Rapid7, Inc. (RPD) Q2 2022 Earnings Report, Transcript and Summary

Good afternoon. My name is Chris, and I'll be your conference operator today. At this time, I'd like to welcome everyone to the Rapid7 Q2 2022 Earnings Call. [Operator Instructions]. Sunil Shah, VP of Investor Relations, you may begin.

Thank you, operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's second quarter 2022 financial and operating results in addition to our financial outlook for the third quarter and full fiscal year 2022. With me on the call today are Corey Thomas, our CEO; and Tim Adams, our CFO. We've distributed our earnings press release over the wire, and it is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast. And following the call, an audio replay will be available at investors.rapid7.com. During this call, we may make statements related to our business that are forward-looking under federal securities laws. These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to the company's positioning, our future goals and financial guidance for the third quarter and full year 2022 and the assumptions underlying such goals and guidance. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the future results expressed or implied in these statements due to a number of risks and uncertainties, including those contained in our most recent quarterly report on Form 10-Q filed on May 5, 2022, and in the subsequent reports we filed with the SEC. The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements. And reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update information presented on this conference call, except to the extent required by applicable law. Our commentary today will be primarily in non-GAAP terms. And reconciliations between our historical GAAP and non-GAAP results and guidance can be found in today's earnings press release and on our website at investors.rapid7.com. At times, in our prepared remarks or in responses to your questions, we may offer incremental metrics to provide greater insights into the dynamics of our business or quarterly results. Please be advised that this additional detail may be onetime in nature, and we may or may not provide an update in the future on these metrics. With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey?

Thank you, Sunil, and good afternoon to everyone on the call today. Thank you for joining us for our second quarter 2022 earnings call. Rapid7 ended the second quarter with $658 million in ARR, representing 35% year-over-year growth while exceeding both our revenue and operating income guidance for the quarter. Our team is executing well even as macroeconomic pressures begin to surface for some customers and corporate budgets come under greater scrutiny. Despite growing pressure on our key budgets, it is clear from discussions with our customers and prospects that security remains a critical focus and priority. As a result, during the second quarter, we continue to see robust customer demand for our best-in-class Insight platform, driving strong ARR growth in our security transformation solutions as customers look for a cloud-native approach to securing their shifting IT environment. However, despite ongoing momentum for our security transformation solutions during Q2, our total ARR was impacted by a growing macroeconomic uncertainty affecting customers internationally, particularly in Europe, where the majority of our international business is concentrated. As we progressed through the second quarter, we began to see increased levels of deal inflection as customers and prospects in the region manage record inflation, softening demand and FX pressures. As we navigate an evolving medical backdrop, there are a few key dynamics that I'll highlight to you to give us confidence in our near- and long-term outlook. Starting with our security transformation solutions. Even as customer budgets come under greater stress, this area of our business has proven more durable as we focus on solving customers' most urgent security challenges. As customers seek better efficacy of security outcomes and lower total cost of ownership, we're helping them automate their security programs while leveraging our Insight platform to minimize risk across their expanded attack surface and detect and respond to threats across traditional and cloud environments. Our market-leading security transformation solutions are resonating with customers amid continued IT shortages and [indiscernible] and an escalating threat landscape due to our quick time to value and compelling ROI. We saw the clear benefits of this in our second quarter security transformation ARR, which continued to grow well over 40% organically year-over-year. This platform traction is illustrated by a recent 6-figure deal with a financial services customer, whose current vendor was unable to scale to meet their detection and response needs. At the same time, the customer is actively shifting towards the cloud and need to expand their security infrastructure despite a hardline budget. Rapid7's ability to consolidate enterprise-grade detection response, cloud security, vulnerability management and automation on a single platform was a huge differentiator. We won on the strength of our best-in-suite platform while enabling this customer to effectively manage their budgetary constraints while creating a seamless, efficient process for onboarding new solutions. The value and usability of our platform were key differentiators in winning this deal. And it speaks to the sustained high growth we see for our security transformation solutions. Given the consistent performance and momentum of our security transformation solutions, we continue to maintain a strong outlook for their growth as we look ahead. Turning to VM. Vulnerability management remains a foundational priority for customer security programs. But as customers apply greater scrutiny to budgets and quickly shift their technology to the cloud, we saw lower relative urgency for VM during second quarter. This was reflected in our VM ARR, which decelerated from high teens growth to mid-teens growth during the quarter, with the most notable deceleration in our international region as we saw higher levels of deal inflection and delays driven by heightened macro sensitivity. However, as customers increasingly look to rationalize spend, we believe Rapid7 is incredibly well positioned to accelerate customers' path to consolidate security spend and increase their efficacy by utilizing our Insight platform to help solve their most urgent security needs at the highest ROI. This fuels our optimism for delivering sustained long-term growth in our business. Amidst a quickly shifting IT environment, customers want to spend their budgets and time around the most strategic areas of their security programs. Increasingly, their focus is on detecting and responding to threats across their expanding digital footprint and managing security of their growing cloud environments. We continue to see great traction with our Insight platform vision as customers prioritize areas like XDR and cloud security, which is reflected in our security transformation solutions now approaching 70% of our new ARR. We see a compelling opportunity to build on this momentum. And over the second half of the year, we plan to optimize our customer engagement strategy to accelerate consolidation by attaching critical but lower urgency areas by vulnerability management to high-growth security transformation solutions. This will enable customers to more efficiently bridge the security needs across the modern and traditional environments while focusing their security budgets around the higher strategic value areas like the cloud. A great example of how customers are leveraging our platform to consolidate around strategic spend focused areas was a $200,000 ARR deal with a hyper-growth retail company during the second quarter. The newly hired CISO has to build out a security program. We had a competitive process where our Insight platform stood out with best-in-class capabilities and strong value proposition. Our detection response also won. And later in the process, the customer chose to add VM to the deal, attaching full coverage of their environment as they justify increasing their budget to gain additional coverage. This enabled the customer to consolidate their security operations back at lower cost while enabling Rapid7 to accelerate its share of gain of a critical market. A core part of Rapid7 value proposition is driving productivity and scale for resource-constrained customers of all class. In today's environment, most customers have some form of security-centric resource constraints. We believe we are strongly positioned to win with these customers. And the time to value of our advanced analytics and automation capabilities are meaningful, competitive differentiators. Looking forward, we expect to increasingly anchor our go-to-market motions in areas of high customer urgency while driving simple and accretive path for products like VM. We continue to invest in our platform experience while building on the product and packaging work our teams have been doing during the second quarter. Returning to the current environment. As we look out to the rest of the year, we have factored in the current macroeconomic climate into our second half expectations. While we do not see customers removing or reducing their budgets, we have observed the slowing or delay of decisions in the current budgetary environment. While this has not changed the critical need for these customers to secure increasingly complex and modern IT environments, we do anticipate their implementation time lines may continue to be affected by budget timing and visibility. Despite the evolving economic backdrop, we expect the Rapid7 ability to close the gap in customer security environment with a comprehensive best-in-class solutions will remain strategic and continue to drive solid underlying demand. The net result of these dynamics are the expectation for sustained high growth in our security transformation business balanced against the impact of macro and used budget scrutiny means that we are reiterating our original ARR guidance range for the year. While the environment has changed from our expectations at the beginning of the year, our ability to sustain durable ARR growth, while executing against our profitability outlook for the year, speaks to our strong value proposition for customers, the leverage in our model and our commitment to our growth and profitability framework. Tim will share more details on our guidance in his remarks. Looking at the security landscape today, our strength: adjusting vast amounts of data, analyzing it in a security context and responding to that information in a productive and efficient way is more valuable than ever. As we lean into the consolidation of spend around extended detection response, cloud security and VM in a comprehensive way, we're continuing to meet customers' operational challenges in both traditional and cloud environments. And we're doing this with a focus on productivity and time to value. And lastly, we continue to execute on our evergreen goals: to enable our customers to secure the transition to the cloud; to expand the capabilities and value proposition of our best-in-class Insight platform; and to balance our dual mandate of scaling profitably while strategically investing to drive durable growth. Our strategy to better align our VM and security transformation solutions value proposition will help customers transition more securely and efficiently into the cloud in a holistic way while enabling them to consolidate spending and gain greater leverage from the Insight platform. We continue to pursue balanced, durable growth and remain committed to our profitability framework. With that, thank you all, and I will now turn the call over to our CFO, Tim Adams, to share additional details on our financial results. Tim?

