we can go in with our InsightAppSec, we can go in with our VM or SIEM or our Orchestration and Automation, but we can complement and help them actually expand their already security program. And there are a number of customers and we’ll find massive amounts of opportunities there because they are overhauling. And they’re saying I have invested in some things and it’s not relevant for the future. It’s not what I need to be successful. So, in the VM context that is, I want to operationalize my security and I want to have a way to think about my risk profile and remediation across my entire complex infrastructure that includes cloud and on-prem. That’s an overhaul and upgrade. We’ll go in and people will upgrade us and they’ll pay us more money than they pay the previous incumbent because they’re actually buying a bigger vision and a bigger aspiration there. Similarly, with InsightIDR, most SIEM projects are failed projects in the enterprise space because it’s complex, it’s expensive, and so you have a lot of failed projects in the Global 2000 companies and we’re starting the journey. We have a good track record of success and starting to going in and upgrading those overall programs. So, the way that we see it is, we see both the mid-market and the enterprise market as good growth drivers overall and for the future.

One more question if I could. We just did a survey and we were surprised to see CrowdStrike show up in the VM space with reasonable penetration. Could you talk a little bit about whether you’re seeing CrowdStrike and how they impact the competitive dynamics when you do?

Yes. So, we don’t see CrowdStrike as a material competitor in any way for enterprise vulnerability management deals. I would say similar to like Sophos and Microsoft is there many important companies that cover vulnerability management on the endpoint to provide visibility of vulnerability on the endpoint and there is a source of vulnerability data. But we are not seeing CrowdStrike as a competitor for any enterprise vulnerability management project. I mean, one way to think about it is the first thing that you have to do is be able to actually know what’s management and unmanaged, which scanning tends to be a more effective mechanism to actually do that. But also, you’re actually covering more than just a desktop. You have a massive long tail. So like most companies that are starting new enterprise vulnerability management projects are putting the cloud in the context of what they’re doing, which is why our customer adoption of CCA got off to a furious and fast start with lots of momentum out the gate and so we’re not seeing them there, but they do, just like others, just like Microsoft, just like Sophos and others, they do provide vulnerability information and context on the endpoint, but that’s different than something like participating in the enterprise vulnerability end-market and RPs.

Great, thanks and great quarter.

Thank you very much.

Thank you. [Operator Instructions] Our next question will come from Keith Weiss of Morgan Stanley. Your line is now open.

Thank you guys. Also, great quarter. Maybe thinking like the opposite side of that question, we talk a lot about the competition from cloud vendors, can you talk a little bit about sort of the benefits that you expect to get from relationships with like the one you’re describing with AWS and when we could start to see that come through into the model?

Yes, no, absolutely. We’ve been spending a lot of time and we’ll be spending more time in the overall cloud market. We really think about it in 2 separate ways. One is that we have to have good relationships just to make sure that our technology, not just works, but it’s productive and efficient for our customers. One of the things about cloud environments, it’s primarily an ala-carte model. So the barriers of so if you think about ala-carte model with low barriers to entry, what that tends to lead to is extraordinarily high management complexity, and our role in the ecosystem is actually how do we actually reduce management complexity and allow people to manage large complex environment from a cyber security perspective. So, we spent a lot of time with cloud players both heavily with AWS but also with Microsoft on how do we make sure our technology is productive for managing the complexity of cloud environments. And especially if you think about hybrid environment because we still see this as a hybrid world for very a long time. The second thing that we’re actually doing is we’re spending more time on the go-to-market side and you saw that reflected. We talked about our time with AWS’ and the re-Inforce Conference where we spent both time not just with the sponsor but also time planning and talking about how we align and how AWS is aligned with us and how we are aligned with them and also spending time thinking about how we actually work with AWS’ and I mentioned the Microsoft’s go-to-market teams to make sure that we’re helping companies both transition to the cloud and manage cloud hybrid environments. And so, we look it from a technology and go to market and we’re still in the early innings on the go to market, but we are starting to actually make some public inroads there which you’ve fairly seen. And the technology we’ve been working on for a while and we’re going to keep working at.

Excellent. And then maybe just one follow-up, you guys are doing really well on international markets. We have been hearing murmuring of weaker demand trends. Anything on the macro side of the equation internationally that worries you guys at all?

No. I mean the thing that I would say is that, we’re probably not a good barometer for the broader market internationally, just because we started later. It’s a lower percentage of our business than you would see for a typical software company. So, we just have lots of room to actually grow in scale. So, we still see international at 16% of our revenue as a continued growth and expansion opportunity, but that doesn’t necessarily have to reflect the broader market.

Excellent. Very nice quarter guys.

Thank you very much.

Thank you. And our next question will come from line of Joshua Tilton with Berenberg. Your line is now open.

Hi guys, thanks for taking my questions. First one, in the past you would provide us with a breakout of potential average subscription ARR for each product. Have your views on these numbers changed? Does the SIEM maybe increasing wallet share with your clients and could you possibly remind us of your expectation for InsightConnect?

It’s a good question. So, I don’t think we made any material change in assumption of the average ARR for products. So, there has been no change there. InsightConnect, it’s just too early, really you can think about Insight apps like an InsightConnect of having the dynamic is they’re a buy and extend model. So, I buy a set of workflows and I add more workflows over time, and so you’re we’re still estimating what’s the average initial buy and then what’s the expansion rate? And that just takes time and that’s part of sort of like things that we’ll update as we go through our overall process of, we sort of next year, but it’s still too early to tell what that’s specifically going to be.

Yes, that was helpful maybe I guess just the follow-up for that would be then, so SOAR is being viewed more and more as highly complementary to SIEM and obviously SIEM product is growing really great. So, what needs to happen to just drive improved adoption for SOAR, especially from the customer base that’s already buying IDR?

Yes, for us, we believe it’s just focus. I mean we focus the last few years on the technology scale ends of use and we are now we talked about now this year, we actually put it into limited release. Our next phase of our cycle is next year we expect to go into a broader release with more go-to-market resources aligned behind it. We think we have a good strategy and a good approach there, but it’s mostly timing of how we actually go through our launch and market introduction strategy. We are fairly rigorous a fairly disciplined about how we approach these things, but we will be making significant investments in the overall SOAR and we have strong confidence that it will yield the fruit.

Alright. Thanks, guys and congrats for the quarter.

Thank you.

Thank you very much.

Thank you. I’m showing no further questions in the queue. Ladies and gentlemen, thank you for your participation on today’s conference. This does conclude our program and we may all disconnect. Everybody, have a wonderful day.