Rapid7, Inc. (RPD) Q4 2023 Earnings Report, Transcript and Summary

Good afternoon. My name is Krista, and I'll be your conference operator today. At this time, I would like to welcome everyone to the Rapid7 Fourth Quarter Earnings Conference Call. [Operator Instructions] I would now like to turn the conference over to Elizabeth Chwalk, Director of Investor Relations. Elizabeth, you may begin.

Thank you, operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's fourth quarter and full year 2023 financial and operating results in addition to our financial outlook for the first quarter and full fiscal year 2024. With me on the call today are Corey Thomas, our CEO; and Tim Adams, our CFO. We have distributed our earnings press release over the wire, and it is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast, and following the call, an audio replay will be available at investors.rapid7.com. During this call, we may make statements related to our business that are considered forward-looking under federal securities laws. These statements are made pursuant to the Safe Harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to the company's positioning, strategy, business plans, restructuring plans and financial guidance for the first quarter and full year 2024 and the assumptions underlying such goals and guidance. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the future results expressed or implied in these statements due to a number of risks and uncertainties, including those contained in our most recent quarterly report on Form 10-Q filed on November 6, 2023, and in the subsequent reports that we filed with the SEC. The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and the reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by applicable law. Our commentary today will primarily be in non-GAAP terms and reconciliations between our historical GAAP and non-GAAP results can be found in today's earnings press release and on our website at investors.rapid7.com. At times in our prepared remarks or in responses to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be onetime in nature, and we may or may not update these metrics in the future. With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey?

Good afternoon and thank you to everyone joining us on today's call. Rapid7 had a strong close to 2023, ended the year with $806 million in ARR, growing 13% over the prior year while delivering revenue, operating income and free cash flow above our guided ranges. Sustained customer demand for our platform offerings anchored by our detection and response and cloud security solutions and improvements in execution supported a strong topline finish to the year. At the same time, our focus on operating efficiency and streamlining our cost structure drove $84 million of free cash flow in the year, exceeding our target and reflecting nearly 500 basis points of free cash flow margin expansion over the prior year. As we look back at the last year, there are a few highlights that stand out. First, we continue to drive product innovation across our Insight platform. We further elevated our market-leading capabilities and our compelling customer value proposition with advancements in areas like AI-driven cloud anomaly detection. We exited the year with a scaled security operations platform that expands over their fragmented attack surface, covering strategic workloads across detection response, cloud native security or CNAPP and vulnerability management. Secondly, our sales force successfully reoriented towards our platform consolidation solutions to meet customers' most pressing needs, while navigating larger and longer deal cycles with conversion rates that improved as the year went on. Our package offerings gained steady traction throughout 2023 and now constitute roughly $100 million in ARR driven by a healthy contribution from both landing new customers and upgrading existing customers. We have reflected the deal size and conversion dynamics of our growing package mix into our forward expectations for seasonality given the onboard success of our consolidation value proposition. And lastly, we rightsized our cost structure to build a foundation for efficient growth. This was a critical initial step that positions us to be able to drive efficient growth in our business over time. A great example of our progress in 2023 is illustrated by a new customer win in the fourth quarter. A publicly traded media company with a mature and security program was extensively evaluating new solutions and looking to consolidate multiple vendors across their security operations center or SOC. The large and complex nature of the company's digital footprint and their lean team, combined with Rapid7's ability to work better together with their endpoint provider made us stand out against legacy SIEM competitors. This customer chose Rapid7 for 3 main reasons: the breadth of our cloud native platform, our ability to consolidate critical capabilities across multiple SecOps categories, including SIEM or XDR and VM. And lastly, our ease of adoption and integrations with other security vendors. We displaced a competitor with our Managed Direct Complete consolidated offering, securing a multiyear deal worth over $0.5 million in ARR. We believe the progress we made in 2023 sets us up well to win market share, accelerate growth and be a leading security platform consolidator in the next few years. Looking forward, we see 2024 as a critical year to accelerate our platform differentiation by driving focused investments to lead in mainstream cloud security adoption, drive security productivity with AI, extend our service and partner ecosystem to deliver sustainable and efficient growth going forward. We are delivering this strategic execution against a backdrop of stable, yet noisy demand environment. Amidst this backdrop, we are leaning into our areas of strategic focus in building our security operations platform for acceleration. We're investing and innovating in areas where we see substantial demand over a multiyear horizon and where there is a clear opportunity to elevate our customer value proposition and the services ecosystem that supports it. We're making deliberate investments to build the strongest managed SOC ecosystem and deliver a leading data platform that contextualizes risk across a fragmented complex environment. Here are the 4 key areas where we are focused on and investing in as we build our leadership position in the extended SOC. The first is on integrating and contextualizing more data across the digital attack surface particularly as security teams are managing data across traditional and cloud environment. Ease of consolidation of data on our Insight platform allows customers to apply the best operational context to their security programs. The breadth and quality of our platform features are strong, and our internal SOC has years of expertise and data to better understand the attacker. In 2024, we're focused on elevating the customer experience, with a better, more integrated Rapid7 technology platform to support fragmented IT environments. The second area of investment will be around driving cloud security adoption and mainstream enterprises. As security programs mature, lean teams with significant resource constraints increasingly need to secure their cloud environments. We believe the majority of cloud security buyers in the coming years will look different from the typical buyer we've historically seen. We are focused on delivering CNAPP solutions that are simple to use, affordable and integrate it into our broader security operations platform. And our packaging and distribution is being fine-tuned for our mainstream enterprise customers. We are also extending our capabilities, building on the solid traction in cloud security posture management to be a leader in cloud detection and response. The third area of focus is the use of AI for improving security operations. Our AI-powered SOC continues to drive our leadership in managed detection response, one of the areas of highest growth in customer demand within security operations. We are focused on using machine learning and large language models or LLMs, to improve our SecOps coverage and detection in multiple areas, including anomalous activity monitoring, analyst workflows and quality assurance. In addition, we are working on leveraging LLMs to drive efficiency and accelerate response times. We are building and refining these capabilities inside our SOC and manage delivery ecosystem to help get product innovations to market faster, and we'll continue to expand on these AI capabilities with a focus on productivity and efficiency all while safeguarding our customers' data. Lastly, we will be investing in our services and partner ecosystem with an emphasis on growing key channel relationships, accelerating our MSSP partnerships and increasingly engaging with customers in marketplaces like AWS. As we look out at the rest of the year, Rapid7 has a compelling opportunity to build better, more connected customer experiences across our platform. We believe that the foundational work we're doing will position us to drive market share gains and higher durable growth over the medium to long term. At the same time, we're focused on optimizing for efficient growth and remain laser-focused on scaling free cash flow. Consistent with our previous commentary, we expect to generate at least $160 million in free cash flow in 2024. Looking towards our overall financial outlook for the year. As we process a healthy finish to 2023, balanced with our expectation for a continuation of the recent stable demand backdrop, we remain focused on providing a high confidence range for our 2024 financial outlook, which Tim will detail in his remarks. We are focused on making deliberate platform and services investments to reaccelerate and drive durable, long-term growth. We are optimizing around our technology and distribution channels, which we believe will position us for the best multiyear growth outlook. With that, thank you for joining us on the call today. I will now turn the call over to our CFO, Tim Adams, to share additional detail on our financial results and outlook.