Thank you, Corey. Good afternoon, everyone, and thank you for joining us on the call today. Before I turn to the results, a quick reminder that except for revenue, all financial results we will discuss today are non-GAAP financial measures unless otherwise stated. Additionally, reconciliations between our GAAP and non-GAAP results can be found in our earnings press release. Rapid7 ended the second quarter with ARR of $658 million, representing 35% year-over-year growth. This reflects continued momentum in our high-growth security transformation solutions as customers prioritize areas like detection and response and cloud security coupled with durable double-digit VM growth. The breadth of our Insight platform continues to resonate with customers who are increasingly tasked with detecting and assessing risks across both traditional and cloud environments. Many of the customers we engage with are looking to consolidate a fragmented set of security tools. And our value proposition stands out in uncertain macroeconomic environment given our time to value and ease of use admits persistent resource constraints on security teams. These dynamics drove healthy growth in both new customer ASPs and expansion business during the second quarter as we saw ARR per customer grow 18% year-over-year to $62,000. Our customer count grew 14% year-over-year as we ended the quarter with over 10,600 customers globally. This was driven by strong growth of over 20% in higher-value platform customers, which now represent over 80% of our customer base while we continue to defocus on lower-value legacy transactional customers who represent a small minority of our ARR. Second quarter revenue of $167 million grew 32% over the prior year and exceeded the high end of our guidance range on the strength of our security transformation solutions. Revenue outperformance was driven by product revenue of $159 million. International revenue saw growth of 52% year-over-year and now represents 21% of total revenue driven by continued strong momentum in security transformation. North America revenue grew 28% over the prior year and comprised 79% of total revenue in the quarter. Turning to operating and profitability measures for the second quarter. Product gross margin was 75%, and total gross margin was 72%, both in line with our range of expectations. Sales and marketing expenses represented 41% of revenue compared to 40% in the prior year period, while R&D and G&A expenses were 21% and 8% of revenue, respectively, compared to 20% and 8% in the second quarter of last year. We generated over $3 million of operating income in Q2, coming in ahead of our guidance range due largely to revenue overperformance. This underscores both the natural leverage in our business model and our ongoing commitment to balancing growth and profitability within our stated framework. Our second quarter adjusted EBITDA was $8 million. Net loss per share was $0.01 and better than our guidance range on higher operating income. Moving to the balance sheet and cash flow statement. We ended the quarter with cash, cash equivalents and investments of $254 million. Operating cash flow was $7 million, and free cash flow was just under breakeven. This brings us to our guidance. As Corey detailed earlier, we saw robust growth in our security transformation business driven by the scope and quality of our Insight platform and our ability to enable better outcomes for customers on their most urgent security challenges. This is being counterbalanced by macroeconomic uncertainty and the associated impact of increased budget scrutiny for customers, which mitigates upside potential to our prior expectations. Given these dynamics, we are reiterating our full year 2022 ARR guidance of $740 million to $750 million, year-over-year growth of 24% to 25%. Our ARR outlook now embeds approximately $5 million of FX translation headwinds for the full year given recent foreign exchange volatility and anticipate sustained but moderated VM growth in the current macroeconomic climate. We are optimistic about our unique opportunity to increasingly attach VM alongside higher priority security transformation solutions while helping customers consolidate their security budgets to drive better efficiency of their spend. In terms of ARR linearity in the back half of the year, we now anticipate third quarter net new ARR dollars to be down modestly over the prior year period on an organic basis before returning to net new ARR growth in the fourth quarter. Turning to revenue. We are narrowing our full year revenue outlook to a range of $686 million to $690 million driven predominantly by a decline of approximately $3 million in our services revenue outlook. We now expect our full year operating income to be $20 million to $24 million in the upper end of our prior guidance range as we remain committed to executing against our growth and profitability framework. We expect net income per share to be in the range of $0.08 to $0.15 based on an estimated 60.2 million diluted weighted average shares outstanding. Our free cash flow outlook is maintained at $40 million to $45 million, and we remain confident in our ability to ramp free cash flow in the second half of the year. Turning to quarterly guidance. For the third quarter of 2022, we expect revenue in the range of $175 million to $177 million, which represents growth of 25% to 27% over the prior year. We expect operating income to be in the range of $6 million to $8 million and non-GAAP net income of $0.03 to $0.06 per share, which is based on an estimated 66.2 million diluted weighted average shares outstanding. We expect the new convertible debt accounting rules, which require use of the if-converted accounting method, to impact EPS for the first time in the third quarter, adding roughly 6 million shares to our share count while also adding back cash interest expense associated with the debt in order to calculate earnings per share. In closing, we started 2022 with a strong outlook and maintain confidence in our ability to deliver within our guidance ranges as we navigate the evolving macroeconomic climate. We continue to balance high-return investments and growth with our focus on delivering consistent annual improvement in operating margin and free cash flow. And we remain committed to our profitability framework and medium- to long-term financial targets. Thank you for joining us on the call today, and we will now open the line for questions. Operator?

