Rapid7 Q2 2025 Earnings Call Transcript

Quartr
Provided by Quartr
August 7, 2025

Key Takeaways

  • Positive Sentiment: Rapid7 ended Q2 with $841M ARR, up 3% YoY, and generated $42M in free cash flow, beating revenue and profitability outlooks. Detection & Response now comprises over half of ARR and grew in the mid-teens.
  • Positive Sentiment: Launched Incident Command, the next-gen SIEM on the Command platform, unifying customer telemetry with proprietary agentic AI workflows for end-to-end security operations.
  • Negative Sentiment: Adjusted FY25 ARR guidance to $850M–$865M and Q3 revenue to $215M–$217M, citing macro uncertainty, seasonal Q4 weighting, and deliberate forecast prudence.
  • Neutral Sentiment: Announced CFO Tim Adams will retire after transition; appointed Alan Peters as Chief Commercial Officer to drive go-to-market acceleration.
  • Positive Sentiment: Achieved FedRAMP High authorization, enabling entry into the U.S. federal cybersecurity market with expected contributions early in FY26.
AI Generated. May Contain Errors.
Earnings Conference Call
Rapid7 Q2 2025
00:00 / 00:00

There are 13 speakers on the call.

Operator

Good day, everyone. My name is Leila, and I will be your conference operator today. At this time, I would like to welcome you to the Q2 twenty twenty five Rapid7 Earnings Call. All lines have been placed on mute to prevent any background noise. After the speakers' remarks, there will be a question and answer session.

Operator

If you would like to ask a question during this time and if you have joined via the webinar, please use the raise hand icon, which can be found at the bottom of your webinar application. At this time, I would like to turn the call over to Elizabeth Schwalke, Vice President of Investor Relations.

Speaker 1

Thank you, operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's second quarter twenty twenty five financial and operating results in addition to our financial outlook for the third quarter and full fiscal year 2025. With me on the call today are Corey Thomas, our CEO and Tim Adams, our CFO. We have distributed our earnings press release over the wire and it is now posted on our Web site at investors.rapid7.com along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast and following the call an audio replay will be available at investors.rapid7.com.

Speaker 1

During this call, we may make statements related to our business that are considered forward looking under federal securities laws. These statements are made pursuant to the Safe Harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to the company's financial guidance for the third quarter and full year 2025 and the assumptions underlying such goals and guidance. These forward looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the future results expressed or implied in these statements due to a number of risks and uncertainties, including those contained in our most recent quarterly report on Form 10 Q filed on 05/12/2025, and in the subsequent reports that we file with the SEC. The information provided on this conference call should be considered in light of such risks.

Speaker 1

Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward looking statements and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call except to the extent required by applicable law. Our commentary today will primarily be in non GAAP terms and reconciliations between our historical GAAP and non GAAP results can be found in today's earnings press release and on our website at investors.rapid7.com. At times in our prepared remarks or in responses to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be one time in nature, and we may or may not update these metrics in the future.

Speaker 1

With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey?

Speaker 2

Thank you, Elizabeth, and welcome to everyone joining us on the call today. Rapid7 ended the second quarter with $841,000,000 in ARR in line with our expectations and growing 3% year over year. Revenue and profitability were ahead of our outlook, and our business generated strong free cash flow of $42,000,000. While customer spending scrutiny persist, our detection response business continues to be a core growth driver, which now represents over half of our ARR and continues to grow in the mid teens year over year. We also saw encouraging pipeline growth and exposure management in response to product investments we have made in our command platform strategy.

Speaker 2

The key message I wanna leave you with today is that we're uniquely positioned to capitalize on the escalating customer demand to bring AI tools and capabilities into the SOC. We have years of experience operating in security operation centers with our scaled software and services MDR business, and this gives us a tremendous head start with proprietary data and experience. We're taking focused action to enhance our go to market capabilities, including today's announcement of our new chief commercial officer. As we will discuss, we today have the products and the capabilities to win. Accelerating our organizational focus to capitalize on this and match our product capabilities with faster revenue growth is our top organizational priority.

Speaker 2

First, let's recap the most recent quarter. We experienced a solid second quarter that reflects strong performance globally, particularly in our larger deal segments. We won a number of meaningful consolidation opportunities at higher ASPs. This validates our strategic position in the market. Deal cycles remain extended, but we're seeing strong adoption among enterprises willing to make larger investments in comprehensive security solutions.

Speaker 2

And we have a number of signature seven figure wins this quarter that are highly validating both of our product capabilities and the value of our integrated offerings. While these higher value consolidation deals naturally have longer cycle times, the quality and scale of opportunities we're pursuing, and in particular, the ones that we have won, demonstrate clear market validation of our approach. We're optimistic about our strategy while maintaining realistic expectations around the extended deal cycles that naturally accompany these substantial commitments. I'm excited to share that ahead of Black Hat this week, we announced a significant milestone in our journey to deliver truly integrated security operations that give customers command of their end to end attack surface. We built the command platform to unify all customer data, not just the data that we collect, so that organizations get the facts from the beginning and reduce their time to action.