Thank you, Corey. Good afternoon, everyone, and thank you for joining us on the call today. Before I turn to the results, a quick reminder that except for revenue, all financial results we will discuss today are non-GAAP financial measures unless otherwise stated. Additionally, reconciliations between our GAAP and non-GAAP results can be found in our earnings press release. Rapid7 ended the year with $806 million in ARR, growing 13% over the prior year. Growth was led by healthy customer demand for our integrated security operations platform and supported by expansion and innovation in our detection and response and cloud security capabilities. We saw strong traction as our consolidated offerings ramp throughout the year with improving sales conversion rates as the combined value and efficacy of our solutions increasingly resonate with mainstream enterprise customers. ASPs increased as we benefited from larger deals tied to our package offerings. And we saw roughly balanced contributions from new and existing customers throughout the year, with particular strength in cross-selling to our existing base. These dynamics speak to the effectiveness of our technology and our strong value proposition as customers consolidate across our Insight platform. Our customer base grew 5% year-over-year to end 2023 with over 11,500 customers globally. ARR per customer grew 7% over the prior year to approximately $70,000 at year-end. Full year revenue of $778 million grew 14% over the prior year and exceeded the high end of our guidance range. Product revenue also grew 14% over the prior year to a full year total of $740 million. Our commitment to profitable growth, including the changes we made to our cost structure in August, drove meaningful expansion in operating income and free cash flow, and we exceeded our guided ranges on both metrics for the year. We delivered $102 million of operating income which represents full year margin expansion of over 800 basis points. And we generated $84 million of free cash flow, which reflects an 11% free cash flow margin for the year. Now turning to our fourth quarter results. Total Q4 revenue of $205 million was up 11% over the prior year and above the high end of our guidance. Product revenue grew 13% year-over-year to $195 million, while professional services declined 10% to $10 million as we actively deemphasize certain lower-value services. Our international revenue grew 21% over the prior year and represented 23% of total revenue for the fourth quarter, while North America revenue grew 9% and represented 77% of total revenue. Product gross margin was 76% in the quarter and total gross margin for the quarter was 74%, both in line with the prior year. Operating expenses in the fourth quarter reflect changes to the cost structure starting in the third quarter of 2023. Sales and marketing expense declined 5% year-over-year and represented 32% of revenue, down from 38% in the prior year. R&D expense was slightly lower than the prior year and represented 16% of revenue, down from 18% while G&A represented 6% of revenue, down from 8% in the prior year. All in all, fourth quarter operating income of $41 million was better than our guidance and represented a 20% operating margin exiting the year. Our adjusted EBITDA was $48 million in the quarter and net income per share was $0.72. Moving to our balance sheet and cash flow. We ended the year with cash, cash equivalents and investments of $439 million compared to $373 million at the end of Q3 2023. We delivered better-than-expected fourth quarter cash flow from operations on higher operating profitability, which helped drive over $60 million of free cash flow in the quarter. This brings us to our guidance for this year. As we enter 2024, we assume a relatively stable macroeconomic backdrop and customer spending environment, consistent with the back half of 2023. This assumption informs our high-confidence growth outlook for ARR this year. For the full year 2024, we expect ending total ARR of $885 million to $895 million, which represents growth of 10% to 11%. As Corey shared earlier, this range reflects our strategy to focus this year on deliberate investments for more efficient, durable, medium- to long-term growth. In terms of seasonality, as deal sizes get larger and reflect a scaling contribution from the success of our platform and packaged deals, our new ARR linearity assumptions for the full year reflects slightly stronger seasonality with a naturally lower contribution in the first quarter. Turning to the income statement; we expect total revenue for the full year to be in the range of $848 million to $856 million, representing growth of 9% to 10%. As we continue to focus on these strategic areas of our business, we expect product revenues to grow slightly faster than this range, offset in part by professional services revenue which we expect to decline to approximately $30 million for the full year. On profitability measures, we anticipate strong growth in operating income which we expect to be in the range of $150 million to $158 million for the full year, implying operating margin expansion of roughly 500 basis points. We expect net income per share to be in the range of $2.10 to $2.21 based on an estimated 75.1 million diluted weighted average shares outstanding. For full year 2024, we expect to generate at least $160 million in free cash flow. This implies roughly 800 basis points of free cash flow margin expansion. In terms of free cash flow seasonality, we expect a modest contribution in the first quarter, driven by a number of cash expenses that are concentrated early in the year, including the FY '23 bonus payments and timing of tax payments. We would then anticipate a notable ramp in free cash flow in the second quarter. Moving to quarterly guidance; for the first quarter of 2024, we expect total revenue in the range of $203 million to $205 million, representing year-over-year growth of 11% to 12%. We expect non-GAAP operating income for the first quarter in the range of $37 million to $39 million and non-GAAP net income per share of $0.52 to $0.55, which is based on 74.4 million diluted weighted average shares outstanding. We made important progress in 2023 across product innovation, go-to-market improvements and rightsizing our cost structure. This year, we have a compelling opportunity to build on that foundation to position ourselves for reacceleration and share gains in the next few years. Thank you for taking the time to join us on the call today. And now we will open the call for questions. Operator?