[Operator Instructions]. The first question is from Rob Owens with Piper Sandler.

Maybe you can unpack a little bit just that net new ARR growth that you saw during the quarter here. And you talked about some of the challenges you're seeing in EMEA, but North America did slow a couple of points quarter-over-quarter relative to growth. So maybe you can just help us understand what you're seeing domestically, what you're seeing internationally right now?

Rob, thanks for the question. So Tim and I may tag team. So the first point is that we saw the highest impact in EMEA from an overall perspective in terms of the pressure on the net ARR growth. The flip side is we saw incredibly strong performance in security transformation solutions. And that was across the globe but also specifically in North America. Now part of what you're seeing there in North America and around the world is sort of like the VM, where it's incredibly healthy, but you did see that deceleration on the high teens to the mid-teens. The way that we think about this is, look, VM's a fundamental demand driver. You know that we've said for a while that as environment priority shifts, if people move to the cloud more, we expected VM to decelerate over time down to the 10-ish percent range. Now that happened faster than we expected this year. But the good news is that we're well positioned for that because when you think about the priority for visibility and risk analytics is we can address those critical areas of highest priority, which is in the cloud right now. And so the dollar dynamic that we actually saw was that shift accelerating, and we think that we're set up well with our strategy to address that in the mid to long term.

Corey, I would add to that just for Q2 ARR. Look, I think we're seeing this across all the industries, the macroeconomic pressures that are happening predominantly over in Europe. And that certainly did impact us in the quarter and as we lay out the outlook for the full year. We also saw about $1 million of the $5 million FX that I referenced earlier hitting in Q2 against ARR. If it were not for this economic impact and the FX then our ARR would have been up on a year-over-year basis.

The next question is from Jonathan Ho with William Blair.