Speaker 2

Our new next gen SIEM, incident command, has the power to scale detection and response operations with expertise from our decades of SOC expertise and AgenTik AI integrated directly within the workflows that customers use every day. We launched the first phase of the command platform last year with surface command and exposure command. And now with incident command, we have delivered a fully integrated platform for security operations and management. This enables our partners and our MDR team to fully leverage a unified AI driven platform that provides complete visibility in the customer's environments with the ability to leverage data on demand to minimize the attack surface and respond to threats in real time. Rapid7 is the only cybersecurity vendor with years of learnings from operating a managed socket offering, including the past year activating and developing our own proprietary AI agents, and our unique capabilities and experience give us a huge advantage in this growing market.

Speaker 2

Incident Command now provides customers with the easy packaging and platform integration to activate this. Coming out of the second quarter, one theme is clear. Customers are increasingly focused on collecting more of their security data and leveraging AI in the SOC to drive measurable outcomes. Security teams need platforms that provide a more comprehensive view of their risk surface while delivering more efficient, transparent, and accelerated decision making and response. We see growing demand for unified attack surface build visibility to simplify risk management, and the mounting regulatory pressure is reinforcing the need for integrated compliance and reporting.

Speaker 2

These priorities align directly with our platform strategy, which continues to be focused on expert guided AI, automation, and providing strong ROI for customers. We benefit from the head start we have given the years of operating our own security operations center and all the learnings that accompany it, making us uniquely positioned in this market. Our long term strategy continues to focus on scaling our leading AI driven security operations platform. At the center of this strategy is the command platform, which integrates native telemetry, open data ingestion, curated intelligence, and automation into a single system of record for risk and response. It's built on three core differentiators.

Speaker 2

First, our open platform with over 500 integration, it solves a fundamental challenge for security teams, fragmented and conflicting views of the attack surface. The command platform brings together diverse data sources into a single, deconflicted, and contextualized view, giving customers a holistic understanding of the environment and the risk it represents. Second, our expert trained agentic AI workflows are built on years of Slack expertise, trained on live playbooks, and refined through real world analyst feedback. These are not generic models. They are proprietary and purpose built engines that improve outcomes in real time.

Speaker 2

And these agentic AI workflows are fully embedded in our MDR offering. Third, customers are looking for automated measurable progress. And we don't just surface alerts. We drive outcomes, whether that's when you see noise through AI informed active response, prioritizing toxic misconfigurations to maximize remediation, or coordinating faster incident response, our platform helps security teams reduce mean time to detect, respond, and remediate. These innovations continue to drive our leadership position in the growing detection and response market, our largest product segment, led by our managed offerings.

Speaker 2

During the second quarter, we advanced our enterprise MDR rollout with the addition of co managed detection, expanded support for operational cloud environments, and new SOC capacity in India. These investments strengthen our ability to support larger enterprise use cases that demand hybrid visibility, AI powered automation, and human expertise. We're starting to see our enterprise MDR investments begin to pay off and we think we're just getting started. For example, during the second quarter, we signed a multi year, million dollar agreement with a major UK based retailer that consolidated a security operations stack on Rapid7's command platform. After years of managing fragmented tools across multiple vendors with limited visibility, this customer selected our MDR led solution to unify detection response and exposure management.

Speaker 2

Our ability to deliver deep coverage, asset level context, and expert chain AI resonated throughout a highly competitive process. The decision to replace multiple incumbent vendors at a large enterprise with our command platform underscores the growing demand for Rapid7's integrated AI driven security operations. Shifting to our exposure management business. As we've discussed, a key pillar of our platform strategy is helping customers move from siloed standalone tools to an integrated outcome driven security operations model. In exposure management, that means upgrading customers from traditional vulnerability management products to our unified risk and exposure management solution, exposure command.

Speaker 2

Built directly into the command platform, exposure command provides a single contextualized view of risk across both on premise and cloud environments, enabling faster, more precise prioritization and remediation. By eliminating fragmented tools and manual integration and giving customers a more complete AI powered understanding of their risk surface, Rapid7 is firmly positioned as a strategic consolidation platform for modern security operations. Before I turn the call over to Tim, I wanna briefly address our updated outlook. We're nearing our full year ARR guidance range to $850,000,000 to $865,000,000. As you know, budget dollars and new commitments are subject to normal seasonality and are typically q four concentrated.

Speaker 2

Given a number of macro factors impacting our customers and the backend loaded nature of our new business cadence, we think it's prudent to provide this updated color. That said, we internally continue to target better pipeline conversion as we firmly believe our product offerings give us the right to win more business in the market. Accelerating our revenue growth rate to max the underlying strength of our product portfolio is a core focus. The remainder of our guidance items remains unchanged. In closing, I wanna reiterate the confidence we have in our strategy and our team's ability to execute against it.

Speaker 2

We have a clear path forward with AI driven managed detection response as it continues to drive healthy growth and our differentiated command platform rooted in automation, integration and expert guided AI is more relevant than ever. We're seeing early proof points, we're doing the hard work, and we remain focused on delivering meaningful outcomes for our customers, our shareholders and our team. Thank you for joining us on the call today. I appreciate your support, and I will now turn the call over to Tim to walk through the results in more detail.

Speaker 3

Thank you, Corey, and good afternoon to everyone. We appreciate you taking the time to join us on today's call. Before I turn to the results, a quick reminder that except for revenue, all financial results we will discuss today are non GAAP financial measures unless otherwise stated. Additionally, reconciliations between our GAAP and non GAAP results can be found in our earnings press release. Rapid7 ended the 2025 with $840,000,000 in ARR, representing growth of 3% over the prior year.