[Operator Instructions] Your first question is from the line of Hamza Fodderwala from Morgan Stanley.

Seems like a lot of opportunities for consolidation within security operations among your customer base. I'm curious, can you talk a little bit more about how you're working with some of your strategic services partners to help drive some of that consolidation and how you're offering perhaps some of your own services as well to augment and complement what your partners are offering too?

It's a great point, Hamza. Most customers right now are trying to figure out how to deal with the twin factors enhancing security programs that have to be improved. We talked about the security backlog of demand, need for talent, need for projects and the fact that they have to do it on the budget. And so one of the things that we're looking to do is to both consolidate their security programs but to do it in a way to drive more efficiency. And that requires partners and talent on that. We are actively building out our managed services partner ecosystem. Our partner ecosystem in general, which is sort of like a big area of focus, but also partners that can actually provide cost-effective services to our customers that allow them to upgrade their security programs along the way. We are incredibly attractive to partners because we allow them to actually look at the landscape across the SIEM and XDR as well as the cloud security and additional vulnerability management. So they can look at both the overall attack surface and risk side of the equation as well as the detection and response side of the equation. And so that's attractive to partners. We're also working on this near and dear to our partners' heart is the ability to process more and more of the alerts that come in from other security products. And so I would just say it's a very big focus that we have, both with our partners and with ourselves. We do have services offering and NDR services internally inside of Rapid7. But our focus is an ecosystem approach to actually tackling this problem that customers are demanding.

Your next question comes from the line of Matt Hedberg from RBC Capital Markets.

This is Anushtha [ph] on for Matt Hedberg. Can you talk a little bit more about the assumptions embedded in the 2024 guidance as it relates to the conversion rates, the net new pipeline as well as macro environment?

Yes. So at a high level, I have to say, we think the macro environment is fairly stable. We're optimistic. What I'll remind you of is that as we did our restructuring last year, we really oriented around how do we actually deliver the best long-term free cash flow growth, which is the intersection of ARR growth, which, again, we want to actually drop share and win share over the medium term and be a share leader in ARR growth, and as well as margin expansion. Those are the 2 factors that we see as sort of driving the overall free cash flow growth strategy. As we actually think about that, to your question about how do we actually think about guidance and alignment, we're really on that strategy that we outlined in the second half of the year of saying setting ourselves up to make sure that we have very, very high confidence and conviction that we can hit targets that are outlined, but also have a setup so that we can actually exceed one or more of the targets. In this market where the market is a little bit noisy, of course, we would love to actually hit and focus on ARR as a dominant approach to growth. But we also don't want to be hamstrung by that. Our take is that if the market gets a little bit incrementally noisy, then we can actually focus on market expansion, and that's just a fine way to actually go and drive free cash flow expansion. So we really think about the guidance being a setup to make sure that we can both hit and we actually have to set up to actually deliver better under different circumstances with the trade-off between margin expansion and free cash flow growth. We always want to go on to take share, but we don't control the market.