I just wanted to dig a little bit into your comments around the bundling and packaging of the high customer urgency sales with VM. Can you talk a little bit about how that changes from your prior sales motion? And what that could mean for something like net retention or maybe some larger lens here?

Yes. No, it's a great question. And so when you think about -- we've had a steady evolution over time, how we actually introduced new capabilities to the market. When you look at our security transformation, which is technology that we've really delivered to the market in the last 5 years, that's over 50% of total ARR and approaching 70% of new ARR. Now as part of that, we tend to start with a focused sales effort and expand that effort out over time. Now along the way, we've actually added focus and sales reps that actually focus on security transformation. And then we've slowly extended our sales team where they can sell all the capabilities. That's been going well. Really, the delta here is that we want to focus our sales efforts for the most efficiency on the things that are our highest customer priority. And so when you think about whether it's sort of detection response, which is clearly a big priority or when you think about visibility, people want visibility and they want risk analytics in the most mission-critical parts of their business organization. Right now, that's centered towards the cloud. Now the good news is that people still absolutely need visibility into their traditional and their on-premise environments. And that's where our vulnerability management really shines. The challenge that customers have right now is that they want to be the most efficient as possible with their overall spend. And they want to get the highest level of results or, frankly, the best economic leverage for the investment. Now what that means is that they want end-to-end visibility. They want to be able to understand the visibility and the risk in the cloud. They want to do that for the traditional environment. Our strategy enables us to do that because our proposition is relatively simple is that you can actually get the best visibility in the cloud with our highly-rated and highly-ranked cloud security solution. And you can actually have the best visibility in your traditional environment with vulnerability management, and you can actually do that economically. This is a perfect place for consolidation to actually play out and meet customers' needs in the moment where they are. Now when you say how do we actually think about this, luckily, we actually have a good experience of this. If you look at what we did in the journey to XDR, we did this in the SOAR, with the SOAR technology. That was technology that was important but not urgent. And so as we actually attach that to IDR and eventually attach that into the XDR motion, we saw a massive acceleration and larger ASPs over time. Our sales team knows how to do this playbook. So that's a playbook we're applying. We said, listen, we're just going to tackle your overall risk and analytics and visibility at the lowest possible cost and the best economics with the best possible technology. And that's a playbook that our sales teams know how to do. But most importantly, it's something that customers are looking for right now.

The next question is from Matt Hedberg with RBC Capital Markets.

I guess, Corey, or for either of you regarding increased budget scrutiny that you talked about. I'm curious, when did that start to happen in the quarter? And I guess I'm just curious, has it kind of stayed stable through July? And then maybe around reiterated ARR guidance for the year, how should we think about, I guess, second half conservatism within that framework?

Yes. Tim and I will tag team to that So we actually did start to see this in Q2, especially in Europe where we actually saw this scrutiny. We've done into it -- there was one area of concern of scrutiny, you want to make sure you have it. There's 2 things actually that reassured us. One, every company we talked to said the security was a major priority. And every company that we actually talked to said that they were actually prioritizing security budgets and that the detection response capability and cloud security were actually top of the list priorities. That made us actually feel good. It also gave us context into those customers who are trying to prioritize their spend overall. While we saw deltas between the urgency around security transformation solutions and vulnerability management, we processed that. And in Q2, our leadership team actually said, listen, let's make this a really simple proposition for customers. So let's go ahead and actually do the work. Let's start building out the packaging so that we can actually take this artificial choice away from customers and give customers the packaging and the solutions that they actually need. And so we saw it in Q2, we started planning and executing, and we have sort of introduced it to our team now as we actually enter Q3.

Yes. Matt, let me just address the second part of your question. When we think about the ARR guide for the full year, we're really in a difficult macroeconomic environment, certainly predominant over in Europe. And we think that will continue to persist for the foreseeable future. I mean, no one has a crystal ball on how this is going to play out. If it were not for that environment that we're in, that really would give us an opportunity to think differently about guidance, but we don't see the same upside opportunity that we had in prior years given the environment that we're in. The FX is very real. That's another $5 million that's hitting us pretty hard. And to the earlier point that Corey made is just the timing of customer budgets and when they will release those dollars to deploy the new products and services, which is out of our control. So that becomes somewhat unpredictable.

The next question is from Joel Fishbein with Truist.

One for Corey and hopefully, just a quick follow-up as well. So Corey, love to just get a little deeper into the managed detection and response business. Obviously, big priority with security personnel turnover, et cetera, and lack of people. And also, I just wanted to follow up and see what are your hiring plans going into the back half of the year, and if you've muted those as well?