Speaker 3

Revenue and profitability were above our guided ranges, and we continue to see healthy growth in detection and response and early progress in exposure command adoption. While the customer spending environment remains mixed, particularly in North American mid market, the operating discipline and flexibility we built into our business model continues to serve us well, and we remain focused on executing against our long term strategy to deliver durable growth and expand free cash flow over time. Turning to our financial results for the second quarter. Year over year ARR growth in the second quarter was split fairly evenly between new and existing customers, ending the second quarter with 11,643 customers globally, and average ARR per customer of $72,000 Second quarter revenue of $214,000,000 grew 3% year over year and exceeded our guided range. Product subscription revenue grew 4% year over year to $2.00 $8,000,000 supported by favorable bookings linearity in the quarter.

Speaker 3

Professional services declined year over year consistent with our decision to deemphasize certain lower margin services. International revenue represented 25% of total revenue and grew 10% over the prior year. On profitability measures, our product gross margin was 76% and total gross margin was 74%. Sales and marketing expenses were 33% of revenue in line with the prior year. R and D and G and A expenses were 176% of revenue respectively compared to 157% in the prior year.

Speaker 3

Operating income for the second quarter was $36,000,000 and above our guidance range, driven by timing of spending as we continue to focus on making targeted growth investments as well as scaling our India Innovation Center during the second half. Adjusted EBITDA was $43,000,000 in the quarter and non GAAP net income per share was $0.58 Turning to our balance sheet and cash flow statement. We ended the second quarter with cash, cash equivalents and investments of $600,000,000 compared to $592,000,000 at the end of the first quarter. In May, we fully repaid the remaining $46,000,000 balance of our twenty twenty five convertible notes. We generated free cash flow of $42,000,000 in the second quarter, bringing our year to date free cash flow to 67,000,000 Additionally, we entered into a new 200,000,000 revolving credit facility.

Speaker 3

While we have no immediate plans to draw on it, the facility adds incremental flexibility and reinforces our already strong liquidity position. This brings us to our outlook for the remainder of the year. For the full year 2025, we are narrowing our full year ARR guidance range to $850,000,000 to $865,000,000 compared to our prior range of $850,000,000 to $880,000,000 Additionally, we expect Q3 ending ARR of approximately $840,000,000 with net new ARR for the year weighted heavily to the fourth quarter. As Corey said, we will continue to target stronger pipeline conversion rates in the back half. We believe it's prudent to provide this additional context given ongoing macro uncertainty and the seasonal weighting of Q4.

Speaker 3

We are maintaining our full year revenue guidance range of eight fifty three million to $863,000,000 representing revenue growth of 1% to 2%. Recurring product revenue growth will continue to outpace total revenue growth, partially offset by year over year declines in professional services. We are also reiterating our full year operating income range of 125,000,000 to $135,000,000 as well as our full year free cash flow range of 125,000,000 to $135,000,000 We now expect non GAAP net income per share of 1.9 to $2.03 based on approximately 75,800,000.0 diluted weighted average shares outstanding. For the third quarter, we expect revenue in the range of $215,000,000 to $217,000,000 up roughly 1% from the prior year. We expect non GAAP operating income between 29,000,000 to $31,000,000 and non GAAP net income per share of $0.44 to $0.47 based on approximately 75,800,000.0 diluted weighted average shares outstanding.

Speaker 3

To close, we remain focused on disciplined execution as we manage through a dynamic environment. We continue to see a resilient detection and response business, growing customer interest in our platform strategy, and a durable model that supports both innovation and strong free cash flow generation. We believe these fundamentals position us well for long term value creation. With that, I will turn the call back over to Corey.

Speaker 2

Thank you, Tim. Before we open up the call for questions, I want to address two important organizational updates that position Rapid7 for continued success as we execute our strategy. First, I want to share that Tim Adams intends to retire from his role as Chief Financial Officer. Tim has been an exceptional partner over the past three years, got us through significant transformation while maintaining strong financial discipline and operational excellence. His leadership has been instrumental in navigating both growth investments and strategic realignments, including our previous restructuring efforts that helped position us for profitable growth.

Speaker 2

Tim has committed to remaining at Rapid7 until we identify and onboard a successful to ensure a seamless transition. We've engaged a leading executive search firm to conduct a comprehensive search process. I wanna thank Tim for his continued dedication to Rapid7 and his commitment to seeing us through this important transition. His contributions have been invaluable and we wish him all the best as he approaches his next chapter. Second, I'm thrilled to announce that we've appointed Alan Peters as our new chief commercial officer.

Speaker 2

This newly created role underscores our commitment to driving our go to market capabilities to accelerate revenue growth. We have spent the past year significantly investing in our product capabilities, particularly MBR and in exposure command. We believe that our product offerings today are industry leading with highly differentiated capabilities. Alan joins us as we enter the next critical phase of delivering on this, driving the acceleration of our go to market efforts to capitalize on our unique product offerings. With detection response now representing over half of our business and demonstrating strong growth opportunities, we have both an expanding product portfolio and significant upgrade opportunity ahead of us.

Speaker 2

Our command platform provides a straightforward upsell motion across our entire portfolio, from VM to cloud to exposure management, SIM and MDR. Recent customer validation combined with the now complete integration of our technologies on our command platform creates significant opportunities. Our focus is now on growth and market adoption and how we operationalize our go to market engine, which is what matters most at this time. Alan brings the exact expertise we need. He has deep expertise in our core markets and importantly, is an exceptional operator who knows how to scale commercial organizations through periods of transformation.