Your next question comes from the line of Saket Kalia from Barclays.

Tim, maybe my first one for you, a great expense control for next year to drive that free cash flow guide. Maybe the question is, how are you thinking about billings growth as part of that free cash flow equation. I know ARR is the focus, but -- and there seems to be a lot of confidence there. But any thoughts on how to model billings vis-à-vis that ARR guide as we think about those contributors to free cash flow?

Yes. Saket, thanks for the question. Generally, you would think of billings and ARR growth rates being very, very similar. A minor exception for 2024, which I mentioned in my prepared comments, our professional services revenue, we expect that to be down modestly in '24 compared to '23. So that gives you a minor headwind to billings relative to ARR growth, but they're pretty tightly aligned with that one exception.

Got it. Corey, if I could squeeze in a follow-up for you. Really balanced growth in ARR here in '23 between customer growth and ARR per customer. But it's that latter one I want to focus on just the ARR per customer and just the success and scale that you're seeing with packages. Maybe the question is, what are some of the non-VM products that you're finding customers are using the most. Obviously, they get offered a lot of the products as part of those packages. Which are the products that you find that they're using the most as they adopt those packages?

Yes. Look, the big driver or one of the biggest drivers, I would just say, is the detection response, which is we shared last year, it is a scaled business. It has very healthy growth rates, but it also has a lot of late customer demands. It is a must-have. We've always said that's what we actually like about that business. It's a must-do, must-have business. People have to be able to monitor attacks in their environment. It's not saying that the exposure or attack surface management is not valuable. We think it's incredibly valuable. In fact, we're continuing to focus on like growth. In some ways, though, our strategy is, frankly, to be a market adoption a unit share leader in the vulnerability exposure of attack surface management areas because that really sets us up well to make sure that we're providing value on the attack surface response to our customers overall. But if you look at from a raw dollars' perspective, it's clearly detection response, it's generating the dollars. Even though we're focused on really having the broad distribution on our overall risk management and exposure management solutions.

Your next question comes from the line of Jonathan Ho from William Blair.

I just wanted to follow up on Saket's question and maybe delve a little bit deeper into your guidance for 2024. Is there a way for you to maybe break out for us what you expect at a high level or just directionally in terms of the growth rates for traditional VM detection and response as well as the cloud side of things as well?

So thanks for the question. It's not really a way to break that out because, again, as we do the platform consolidation offerings, it's offering multiple -- like VM is a feature of every platform overall. What I would just say is, one way -- maybe the easiest way to actually think about it is that we have, I would just say, a very reasonable very, very high confidence growth in our guidance that's just anchored on, I would say, the trends that we're seeing continuing at very reasonable levels. I actually think we actually have upsides. We actually take our cloud security solutions more mainstream. That's not something that we're factoring on for this year. It's something we're looking at as a big growth driver over multiple years. We expect to see the same type of progress that we actually saw, which was solid over the course of the last year. We think our market in cloud security is a big one, but it's really a sort of like it goes from niche specialists to mainstream cloud security providers, and I talked about -- a little bit about that earlier. But we see that as a big growth drop over multiple years. It could be upside to this year, without a doubt. I would just say the core linchpin is the continued progress that we see in detection and response, and we expect that to be fairly somewhat consistent. And we see upside from some of the other emerging areas, but they're not factored into our baseline assumptions. When we think about to your question about the given guidance, we actually just really center in the guidance on what we actually have seen, have visibility, have high confidence in. And this is something we're working on delivering that discloses into sort of how we actually think about upside.

Corey, the only thing I would add, as you mentioned in your prepared comments is we're really seeing the market adopt these packages and it's really resonating with customers. It's over $100 million of ARR, and they were introduced roughly about a year ago. So we're really starting to see that traction. That gives you a larger ASP per customer.

Your next question comes from the line of Rob Owens from Piper Sandler.

Corey, I was hoping you could maybe drill down into that commentary about driving more cloud security in a mainstream environment and exactly what you're implying there. And number 2 for me is just around customer count and kind of looking at the 11,500, but obviously, have seen declining customer counts over the last couple of years in terms of either net new or year-over-year growth, however you want to look at it. What's really the catalyst to get that moving again? What's it going to take? Is it the partner network? Is it maturation of the sales force in terms of selling the platform? Just what's going to get that moving? Because it's not that big of a number, I guess, in the relative scheme of things.

Yes. I think both of those are very sort of like there. So on the first question -- what was your first question, Rob, before I take the second one?

Mainstream cloud.