Great question. So in regards to managed detection and response, I remind folks that we have sort of 2 plays. We do some of that directly, high-margin managed detection response. And we're increasingly doing a lot more with the partners over time, which is our real focus area. As you say, look, this is a big demand area for customers. We luckily have a massive demand from our partners to deliver the technology. We have a high focus on quality because that's incredibly important to us. But we see this as an ongoing area of customer focus. And this is definitely a contributor to the strength in security transformation solutions. Now I would also just point out that when you think about what customers are looking for, you have customers that have teams and staff that also need the higher levels of productivity, which is a core part of Rapid7's value proposition. So again, we do some, our partners do some. And we're really focused on building a high-quality partner ecosystem. And I would say we're well oversubscribed for the partners that we can actually onboard today, but we're focused on building the capacity to actually add more and more partners over time. And that's going to be our priority. The next question that you asked is just around the staffing and how we actually think about that. I'll remind you that we actually didn't start the year that we were preloading lots of our staffing for the year. So even before we saw from the pressure of the environment, we actually plan to actually really step up in the first half of the year, especially from a year-over-year comparable perspective and then ramp that staffing down. We are still hiring. I just want to be clear about that. We're discerning. We're hiring in quality. We're focused on our profitability on both client work, but we are still hiring. But we already plan to actually have more of our hiring funnel for the first half of the year.

Yes. And Joel, look, we just want to give you the comfort and all of our investors as well that we are very mindful of the economic times that we're in and this pendulum moving more toward profitability that goes along with the growth. And I can assure you, between Corey and our COO, Andrew Burton, and myself, we spend a lot of time really looking at all the investments we make across the business, head count being one of the larger ones. And we think we are appropriately invested, but we're very mindful of profitability goals that we've set with our shareholders.

The next question is from Fatima Boolani with Citigroup.

This is Joel on for Fatima. So just wondering if you could give us some detail on your 3Q guide, given it's come in below Street, more so on margins, that's EBIT and EPS. So is this entirely macro? And can we perhaps get a breakdown of some specific sources of margin pressure?

Yes. Tim and I will tag team in it. I may ask you for a clarification about the margin question. But there's a couple of different things that I would actually sort of like point out at the top line is, one, we have a focus on linearity. And we think we're being fairly consistent with our approach to linearity overall. The second thing is that we are really focused on simplifying things for customers. I think customers, in the early discussion that we've actually had with customers about what they're actually looking for is, they are looking to actually figure out how to get the most leverage from security spend in this environment. We think that our approach of attaching VM to security transformation solutions give customers the leverage that they want. We're rolling that out to our teams. And so when you think about the linearity for the year, there's 2 things. One, it's consistent with our plan as we actually started the overall year. But it also allows us to have the ability to actually adapt to what we're seeing in the environment and make sure customers are getting the solutions how they want and the way that they want them.

And just to the margin point, we really do focus the operating income and margin on a full year basis. And as you can tell from the prepared remarks that we've increased the low end of that range, and we feel very confident with that. But we do take a look at this on a full year basis.

Yes. And just earlier, the expense management and our profitability growth framework is a significant area of focus has been, and I think the team has very good control and visibility into this.

The next question is from Michael Turits with KeyBanc Capital Markets.

This is Eric Heath on for Michael. Just wanted to ask a broader question on InsightCloudSec. So can you just talk more specifically about this product? I mean in terms of traction you're seeing, be curious how large these deals tend to be and really how you're differentiating in cloud security with your kind of heritage and VM versus several of the other vendors that are out there kind of tackling this market from a lot of different approaches.

Yes, absolutely. So one, I would say that we have one of the more comprehensive cloud security solutions in the market today. That includes cloud security across the management, cloud workload protection, cloud identity analytics. We also complemented that using some of our market-leading technology from VM to add to it, which lots of the other newer players and entrants that don't have. And we're going to be accelerating over time, leveraging the technology from our detection response team. If you look at the setup, if you think about cloud security is, in general, just another form of security operations for the cloud, where you have to have visibility. You have to have automation. You have to be able to detect, respond, assess, analyze. We are well suited to actually continue to be a leader in that overall market. And so we look at the entire spectrum of that when we think about cloud security. And we think about all of our technologies actually delivering capabilities to the cloud that should allow us to have both the breadth and the depth, which is incredibly hard to do from a cloud security perspective. That's why we're still confident leaning into this overall strategic priority. So when we think about the setup, we think about like we can be best in both breadth and depth on the cloud security. And it is about data analytics and automation, which are our core sweet spots. We're not learning the new domain here. We're accelerating our current capabilities that we've been building on for the last 2 years.

Great. And I could just squeeze one in on the VM side. So I appreciate the color on the dynamics for the quarter. But just wanted to clarify, this was just purely kind of an issue with tighter budgets and people trying to be more efficient with their budgets and their security spend? Or just want to make sure it's not necessarily a change in the competitive landscape in any regard.

No. We see no change in the competitive landscape. But frankly, we still see VM as a high priority for customers. If you -- one way to think about it is part of what's happened is our customers have actually accelerated their transition to the cloud. And so when you think about VM primarily being focused on visibility and risk analytics, if some of your most valuable assets of the company are in the cloud, you're starting to ask yourself, okay, where do I actually really prioritize and what order do I do things in? And we think this is a large opportunity for us. But people are still going to do vulnerability management. It's just that people accelerated their focus areas into the cloud. And they have to actually make sure that they're actually doing everything they need to do. And in that environment, we have more of the company's crown jewels in the cloud. Yes, VM takes a slight backseat, but the overall need for it has not decreased.

The next question is from Brian Essex with Goldman Sachs.