Speaker 2

With over twenty five years of experience, Alan has a proven track record of scaling go to market motions, accelerating revenue growth in software, and specifically in cyber security businesses. Throughout his career, Alan has consistently delivered revenue growth and operational excellence, successfully leading companies through periods of significant transformation. His expertise in building high performing sales organizations and executing complex go to market strategies makes him the ideal leader to help us operationalize our platform strategy. Alan will oversee our global sales organization, partner ecosystem and revenue operations, ensuring we execute with a position as we capture the significant opportunities in front of us. His operational rigor and deep understanding of our markets make him an ideal leader to help us maximize our commercial potential.

Speaker 2

As we continue to drive innovation and capture market share, having world class operational leadership will be critical to delivering value to our customers and driving sustainable, profitable growth for our shareholders. We remain confident in our strategy, our team, and our ability to be the platform of choice for the modern SOC. Thank you for joining us on the call today. And with that, we will now open up the call for questions. Operator?

Operator

We will now move to our question and answer session. If you have joined via the webinar, please use the raise hand icon, which can be found at the bottom of your webinar application. When you are called on, please unmute your line and ask your question. Our first question will come from Matt Hedberg with RBC. Your line is now open.

Speaker 4

Great. Thanks for taking my questions, guys. Wanted to so D and R continues to do well. And I'm curious, I wanted to double click on that and ask specifically about MDR in there. I I know it's a pretty significant portion of that business and and had been seeing some strong demand trends.

Speaker 4

Just curious if if, you know,

Speaker 5

if you can give us a

Speaker 4

bit more of an update on on MDR.

Speaker 2

Yeah. We can see it to see strong demand trends. You know, I'll remind you that we started the MDR expansion a few years ago, and it's been a core growth engine of the business. DNR totals over half of our overall business. But even with the success we've seen, we were only really addressing part of the overall customer market.

Speaker 2

Earlier this year, we launched our customization and expansion offering that we just call happen to call enterprise in the r. But, really, what it was about was accepting all data and all workloads from customers, enable being able to manage that at quality and at scale. We couldn't have done it without the investments that we have been doing behind the scenes on our own AI technology that we have been rolling out steadily, which we are continuing to invest in. And so we look at detection response as a major growth area. You just take a step back and look at the fundamentals is every organization is under increasing pressure to actually manage their entire dataset and their entire security operations on a 24 by seven basis.

Speaker 2

The regulatory pressure is increasing. The amount of their environment is becoming more complex, especially if you consider not just SaaS, but also the fact that you're now having lots of custom AI driven applications. And so the ability to be able to monitor that complexity, people need people that are not just deploying technology, but they're also actually have the active ability to actually manage and separate the signal from the noise. And that's what we've been focused on, but our whole goal was actually make sure we could do that at quality. So that's a continued expansion area.

Speaker 2

We're investing both in the team and the services around that and the AI to support that, but that's a big investment area for us.

Speaker 4

Got it. Thanks. Then maybe, you know, you mentioned, Corey, you know, q the net new ARR is weighted towards q four, recognizing it was a good quarter relative to expectations and you did temper full year. Just can you just underscore the confidence that you see kind of specifically in 4Q, which seemingly sets a good foundation for 2026?

Speaker 2

Yeah. And and by the if you look at what we had in in q two, we saw that higher concentration of larger, more strategic deals. And so, frankly, what we're looking at is really we have a great mix of strategic deals that we're winning and converting. The deal cycles are longer because we're seeing larger, more strategic concentration. And so we're always paying attention to, like, not actually trying to estimate timing too precisely.

Speaker 2

But when we look out over the course of the year, when you look across q three and q four, we see many different paths to actually achieve the range, which is why we actually tightened up the range some. We also said, frankly, like, you look at q three, we don't wanna actually estimate timing too precisely. We got burned on that early in the year even though many of those deals closed. And we had a healthy momentum exiting q two, but we see more than enough pipeline to actually be in the guided range. We always are a little bit more back end loaded if you look at every year.

Speaker 2

Last year, we had a very robust q four. We probably are in great shape to actually have a healthy q four this year or healthy back end part of the year. But what we really look at is the fundamentals of, like, what's the pipeline, how we're doing on conversion, and how we're ourselves up. But we wanna make sure that we are in a range that we actually have confidence that we can achieve, and that's why we tightened the range and made it a bit more focused.

Speaker 3

Matt, if you Got it. The numbers. If if yeah. If you look at the midpoint of the guide, q four of this year is expected to be very similar to what we saw a year ago in q four. So we've done that before.

Speaker 4

Got it. Thanks. And and, Tim, best of luck in the next chapter of your life.

Speaker 3

Matt, thank you. I appreciate it.

Operator

Your next question will come from Junaid Siddiqui with Truist. Your line is now open.

Speaker 6

Great. Thank you for taking

Speaker 2

my

Speaker 6

question. Corey, could you comment on the progress of some of the various sales and channel enablement initiatives you've undertaken to drive adoption of your Exposure Command platform and how they're tracking? Thank you.

Speaker 2

Yes. Absolutely. I think what you're alluding to is the fact that we actually shifted last year to take more investments in our partner channel ecosystem. And we look like that's going well. We're getting good feedback from our partners.