Yes, what does mainstream cloud mean exactly.

Yes. So the way that we've seen the market so far, keep in mind, when we were starting cloud, we got direct access. And so we have a very healthy cloud business and a growing cloud business. We have not obviously explicit is that we are accelerating our investment in the cloud because what we've actually found is that the early adopters of cloud security technologies were cloud security specialist teams. They were special teams that were not the main security teams that get nothing but cloud security, and they were very focused on that. And we've been participating in that market. And you see people like the Wizes of the world doing quite well. So what we actually see as we go out, though, if you think about like the -- when we think about the mainstream enterprise, think about that Russell 3000 and their property equivalent and all those other companies out there, those are folks that are not going to have like 5 to 10 people just for cloud security. They actually have to actually have security as part of their core vending. It has to be integrated in. It still has to be highly functional, has the accessible, easy to use, it has to bit of keep results. But it has to be in the context of their overall security operations program. Lots of those customers have now adopted cloud security. So we look at cloud security is a massively untapped market. A similar way, Rob, the way to think about it is that when we went into the SIEM market, originally, people are just like, why that market is on around forever, and it's a little bit tapped and we said, no, no, most SIEMs are only designed for very complex, large, complex enterprises. Most mainstream enterprises don't have a functional SIEM because they have not been designed for that ease of use, that mass-market efficacy and efficiency. We see the same dynamics in cloud. We view that as a largely untapped market. There's things that we actually are doing right now and investing in to actually allow very complicated things about how you assess risk environment, how do you do detection and response in cloud environments to actually be part of a mainstream security operations and risk program. But that's the core of what we're actually looking at when we talk about sort of that mainstream enterprise. It's the large majority of companies that have not purchased cloud security and are not going to do it at the traditional price tags of $0.5 million plus for those types of solutions. And so that's where we see the big opportunity playing out over the next few years. And we think we're all set up for that. Again, we're seeing early adoption of that. We're well set up for that. And again, I think we have the opportunity to make progress this year around it. To your other question, which I think could go into, which is about the customer count, what I would just say is lots of the customer count, I think we have plenty of space to grow customer count, but I actually want to grow it strategically. I think what I've shared before was that our customer count volume from years past had a lot of transactional sales in it. The thing I like about 11,000 customers is we made a much more strategic base that allows us to truly achieve our TAM and allows us to truly actually get material ARR per customer, and we expect that to continue to increase. We will grow the customer base. I'll just say listen, sales and sales is the fact that we're having a lot of success with the consolidation efforts. And so what it does mean is that your average sales rep needs fewer customers in order to actually hit ARR targets. Even though the sales productivity and the ARR per sales reps, we expect to continue to improve this year. Part of how we actually do that, Rob, to your point is we have a big focus on that partner ecosystem. I think you and I have talked about in the past are critical. You've asked a lot of questions about that. We think that we are ready and equipped. We have a compelling portfolio. I would say that that is still the -- we're seeing lots of momentum. I would say, still an upside drop for the year as we're onboarding partners. We're focusing on a smaller set of partners that actually have massive distribution capabilities, and we're tuning that in. So I think I got both of your questions there.

Your next question comes from the line of Gregg Moskowitz from Mizuho.

This is Mike [ph] on for Gregg. And perhaps a follow-up to Rob. You mentioned last quarter that following the restructuring, you really zeroed in -- you really zeroed in on your installed base, right? Did that focus continue with the same intensity this quarter? Or have you recalibrated back to your sort of traditional approach with respect to new logo and expansion business?

Well, I would say, look, we are in noisy markets. It's actually just, I think, more straightforward to actually tighten and focusing on your installed base. I would just say that's generally achieving because you have existing relationships, you have existing contracts, you have existing vehicles. I don't think that bias has actually changed. What I would say to the question in the previous question that Rob had is we are looking to expand the installed base. But because our ASPs are growing and the package consolidation is successful, instead of trying to actually force it, we're actually really being very thoughtful about our distribution and how we drive distribution and partnerships. And so we have a strategy in the near term to actually -- again, I want to be very explicit -- our goal is to actually take share and drive growth and be a very strong grower in the medium term. Our investments this year -- if you ask, we're opening our investments this year, we're putting more investments into the partnership and distribution and growing that investment at a higher rate than the growth in our direct sales force. And that's a very intentional thing because we actually think that that gives us scale of net new customer adds but it also allows us to actually service more customers who actually need more care.

Your next question comes from the line of Adam Tindle from Raymond James.

Okay. Tim, I just wanted to start out with the fiscal '24 guidance, which is really impressive on profitability. If I look at it, revenue is going to be increasing about $75 million year-over-year and EBIT up over $50 million year-over-year. So call it a 75% or so contribution margin on that. If you did that same analysis during fiscal '23, I think you'd come up with a similar contribution margin for drop-through of revenue to EBIT. So I guess the question would be, because fiscal '23 had risk and cost control and stuff like that, how you thought about the buildup to drive similar leverage, operating leverage in fiscal '24 as fiscal '23 and the logistics behind it. And I've got a follow-up for Corey.