I guess maybe, Corey, if we could peel back another layer on the demand side. What are you seeing -- I guess we're talking about FX as an issue. We're talking about lengthening sales cycles. What are you seeing if we unpack that and think about the impact to the results and the guidance? Is one more material than the other? Are these just push deals? Are customers downsizing to get deals done or maybe reducing attach rates? And is this maybe on the -- in the mid-market as opposed to large enterprise? If you could just give a little bit more color there to better understand the dynamics, it would be great.

Yes, those are good questions. So I'll just do it -- I'll just cover a couple of ones as I understand the question. What's the big drivers if you think about your guide? I'm saying this randomly. So I'll just cover -- so one is clearly FX. That's a $5 million impact. That's actually very clear. The second one is you actually -- look, Europe has been our biggest growth region. And we still are underweighted to Europe versus what the potential opportunity is for a company of our size. And so we've been investing heavily over the last few years. And you've seen us steadily grow the percentage of the business that actually comes from global customers and the percentage of the business that comes from Europe, and we set up this year to actually continue to make that investment. It just turns out that the higher rotation of investment that's worked for us so well before having a higher allocation of resources to Europe turned out after the start of the year not to be where the demand was because you see more of the challenges in Europe. So Europe itself, you're seeing it as a priority, but there's a lot of factors going in Europe. And I'm not breaking new ground. I think you've heard from a lot of companies, there's a lot of broader market commentary there. But we were overweighted, our focus in Europe, because it's still a great long-term growth opportunity. So that's the next thing I point to. The third thing that I will point to, I look at it as a long-term opportunity, and we're going to ramp into that opportunity, is that in an environment like this, security is going to be top -- every customer we talked to says, listen, security is a top priority. They also tell you that their IT budgets are pressured, and they're trying to find ways to actually get leverage and trying to find ways to get efficacy. Now that does -- not all security areas are going to be treated the same. We see a big divergence in terms of the priority that we see from our customers in terms of security transformation versus vulnerability management in terms of what the urgency is and how they prioritize it. Our belief is that we actually ramp up our sales and our channels around our attach strategy and some of our new offering is that, that can become a competitive advantage for Rapid7. But when you play that out in the guide, $5 million, Europe under some pressure and then sort of the speed that we can actually get the updated packaging out to our channel is we actually think our guidance range is actually pretty good, especially in this economic environment. And yes, without those changes, yes, we would have had a lot more bullishness there. But we think that with those changes, we think we have the right response. We think it's going to be great in the midterm. And we think that it sets us up well as we actually go forward.

Got it. That's really helpful. And maybe just a quick follow-up on the cloud side. Who are you seeing competitively? Are you seeing some of the larger platform vendors that have acquired their way into the space? Are you seeing some of the kind of cloud-native emerging vendors that are coming out kind of in the best of breed or maybe neither of those in that you have a different approach in go-to-market strategy with a foot in the door with the customers that are adopting?

Yes, I think you'll see both. I think there's definitely customers that we're actually seeing where we can actually leverage our existing relationships. And that's definitely a core focus area for us. You can think about that as almost our first priority out the gate as we actually sort of respond to that shift. Then you actually see a mix. You see like the Palo Altos, which have obviously made lots of investments for acquisitions. And you see a lot of niche players in -- I would say that we -- there's only a couple of players that have the breadth and quality of capabilities that we actually have. And I'll say probably only one other company that has the breadth and quality and the capabilities that we actually have. That said, we have been ramping our sales and marketing focus on the cloud. We have not made it -- we've been steadily expanding, but it has not been, to date, available to our entire sales force and not our entire partner ecosystem. We're actually shifting that rapidly. We're increasing the priority, both on the marketing and on the number of salespeople that are actually selling it, around it. And those are decisions that we actually made in the last quarter that we're actually ramping into right now as we actually try to meet customers' priorities where they are. As you know, we've been fairly disciplined about how we introduce new technologies. The customers' priorities are shifting and moving fast. We think that that's an advantage and an opportunity for Rapid7 in this market, in this environment.

The next question is from Hamza Fodderwala with Morgan Stanley.

This is Matt Saltzman on for Hamza. Corey, just a quick one for you. So there's obviously been a ton of growth in the MDR market in recent years. And with that, you've had a ton of new entrants into the space. So I'm just curious from your perspective today how you see the competitive environment trending on a go-forward basis? Are you expecting further bifurcation for the new entrants to go after the opportunity? Or are you expecting to see some more consolidation to a few key players?