Speaker 2

We're starting to scale that business. As I talked about earlier in the year, is that that was going to be a ramp overall. You know, one thing that we're finding that is, I would say, good in the midterm, but was somewhat different than what we expected originally, is when we originally launched exposure command, we expected it to be a smaller dollar, you know, 10 to 20% uplift, upgrade cycle. And we've continued to develop robust pipeline around that. What we're actually finding is that it is actually a more strategic choice, and we're finding that we're willing larger deals, but the deal cycles are longer.

Speaker 2

But, also, the ASPs are significantly higher than we estimated, which is, I think, positive in the midterm. But we're not necessarily getting the 10 to 20 upgrades that we originally expected between us and our partners. But our partners are excited by the ability to actually win larger workloads for customers. So we have readjusted in our guidance, our expectation. Again, having customers consolidate, I gave one case study, but we have several different case studies where customers with the full attack surface management view have larger assets under management than they have with vulnerability management.

Speaker 2

It's been a great entree into starting to upgrade the cloud workloads. But, those are much, much larger deals, much larger ASPs.

Speaker 6

Great. Thank you.

Speaker 2

Thank you very much.

Operator

Your next question will come from Eric Heath with KeyBanc.

Speaker 7

Hey. Thanks for taking the question. And, Corey, great to hear the focus on accelerating growth. I guess, what are what are some of the near term and medium term priorities to execute on that and maybe some of the internal metrics you're measuring to understand how you're tracking towards those goals?

Speaker 2

You know, it's a great question. Look. I think our team has act and we're continuing to invest in the product and the service. Look. At the end of the day, having robust investments in product and services is key, and that's been a big focus of the time.

Speaker 2

And our sellers and our customers' capability and focus on both serving the customers and starting to get the story out about what we're doing because there's been lots of changes and investments in our technology stack over the last few years. As we think about operationalizing the platform, it's a big deal now to have our full technology stack on the platform to have some of the proof points in the evidence in MDR and the DNR space and to continue to expand our exposure to our exposure offering. Part a big part of what we're doing is moving to really operationalize our expansion motion. If you think about sort of, like, the two big things that we actually have not nailed and we actually have to have improvement on that we're working with both our customer teams and our new CCO on is, one, we have to educate the market that the traction and the momentum that we have in the detection response space. You know, we are one of the larger, more successful companies.

Speaker 2

We have outstanding marks from our customers. We just had an exciting new release with incident command, but we have to actually do a good job of educating the market that we've successfully expanded beyond the traditional vulnerability management roots, and that we're actually taking data and workloads of all sizes in. So that's one is making sure we actually educate the market. So that's a clear focus. And doing that cost effectively, by the way.

Speaker 2

The second thing that we're sort of, like, are really focused on is we have to really build the operational engine for our expansion. We do it today, but we have a bunch of hardworking people that are actually going in and, frankly, doing it much more manually. And so really building the rigor and the process around that expansion engine is a big focus that I actually have going forward. But, you know, it is a big deal that we can actually do it off of a fully integrated platform that's all upgraded, ingesting data across the environment on the command platform, which was a big milestone for me and a big focus on both myself and the company over the last year.

Speaker 7

Yeah. That that that's great. And I I did just wanna if if I could just help me understand a little bit better what what's incremental with the Internet command platform versus the prior iteration. Is this just more holistic data capture onto onto a single unified interface, and is there any sort of customer migration activity that's needed to get on step platform?

Speaker 2

The the upgrade is gonna be very straightforward and easy, and it's a lot. It's actually incremental. So, like, if you look at the core fundamentals is we've actually made it easy to actually subsume both more raw data and more alert data and telemetry into the platform. So it's just like the rest of the command platform. It's about both the data that we collect, but it's also is actually rationalizing the master system record for data.

Speaker 2

The second thing that it actually has its core is it has a fully built in threat intelligence platform that actually takes a lot of the noise that you get in and helps make sense, but also helps correlate your data about real world threats and attacks or we're seeing in the environment. And probably the biggest single piece of the upgrade is we've been training and working with incident command as part of our MDR offering and training and optimizing it. And so customers out of the bot get a full experience where it actually dispenses alerts, organizes it, puts it directly into the MITRE framework, and allows customers to actually not have to actually go through and do their own research. It provides a clear point of view about what's deduplicated, what's not, what's likely a threat, what's not a threat. And it actually starts to do the work for all of our customers in the SOC.

Speaker 2

Again, this was trained on the data that's actually helped our own MDR team scale and our customers and our partners' MDR team scale in their environments. Keep in mind, our managed detection response is both us, but we have a lot of partners that do that. And we've been making these technologies available to study to those partners.

Speaker 7

That was very helpful. Thank you, Corey.

Speaker 2

Thank you very much.

Operator

Your next question will come from Mike Zikos with Needham.

Speaker 8

Hi. This is, Jeff Hopson on for Mike. Thanks for taking the question. We've seen companies that had deals slip from Q1 to Q2 from Liberation Day and then now Q2 to Q3 in some cases. Is this something you guys are seeing that could end up pushing even more to q four, even more than last year?

Speaker 2

Yeah. It's a it's a great question. So one is we definitely saw it in q two I mean, q one. You know, in in in q two, we were more prepared for it. So we actually felt like things ended up quite healthy in q two.

Speaker 2

But, I mean, to be clear, there's some things that came in. There's some things that actually were delayed in slip, but we felt overall felt quite healthy. We are not just to be clear, our baseline assumption right now is that deals will move around. This is why we gave you what we consider a prudent outlook that Tim gave in the outlook. And, look, deals with one, we have more larger deals.