Yes, Adam, we try to be very thoughtful when we go into the planning session as we move into 2024. And a lot of that stems from the actions that we took 6 months ago with the restructuring. And we really tried to be very deliberate at a department level where we're going to make our investments. Corey mentioned a little bit early in the prepared remarks, about some of this investment in innovation. So I would expect R&D as we go into next year to tick up a little bit as a percentage of revenue. But when we look across the base, I think we see nice leverage across the board in sales and marketing and G&A, and we want to make sure we're investing in the appropriate areas. And I think we can do all of that based on the way we built the plan for this year and still double that free cash flow to at least $160 million as we go into 2024.

Okay. And quickly, Corey, this obvious improved profitability is impressive, but I wonder how you would reflect on the impact on growth. You added $90 million of net new ARR this year. It looks like guidance implies around $85 million net new ARR next year, so flat to slightly down. What would it take to maybe push to a new level of net new ARR a step function above this level on growth? And do you think you could do so while holding this level of profitability?

So one, it's a very good question. What I would say is that we have plenty of growth levers in the business, whether you look at our distribution partners or whether you look at the new products and capabilities that we actually -- plan to actually bring online. When you look at the fact when we see the same market momentum and consistency that was actually in Q4 and that you see a healthier market, not just stable, but it gets even healthier. So we have, I would just say, growth drivers and catalysts in our own business. There's market ones. There's things that we're doing in our partner distribution ecosystem. So we have a number of catalysts and growth drivers. Well, I'll just say is from a guidance perspective, we just don't think that's material to actually put into our baseline guidance assumptions. So we're always going to pursue -- look at pursuing higher growth. But in our model, what we're committed to is actually delivering very strong free cash flow growth, of which I am thrilled and my focus is for that to come from higher ARR growth. But if the market is tighter or tougher, then that can just easily come from margin expansion, which Tim and our finance team has a clear room to do.

Your next question comes from the line of Fatima Boolani from Citi.

Corey, a question. I wanted to read the ARR or outlook and maybe ask you this question from a different angle. So when I stack up all of the goodness that you're seeing with respect to the package momentum, the larger deal sizes, the ASP increases commensurate with that. Why would we see a deceleration and frankly, a lot in out of your net new ARR? If you can give us sort of the flip side of the coin on what are some of the conservative elements that you're baking into your outlook here? Perhaps, there is some cannibalization and maybe some compression of existing spend. I just really like to better understand the other side of the coin on that implied conservatism, even though things are going well and you're frankly entering year 2 of a much stronger, better equipped and enabled sales force in selling these packages.

No, it's a very fair and good question. So I think the first thing I would just say is that we do expect the market to be noisy. And so overall -- so the first thing you just say is that, look, if we actually -- while Q4 was consistent and stable, we saw upward momentum in deals getting funded, and that was very healthy. Look, if the market stays very healthy, then like we have room. That's a good thing, and we actually have upside there. That's not a problem. It would be inappropriate from my perspective to actually assume that all market noisiness and challenges are behind. That's just not something that I'm going to do what we're going to do from a fundamental planning perspective. But if it is, that's sort of like -- that's very consistent. I would just say that's probably one of the biggest factors that I will consider. And then to your other point, if things stay -- I would just say, like, if I look at the positive signals and those stay consistent, like our conversion rates are great. We're seeing some of the best conversion rates we've actually seen. I don't assume that record high conversion rates stay record high. I'll just be explicit about that, even though they've been record high for a couple of quarters. That's great. If you look at what we're doing from a distribution and building pipeline perspective, as we've actually sort of like come back from the RIF [ph], we're really investing heavily in our partner ecosystem. I'll just say that our assumption is that that turns out later this year and into early next year, but that actually may turn on sooner, and that's actually a great sort of like thing that actually happens there. And so if the positive things that we actually see in the business and outlook continue, then we'll definitely, to your point, sort of be able to perform above. We do not factor that into sort of like the baseline exceptions to just say in a noisy market that things are going to actually be all good. I think that's more of just the approach that we take. What we are committed to on the flip side, and this is something that we actually instituted at the end of last year coming our restructuring is we're committed to actually delivering strong free cash flow growth and setting ourselves up to actually exceed expectations somewhere along the line in the medium-term setup. And that is sort of like a commitment that we're going to make is like, hey, if the market is noisy, then we actually have margin expansion. But if we've seen the health and consistency that we actually saw coming out of last year and that continued stably throughout this year and it goes up, then we'll feel very good about things, and we'll be going stronger.

Corey, I would just add, we're seeing strong demand from CISOs because they have a backlog of projects. And the CFOs have gotten in the way a little bit to slow things down to release.

The funding of the projects that are in the backlog -- CISOs have a lot of stuff that they want to do. We actually saw that those get funded nicely sort of like coming out of last year. And I would love to see in our aspirations to see those keeping funded. We don't have a demand problem. We do have like our customers have to continue to fund security, and the pace of that funding is something that we keep an eye on.