An interesting dynamic is that you do have lots of new entrants. I would say they have very variable levels of quality associated with it. I think you've always seen this. We are really focused on high-quality, high-margin [indiscernible] services. I would say that we don't even consider all the margin -- all the market addressable. We're not interested in doing low marginal quality on the managed detection and response side. And we're interested in doing it primarily in partnership also with I would say very strategic, very high-quality partners. So that's just a point of like where we're focused. We think that's a massive opportunity. So yes, absolutely, it's got more competitive. The odd thing is that because of the labor force tightening, the market demand is probably still moved in pace with or ahead of the number of interest and the capacity of the quality players in the market. So the way that we think about the market is sort of what's the overall market demand. So -- and then what's the market demand for the segment of the market that we're focused on. And the segment of the market that we're focused on is, again, things that we can do in high quality and high margin. The demand for that has exploded over the last couple of years. So our outlook remains very positive even in a -- you could say, a more competitive environment, but part of that is that there's much more intense competition at the lower margin, lower quality end of the spectrum. And so we see a much tighter band of competition. And then to answer your last question is, yes, we actually do think that, that consolidates over time. What you see is that lots of these players start off with VC capital funding on the lower margin and lower quality side. And it's really hard to scale that business. And so you see so many of these companies get subscale, which is why we have the strategy of, yes, we'll do a little bit of our sales first in our margin stuff. But it's really a high-quality partnership ecosystem, focusing on partners that can actually deliver this in the way that we want and our customers want.

The next question is from Shebly Seyrafi with FBN Securities.

So you said that net new ARR is expected to be negative in Q3 and then go positive in Q4. Can you segment that out between VM and STS? And it looks to me, in my model, that your VM ARR growth might decelerate to like flattish. I'd like to hear your thoughts on that in Q3. And then do you expect it to accelerate after Q3? And why would it do so?

Yes. So let me answer. Tim and I may tag team. So you got a bunch of questions that we'll just unpack as we actually go along there. So one, on the -- linearization is one, I do think we have our regular, I would say, our typical calendar linearization. Most importantly, the other part of the equation is that part of why we have more confidence in Q4 is that we're actually ramping up our sales force on what we think is more customer filling packaging with the VM attached. And so there is an element of actually where we made the decision last quarter, we got our infrastructure in place last quarter. We're rolling out this quarter. You don't see the full benefits of that to Q4. The other thing that we actually did is in the middle of the year, as expected, like lots of companies, we actually did a price increase. That, again, we honor existing quotes that are out. You see more of that benefit that actually happened in the Q4 time frame. So those are 2 things that actually give us sort of like visibility and confidence with the pipe into Q4. The second question that you actually asked was around VM. So I'll tackle on the -- the timing with Tim. But just to be clear, VM is still a priority in the demand area. We said earlier that we actually saw it moving from the high teens to the mid-teens. Our outlook overall, if you actually say midterm and long term, we still expect VM to be where we've actually held our long-term outlook in the past, which is to be contributing roughly 10-ish percent overall to growth. We don't see a change in that outlook. Look, people still have complex and diverse environments. They need visibility into that. They need to understand the risk and vulnerability prioritization. That's still going to be a demand driver. But if more of that demand shifts to the cloud, you're just going to see a bit more balance about where that spend [indiscernible]. And frankly, the cloud spend started from a lower base, but actually has more growth potential ahead of it.

It's Tim. I would just add to that. I think Corey brought it up in his prepared comments. Look, STS, the security transformation solutions have continued to perform very well for us, overall growth rate and as a percentage of the new. And that's the high-value strategic element of the product set. VM is still critically important to many of our customers. But as you see this shifting to the cloud, security transformation solutions continues to grow at a very nice rate.

Right. And on this price increase, what was the percent increase? And when did that happen?

I don't know if we -- I don't know how we've communicated the percent increase, but it actually -- we did in the middle of the year. Tim?

Yes, it's going to be effective this quarter. We have not disclosed it publicly yet, but it will be a modest price increase that we think is certainly in line with what's happening in the market with inflation.

The next question is from Joshua Tilton with Wolfe Research.

Does the back half guidance assumes that the environment gets worse? Or that it kind of stays the same as what you're seeing in 2Q? And how does what you're seeing now kind of compared to what you saw during the first months of COVID?

That's a great question. So I would say our guidance assumes that it stays consistent with the Q2 exit rate. It's kind of the way I would actually throw my claim because we did see the dynamic shift over the course of Q2. So I would say it stays consistent with the Q2 exit rate. It's a great question because we saw very similar dynamics [indiscernible]. Now for those of you that may remember is that, at that time, we came out and said VM would accelerate. And it did decelerate, but it actually bounced back much faster than we expect within like a year or so. But when people are forced to make prioritization decisions, we found in that environment, too, people actually had a -- they -- security was a priority, but it was not the same priority for everyone. I would say that part of our adjustment here is we've learned some of those lessons. So we've got a -- what worked in the pandemic is that like when people have to make hard decisions, you make the decisions easier for them. And so we're applying the lessons that we actually learned with the packaging. We're applying the lessons that we've actually learned with the attach and really just being focused on how you reduce the complexity for customers. When customers themselves are under not just budget pressure but also staffing pressure, our goal is to make it as easy and as simple as possible for the customers. And we think great financial results follow that.

And just a quick follow-up. I'd have to imagine that the full year ARR guide, the mix between VM and security transformation is probably a little different now than what it was at the end of 4Q. If you lean more towards the security transformation ARR, let's call it, over the next 12 months because people don't prioritize VM as much, does that change -- how does that change your profitability profile over those same 12 months as well?