Speaker 2

They're more strategic. They're more concentrated. They actually have more scrutiny. And so there's a range of a couple million dollars that actually happens. We don't think that's a big deal, which is why we really focused on the outlook for the overall year.

Speaker 2

But I'll say q two, we felt good about the mix. Q three, we assume that it's stable. A few deals may slip. That could actually add some incremental pressure, but that's why we're managing to the full year outlook, not really focused on sort of, like, the q two, q four timing because we found that that wasn't as big a deal once we actually got through April.

Speaker 8

Got it. Thank you. And could you just give an update on the timeline of the investments, in the, India SOC? The SOC has come up a lot in discussions, and just curious of, you know, how that's been going.

Speaker 2

Thank you. Yeah. No. It's a good one. It it's in ramping.

Speaker 2

You know, what what I would say is that we're ramping capacity, but just as importantly, we're adding capacity and, frankly, accelerating, and and we're gonna continue to accelerate the capacity of what our AI engine can do. We have a global 24 by seven stock around the world that actually operates in The US, operates in Europe, operates in the Pacific region Asia Pacific region. And so adding India is another region because we do believe that AI gives us scale, but we think people matter. We think security is an ever evolving thing. And so this is an ideal area where you actually take AI and you actually push it.

Speaker 2

The fact that the matter is we love the fact that our security operations team pushes our engineering team aggressively, and it's actually helped push the bar not just on the success we have, but it's also pushed us aggressively to actually do even more from where we are today. And we think that's a very healthy dynamic, and I think the customers of Internet command are gonna be able to see that value directly in the product.

Speaker 3

Jack, when you when you see it hit in the p and l, it's definitely ramping up in the second half of the year. If you look at the OI guide for q three, it's a pinch below where we landed in q two. That's really the investment really starting to tick up in q three and q four of this year.

Speaker 2

Thank you. Thank you for the question.

Operator

Your next question will come from Joshua Tilton with Wolfe Research.

Speaker 9

Hey. Can you guys hear me?

Speaker 2

Yes. Hear you. Good, Josh. Thank you, Josh.

Speaker 9

Awesome. Thanks for thanks for squeezing me in, and congrats on the on the results. I I have two. The first one, you guys kind of sort of addressed it, but I guess I'm still a little unsure as to why you guys are lowering the high end of the ARR guide. I think you said that the ARR this quarter was in line with your expectations.

Speaker 9

You know, there was better bookings linearity. It sounds like there's still deal scrutiny, but it hasn't gotten worse than last quarter. So I'm just trying to understand why exactly, is the high end of the guide, coming down. That's my first one.

Speaker 2

You know, it's a great question. So the core of it is if you look at what's happening on a fundamental basis, we're continuing to build total pipe. We are seeing a larger concentration of more strategic deals that are at that. And you know our history, but that's actually a new thing that we're actually going through. And we actually think it's prudent not to be out of our skis.

Speaker 2

So we have high confidence in the guidance range. Could we do better than that? Yes. But our focus is actually giving investors a high quality range that we actually feel good on, especially when you actually have a back end load a year and you actually are seeing a higher concentration of larger and more strategic deals, we actually feel okay about the economy in general. We are seeing a deal mix shift up.

Speaker 2

But we also don't want to in a world that is volatile, let's just put it that way, we don't wanna put all of our eggs in the basket if everything is going to actually be fine across the rest of the year. So we gave you what we actually thought as a a range that we actually feel good about, especially as you look at sort of, like, the remainder of the year, and we can actually land the time and how it lands. We'll be able to get pipe, and it's more robust there, but that's the focus. We wanna make sure investors have a clear sense of where we are, where we actually have confidence, and what we're seeing. Okay.

Speaker 9

Makes sense. And maybe just just my follow-up. You know, you announced new chief commercial officer. I believe that's the title of the role. Corey, I think the words you used were drive go to market capabilities and accelerate revenue growth.

Speaker 9

Clearly, half the business is still doing pretty well. The other half of the business, obviously, kinda lagging. Day one, new chief commercial officer, like, you know, what are his expectations? Like like, when when when when would Corey like to see him start to really make an improvement to the half of the business that's been kind of overshadowing the strong growth in DNR?

Speaker 2

Yeah. So so one, I think that steady wins the race. So we have a high sense of urgency, but we wanna focus on fundamentals. I expect to actually see continued success in DNR, and we don't wanna wreck sacrifice that because that's a robust market that's healthy, that has healthy trends overall. The biggest thing that we actually are going to focus on when it comes to the other parts of the business is really operationalizing the customer go to market expansion engine.

Speaker 2

I think we have some efficiency gains to do. I think there are some things that actually make it easier for our sellers to actually get momentum. There's some market things that we have to do to actually make sure people actually are aware of where we are and that we're actually selling in a platform motion. And so I'm really expecting the leader to actually work with our teams on making things easier for our sellers to actually go not just tell the story, but be able to cross sell and upsell more efficiently and effectively. If we do that, everything will actually follow, and, actually, growth will follow.

Speaker 2

My expectation is to see improvements as we actually move into next year, and we'll continue to actually talk about that and educate you about where we are along the way. But I think we're doing off of a stronger base of a more integrated platform, but we don't wanna lose the momentum that we actually have in DNR. What we really wanna do is make these selling motion easier for our sellers.

Speaker 9

Awesome. We're excited to see it. Thanks.