Your next question comes from the line of Gray Powell from BTIG.

Yes. So that last answer was really thorough, but I did just have like one follow-up to Fatima and Adam's question. So if I just look at like net new ARR trends, you bounced back to positive territory in Q3. Obviously, we had the Q4 results. The 2024 guidance implies that net new ARR additions is down. I'm just curious, like in terms of linearity, at some point, do you think that we get back into positive net add growth in 2024? I guess that's something that could happen in the second half of the year, or is that really more of a 2025 event?

Well, I think similar to the last question, I think you're asking, a, as you know more and if the market is stable and good, do you have the chance to grow higher. I say, yes. Look, we have the capacity to actually grow faster. That is not a framework that we're going to start out with. The framework that we're starting out with is basically the free cash flow framework. First is actually taking a definitive view that the market is completely stable. If that actually happens, and without doubt, we'll actually grow -- we'll grow faster.

Okay. Really helpful. A lot of color there. I appreciate that. And then last one on my side, just did the risk from August have any outsized impact on productivity or conversion rates or anything in Q4? Or was Q4 pretty much exactly like you expected it to be?

Q4 was pretty much exactly -- I would say even Q4 was slightly better than we expected. I mean like we saw -- again, we saw incredibly strong conversion rates. We saw customers funding projects. It was not budget flush to be clear. There was not like a lot of net new things like projects that customers have been waiting on spending on they actually funded those projects. Our sales team executed extraordinarily well. We liked a lot of what we saw in Q4, and we liked a lot of the momentum that we actually have here in this year.

Your next question comes from the line of Shrenik Kothari from Robert Baird.

Yes. So Corey, you mentioned about, of course, deepening investments in the partner ecosystem. And you also highlighted leverage marketplaces like AWS. So just as a follow-up to an earlier question about the new customer growth, looks like CSPM is a percent of your strategy. Can you talk about the traction with the AWS Marketplace and how much potential do you see that as we already offer products that are integrated into the AWS ecosystem, aimed at reducing the cloud attack surfaces and mitigating cloud growth. So yes, any color would be helpful here.

Yes, I don't have the numbers off we probably won't break them down. I would just say we saw good growth in AWS Marketplace traction in sales last year. We are expecting, I would just say that growth to continue. This is part of our distribution strategy in engine. And I would just say it's continued momentum, and we have upside there, but we've seen healthy growth in demand through that marketplace and through our AWS partnership. We are a strategic partner for AWS. They've been a good partner. It's been beneficial on the sales and to the customer side, and it's something that we and they are investing more into.

Your next question comes from the line of Alex Henderson from Needham & Company.

A couple of comments made on the call just seemed a little difficult to analyze. And you said you plan to gain share but I don't really know what you think the market growth rate is that you're gaining share against. So I was wondering if you could just give us some sort of parse on what the rate of the market growth is both in the near term and say, intermediate time frame. And in that context, you do talk a lot about the new customer adds, and it seems to me that you're still shedding some of the smaller customers and shifting mix to the larger customers. So it's somewhat of a bimodal number. If you could give us a little bit more quantification on what the larger customer growth rates look like versus the fallout at the bottom of the pie. That would be great.

Yes. So good questions. I'm not going to try to do the IDC, Gartner thing given the overall market growth rates because I probably like misremember stuff -- but what I would just say is that think about my comment largely, Alex, is that our assumption and our plan is to see growth rate acceleration over the midterm, you can think about that 2- to 3-year window. So we do actually plan to see like growth acceleration. And we plan for that to actually be ahead of where the analysts in the market is. And I think we can look at what they have as their growth rates is probably the best arbitrator. It's certainly something that access that, but we see the capacity. And our strategy for that, just to be very specific, is that this year, our investment is rotated to products and product differentiation and distribution and market expansion. So like we're very focused about like what are the high-growth areas, detection response, taking cloud security mainstream, getting more leverage for us and our partners through our AI and SOC investments and then extending our partnership ecosystem, especially in the managed service space. We think that those investments will allow us to both be differentiated to address more customer demand that we actually see in the overall market and actually have a more cost-efficient go-to-market motion and distribution motion. That's where we're actually putting our dollars and our investments. We think that over the next 3 years, we can be a very, very strong both free cash flow grower but also a total top line ARR grower with the actual setup and with that investment. I won't comment more on the guide because I think I talked about like the different structure we have in the guide we entered at the end of last year. So I think I've talked about that extensively. But that is just not sort of like the totality of how we actually see the midterm and the long term or even fully this year. Your other question about customer accounts, you're absolutely 100% right. We -- and what I would just say is that you can say it's smaller customers who want to just say is that both in customers, I think you know that, Alex, it actually makes a shift from transactional sales and yes, some smaller customers to a higher mix of strategic sales, where Rapid7 is a dominant security provider with all the opportunity for expansion and growth on that. So you're seeing a real shift in mix as reflected by our ARR per customer in there. So it is an intentional, as you say, shedding I would say, lower more transactional sort of like customers, it's transactional to focus, not really the dollar size to actually being more strategic. And I think we're executing great on that sort of like strategic agreement. So to that point, that's a stat we're not focused. Your question on like what's the growth rate. I think a while ago, we provided like the platform growth rate I don't have that metric on hand and ready to go.