Yes. So I will give an extended view versus a precise view about the next 3 to 4 months just because this will be a continuing train of thought. There's a couple of concepts to separate. I'm going to separate out sort of like revenue and attribution from customer usage. We think this is going to accelerate customer usage of VM because with the attach strategy, what it really allows us to do was we get a larger ARR for customer faster. And so it accelerates the consolidation of the share of wallet that Rapid7 has. The customer gets a net better deal because they're spending a larger amount of money with us. And therefore, they get more capability, more coverage, faster and broader. It's a win for Rapid7 as part of the consolidation, and it's a great win for the customer overall. Now what that means is from a revenue perspective and from an ARR perspective, the attribution that goes to VM continues to shrink and shrink at a faster rate. But the opposite is true from a usage perspective. We expect that the usage of our overall technologies to accelerate, and we expect more people to actually be using more VM. And I get the case study on the call that the customer that actually attached, they decided to attach themselves and that was at from one of our programs. But as they attached, they actually covered 100% of their environment for VM. And as you know, VM typically still starts off with a smaller percentage of the environment and grows over time but rarely gets to 100% of the environment. And so part of what we actually get is customers get the visibility at the right price for the entire environment. So you want to net it out is that our ARR customer should increase over the medium term and long term at a faster rate. Our share of wallet should actually increase. That should drive customer economics to be a positive trend on profitability because our customer economics improve. For customers, that allows them to actually get better efficacy and get a better deal because they consolidated their spend overall. And because they're getting better efficacy and consolidated their spend, they're actually using the product higher. So our usage share of the market should actually increase.

Josh, I would -- and all of that fits inside the profitability framework and guidance that we've shared where we said product gross margins are in the mid-70s range, and that's what we expect.

The next question is from Alex Henderson with Needham.

Great. So I understand the environment in Europe has gotten more difficult. But I was hoping you could give us a little bit more clarity on how they're thinking about transactions, and what percentage of your sales in Europe are, in fact, in dollars versus local currency. But if I'm a CISO or CFO in a European environment, I'm looking at an 18% to 20% currency translation plus price increases on a wide variety of goods, and I'm looking at pressures on my budget. So how am I exactly approaching that? What are they telling you they're going to do? Is it they're spending the budget they'd already committed to this year and then they expect to tail in the budget next year? Are they downsizing the spend to get better quality product but in smaller volumes? And how are you handling that 20% currency translation that they experienced as a price increase in the U.S. dollar purchases as a result of the exchange rate swings? Are you giving them more breaks, more discounts or anything to offset that?

Yes. Alex, this is a great question. So you got a couple of components there, and I'll tag team with Tim again. So the first thing I'll start with sort of like the customer. You actually pretty much nailed the complex conversations that we're having with the customers about the pressure that they're under. And here's what they'll say, if you do a generic survey, everyone is going to say security's top of the list and priority. And that can be taken to be like there's no issues or pressures on security, it's actually fine. When we did, what we actually find is that what it means is that security is the top of the priority only likely shrinking IT budget. And so it is a top priority, but on a -- especially if you're a European customer, a shrink IT budget for all of the factors that you did. And so what customers are trying to figure out is how do I get more bang for buck, so to speak. How do I get more leverage out of my investments? And this is where we were paying attention and we're actually listening. And what they're saying is like, listen, I need to find a way to get the maximum amount of security and, frankly, a better economic value. I mean customers are very clear about that around the world, but especially in Europe where they actually have lots of the pressure. And that's part of the reason that we've actually taken the approach that we've actually taken is how do we make it first a win for the customer, and then secondarily a win for Rapid7. Now I think the next part of your question, I'm going to actually tag team and bring Tim into it.

Yes. Alex, I think it's a great question. So we've said 20% of our revenue is outside the U.S. Let's just say, bookings follows that general 20%. Half of that is denominated in U.S. dollars, and half of that is denominated in the local currency. So to your point, it is the contracts that are in local currency when we -- the customer comes up for renewal, they're going to look to the price they paid last year in a local currency. And you see that we've got a strengthening dollar, so that number is going to move up on them. And yes, we do entertain those conversations on discounting with customers because we believe the retention value of that customer is highly critical to us. So there is some pressure from the customer point of view because of currency.

So part of that question was, are you adjusting pricing to reflect what is obviously a price increase from their perspective because of the exchange rate and giving them more discounts?

I mean Alex, we do have those -- I mean, you can imagine, if you were the customer, put yourself in their shoes. They're going to feel that with the -- because of FX, this feels like a price increase when in fact, it's not. It's due to currency, but they think in local currency. So we do entertain and have those conversations on discounting. But I think it's critical that we -- you save valuable customers.

Yes. As Tim said, our focus is we're not going to take something that is a market effect that's impacting our customers and not be responsive to it. It's just not consistent with our ethos. So yes, we actually do respond to that. We actually do look at it. It is a driver. We think it's the right thing. And yes, we take a short-term hit in the near term for that, but it's the right thing to do for our customers.

Right. You keep them long term.

Exactly.

And that's critical.

We have no further questions. At this time, we'll turn it over to Corey Thomas for any closing remarks.

Well, thank you all for joining us for the call this quarter. We appreciate the time, and have a good day.

Ladies and gentlemen, this concludes today's conference call. Thank you for participating. You may now disconnect.