Speaker 2

Thank you very much.

Operator

Your next question will come from Aiden Perry with Piper Sandler.

Speaker 2

Hi. Can you hear me? Yes. Can you just This

Speaker 10

is Aiden on for Rob Owens, and thanks for taking my question. It was, great to see the recent FedRAMP achievement. And I understand it might still be early, but how are you thinking about the federal opportunity in longer term and your right to win in this area versus other competitive solutions?

Speaker 2

Yeah. We're very excited about it. If you look, we actually have some early customers that we've had for a while that, you know, give things more of an exception basis. We see a robust opportunity there because we have not had these certifications, and this is a catch up area. And we see lots of healthy demand where we can help make those workloads more efficient, more effective, introduce some competition into the market.

Speaker 2

So this is a huge upside for us. That's it. It's the federal government. Deal cycles are actually longer. It's an impact that we start expect to start seeing in '26.

Speaker 2

We got the certification. Our teams are out in the market now. We're frankly scaling the teams that are actually addressing the federal government workloads, but it's a benefit that we start expect to start seeing in '26. The federal government is one of the largest and most stable spenders on security, and we haven't been participating in the market. And I'm thrilled that we're actually doing it now, but we have to build up our capacity to actually do that well and not just in the narrow way that we've been doing it, but in a more expansive way.

Speaker 2

And so it provides a good opportunity in front of us.

Speaker 10

Great. Thank you

Speaker 2

for the color. Thanks. I appreciate the question.

Operator

Your next question will come from Gray Powell with BTIG. Star six will allow you to unmute, Gray.

Speaker 5

Okay. Great. Can you guys hear me okay?

Speaker 2

We can hear you just fine. How are you?

Speaker 5

Alright. Awesome. I was a little slow on the trigger there. Thanks for taking the question. Greatly appreciate it.

Speaker 5

So so yeah. Look. I I I know that the the MDR space is is pretty fragmented. But I I guess I'd be curious, like, how does Zscaler's acquisition of Red Canary change the competitive landscape there, if at all? Do do you see any potential discussions resulting from that that acquisition or any potential tailwinds?

Speaker 2

You know, there could be some tailwinds. You know, who look. These sales are incredibly talented company. I have a lot of respect for Jay and the team there. I don't think it changed anything mostly because the MDR market is a highly fragmented market.

Speaker 2

So, know, our focus is doing what we think we actually do best, which is offering a high value solution to manage cost all of customer security data with a high quality level of service. And I think we've made great strides there, but, frankly, we're we're ambitious. We plan to make even greater strides there, having a high bar for some be you know, our goal and we have you know, we have this history of Rapid7 around security and security focus. We wanna be the best home in the world for security practitioners, but then also marries that with some of the latest advances in artificial intelligence to actually give customers a trusted provider of security solutions. I think if we do that, we'll be wildly successful.

Speaker 2

And I also think the market will be a highly fragmented market. And so I think because of that, it doesn't really change the dynamics. Overall, it's a noisy market. Frankly, I think we have not been the most effective that we could be telling our story and making sure people know how impactful and successful we are. Every time we meet customers and they actually look at it or they get references from other customers, they're constantly surprised about how impactful and how successful we are and the quality of service that we actually have.

Speaker 2

So we have to actually do a better job of telling our story, and that's frankly gonna matter more than anything, you know, that's happening in the competitive environment. Again, it's a big market. If you just zoom out, my estimate is that over 90% of the world will not have the capacity to do what's required from a security operations perspective, which is to manage and monitor all their data, all their telemetry on a 24 by seven worldwide basis in an incredibly technology fragmented and highly regulatory environment. That's a massive opportunity, not just for us, not just for Zscaler, but for the world. And we have to compete effectively, but we're doing that from a scale position, from an innovative position, and, frankly, from a position where we actually are able to attract great cybersecurity talent.

Speaker 5

Understood. That that's very helpful. Thank you.

Speaker 2

Thank you. Thank you very much. Thank you.

Operator

Your next question will come from Adam Borg with Stifel.

Speaker 11

Awesome. Can you hear me okay?

Speaker 2

Can you me just fine?

Speaker 3

Hey, Adam.

Speaker 11

Hey, guys. Thanks so much for taking the question. Maybe just for Corey. So as we think about the command platform and the various pieces coming into place now with incident command, how do we think about just overall pricing and packaging? You just spent a a few minutes ago, you talked a little bit about trying to make the selling motion easier for sellers.

Speaker 11

And just thinking when, you know, Alan joins, what's the opportunity around pricing and packaging given what he just mentioned? Thanks so much.

Speaker 2

Yeah. Look. We got work that we have to do. We've done some you know, we've gone through multiple iterations over the years with doing consolidation packages, which has helped on the initial sale. We have not actually nailed the price impact chain on the expansion motion.

Speaker 2

And even if you think about the success that we're having in explosion command, it's strategic success that's either really, really massive upgrades or significant new lands. And so we have to actually make it easier for our customers to actually adopt on the journey and actually take off bite size increments and for our sellers to be able to actually sell the bite size increments on the journey. So there's work to do there, just to be clear. I mean, if you look at, like, where our our growth is versus where our platform, it's actually very clear that we're actually taking in large complicated chunks. And the biggest drag on growth is we actually don't have the continuous expansion engine.