That number is growing faster than the overall customer base.

It is. I just don't have it...

We didn't break it out. It's a few points higher than what we disclosed.

Exactly.

Your next question comes from the line of Michael Turits from KeyBanc Capital Markets.

I mean, just along similar vein of the questions that have been asked, but I guess I'll just ask 2. Corey, I guess what are the areas of the business where you can kind of best control your own destiny when it comes to that ARR acceleration? That's number 1. And then two, just curious performance in the quarter, just curious if there was anything called out, whether it's demand trends or just execution from the team, whether it's Americas versus international, if there's anything to call out.

That's a good question. I might tag team that with Tim. Look, I actually thought Q4 was fairly solid from my perspective. There's nothing that stands out, Tim. I don't know whether you think about anything that stands out.

EMEA performed very strong in Q4 in terms of new bookings.

Yes, which is an improvement over the prior year. So that was healthy. But I would just say that Q4 was overall very healthy in general. I think on the stuff that we can control, I would just say we're taking very, very disciplined mid-term investments. Look, we can control our distribution ecosystem. As I've said before, we are investing in the partner. As we bring on new distribution, things we're being quite successful at it. I just don't factor-in and that's why just like you could figure out how you want to talk about those. We don't factor in things that are in motion or in play, even if they're sort of like optimistic and doing well and hit. It's a baseline assumption. That's just not the way we're ever going approach it. We talked to you about things that are actually already done and completed. But we have a lot of control. Look, we're in the right markets. We're in sort of like the growthier parts of security, detection response is our anchor tenet. We have incredible conversion rates. We're set up well. We don't have to change our market position. So what I'll say is we have capacity to actually do well in the market. But what we're communicating, I think, overall, I'll reiterate is that the market, I'll flip it around and just say the setup that we gave you is actually one of control. What we've actually said is that like we can actually grow well and drive free cash flow independent of what happens to the market. And we think that's a great setup in a market that's a little bit noisy. And I would just say if the markets stay safe, if the market is stable, then we actually have plenty of capacity for the topline growth.

Your next question comes from the line of Joshua Tilton from Wolfe Research.

This is Patrick [ph] on for Josh. Corey, you've mentioned that the environment was noisy a few times now. Just wondering if you could unpack that a little bit further. And then also, one of your competitors mentioned that the mid-market was strong in the fourth quarter. Curious if you saw any of that outsized strength in the mid-market space or maybe increased competition?

Yes, I'll do the second one first. Mid-market was I'll just say stable and consistent for us, and it was healthy. I think we made adjustments earlier. So I think different people processing their observations about the mid-market. We processed ours at the start of last year. And I would say it was at or exceeded our expectations, and we think it's a healthy driver and contributor. And then remind me your first question again? I'm not good with the questions.

So you mentioned that the environment was noisy.

Yes, yes. So here's what I mean by noisy. When we talk to CISOs and security teams, we see plenty of demand, like there is plenty of demand. What's been noisy is if you look over the course of last year, there was different points in times where people were having trouble getting those projects funded versus not. And so we don't see a problem in actually security demand. The question is, can those security teams get those projects funded? If they're getting those projects funded, we feel great and things are great, but I'm not going to take an [indiscernible] that basically all the security projects that we actually see are actually going to get funded. That's what's been noisy. Over the course of last year, you had different periods of time where security teams were told they had to slow down some of their investments. I would say that my hope is that what we're seeing from the regulatory environment and what we're seeing more broadly is going to encourage people to actually fund the projects that their security teams and their CISOs are asking for. But it's also not something that it will be wise to actually have a presumption, that's going to be the default case.

Your next question comes from the line of Rob Galvin from Stifel.

Corey, last quarter, you spoke of a growing number of longer-term contracts with weighted average deal duration up 20% year-over-year. And I'm wondering if you've seen the same trend persist into Q4 and what your expectations are for 2024 on this front?

Yes. But still, it was strong again in Q4. So we're really pleased with really seeing those contracts being extended out beyond 1-year contracts. We're seeing a lot of 3-year contracts, both on the new and the renewal side.

Yes. I would just say that goes to what we talked about us becoming and being a strategic provider, I think I'm most proud of the team is that like if you look over the last 3 years, we have become a very strong strategic provider of security. And you see that both reflect in our consolidation offerings as well as our ASPs and ARR as well as the length and the duration of the contracts that customers want to do with us. So yes, I think that's fair.

And that's all the time we have for questions. I will now turn the call back over to Corey Thomas for closing remarks.

Well, thank you all for joining us on the call today, and I wish you all a good evening. Thanks.

This concludes today's conference call. Thank you for your participation, and you may now disconnect.