Speaker 2

And we we own doing that, and we actually own doing that well. So that's a relatively large area of focus that gives us steady, frankly, better predictability over time. Because I well, I love having some of the success that we're seeing in larger deals. I don't love not having the volume of transactions there. So it give us both more predictability, but it also materially actually assist in the revenue growth piece because we have 11,000 customers.

Speaker 2

We have a good story. We have to tell them the story, but we have to provide the right bite sized shots people to bite off. And so that will actually both help the growth, but it also help the overall, customer experience.

Speaker 11

That's great. And maybe just as a quick follow-up, you know, number of customers, you know, modestly fell for two quarters straight. When should we get begin to see that stabilizing? Thanks so much.

Speaker 2

Yeah. So I think what you're seeing is that we're doing quite well at adding strategic customers. Look. We have some, what I'll consider, legacy customers and trade off. We owe you a measure to actually think about about think about quality overall.

Speaker 2

It's not something I'm focused on at all is the customer count. I really wanna shift it to be how many customers do we actually have, how far in the journey of customers fully leveraging the platform, how many coverage is our AI managed SOC managing? How many workloads are we managing and leveraging through AI? And that will represent significant growth. We'll grow customers.

Speaker 2

The and so but, like, losing transactional customers, right, and strategic customers, that's gonna be noise for a little while. I won't even call it a hit when it's just noise for a little while. We do owe you some better measures about how to actually see that equality. So, you know, I'll have the team. We'll work together on that.

Speaker 2

But it's not a big factor right now because it's a little bit noisy.

Speaker 3

Yeah. But still a lot of room to to grow that ARR per customer.

Speaker 2

It will grow the quality platform customer too. Yeah. But we have significant room on ARR per customer, and that's the focus. But we all are so adding new customers in a quality way. But we are having, like, again, you know, sets of small dollar customers fall off that are more transactional as we have larger, more strategic customers.

Speaker 11

Very helpful. Thanks again.

Speaker 2

Thank you very much.

Operator

Your final question will come from Rudy Kessinger with D. A. Davidson.

Speaker 12

Hey, Greg. Can you guys hear me okay?

Speaker 3

Yeah. Hey, Rudy.

Speaker 12

Okay. Great. So I I wanna kinda go back to Josh's question about lowering the ARR guide by $15,000,000 on the top end. I think last quarter, you guys said the outlook kind of relied on some stabilization and declines you're seeing in your VM business. I'm curious how that trended in the quarter.

Speaker 12

And because when I look at your ARR, if DNR has continued to grow in the mid teens and make up an increase in mix while your overall ARR growth has slowed, obviously, that math suggests that the declines in in the rest of the business are actually worsening. So I'm curious if you could just give any color on that dynamic.

Speaker 2

Yeah. No. It's it's a great question. So, you know, the first thing is we are seeing very healthy both pipeline and conversion. It is much chunkier this year.

Speaker 2

So it's larger, more strategic deals. And, frankly, we are getting better and better at forecasting those, but we don't wanna be out over our skis. We saw exactly what we hope to see in q two, and so we feel good about the overall q two dynamic. But we want to have a range that we actually have high confidence in. To answer your core question is, you know, I'll answer it two ways.

Speaker 2

One, we have a massive DNR opportunity, and we expect both the work that we've done on the product side, but, frankly, the work that we're investing on the sales side, we think that we are actually have more growth capacity in the overall DNR business. And it's a larger, more strategic market, so we have laser sight and focus on that overall. The second thing that I would say is we are in the technology around both vulnerability management and exposure at the core level, but we think about that as an upgrade motion in the install base and business. And we're frankly happy with what we're it's not what we expected to see, so I don't want any of You know, we expected to see a bunch of smaller dollar transactions that would have given us higher predictability and concentration on growth. And what we're seeing is robust pipeline build, but customers making strategic platform decisions.

Speaker 2

And, again, frequently, they're choosing us, but instead of a smaller dollar three to six month sales cycle, we're definitely seeing a larger dollar nine to twelve month sales cycle. And so part of what we're bringing it down is that, like, the, you know, the smaller dollar high volume is much more predictable, and that was our base coming in. We like what we're seeing in the larger strategic consolidation dollars. We like what we're seeing in the upgrade motions. I gave you a couple examples in the case studies early on.

Speaker 2

But those are a little bit trickier to actually forecast the timing of. And so based on where we are and the concentration of larger deals and pipeline, we actually adjust our guidance to where we want to be. And that's really the dynamic that you're talking about, Bala. Sounds like q two was fine, and you saw what you need to see. Absolutely.

Speaker 2

It was act absolutely. It was actually fine. What's not what we wanted to see is the volume of smaller dollar upgrades. Of that, we have to actually tune the engine on. But, frankly, if you zoom out, we're fine with that because we're seeing the consolidation and the wins on the large dollar, and we actually have a path to that.

Speaker 2

And we don't wanna distract ourselves too much from the really large DNR opportunity that's upon us. Sorry. I know that was a lot, but I really wanted to get to the core of the core of that question. Alright. Thank you all very, very much.

Speaker 2

Look. As we close out today, I just wanna thank Tim again for his work, commitment, and service to the company. I'm deeply appreciative of his commitment and what he's helped us achieve here as we've gone through, frankly, radically reforming the company to be something that's equipped to actually invest in and actually tackle the future opportunities that we see in the world around us today. So thank you so much, Tim, and thank you for all for joining us on the call. Stay.

Speaker 3

Thank you.

Powered by Quartr