Rapid7 Inc. Stock

Good day, everyone. My name is Alice, and I will be your conference operator today. At this time, I would like to welcome you to the Q3 2026 Rapid7 Earnings Call. [Operator Instructions]

At this time, I would like to turn the call over to Ryan Flanagan with ICR. Please go ahead.

Thank you, operator, and good afternoon, everyone. We appreciate you joining us. Today, we'll be discussing Rapid7's third quarter fiscal 2026 financial results. We've distributed our earnings press release over the wire, and it can be accessed on our Investor Relations website. With me on the call today are Wael Mohamed, CEO; and Rafe Brown, CFO. [Operator Instructions]

Before I hand the call over to Wael, I'd like to remind everyone that certain statements made during this conference call may be considered forward-looking statements under the federal securities laws. These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include, among other things, our outlook for the fourth quarter and full year 2026, our expectations regarding fiscal periods beyond 2026, our transformation and restructuring initiatives and their expected costs and benefits, our strategy, priorities and capital allocation, including our evaluation of noncore offerings and plans to repay our convertible notes due in March 2027 and the anticipated financial effects, anticipated operational improvements, investments in our core platform and AI capabilities, including the development, anticipated launch timing, adoption and expected benefits of new products and AI-first services, including autonomous SOC and our expected growth drivers and financial performance.

These forward-looking statements are based on our current expectations and beliefs and information currently available to us. While we believe any forward-looking statements we make are reasonable, actual results could differ materially due to a number of risks and uncertainties, including those contained in our filings with the SEC. Reported results should not be considered as indicative of future performance. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events or otherwise, except to the extent required by applicable law. Further information on these forward-looking statements and risk factors are included in the filings we make with the SEC, including the section titled cautionary language concerning forward-looking statements in our earnings press release. Additionally, over the course of this call, we'll reference non-GAAP measures to describe our performance. Please review our earnings press release and filings with the SEC for a rationale behind the use of non-GAAP measures and for full reconciliation of these GAAP to non-GAAP metrics. These documents, in addition to a replay of this call will be available on the Rapid7 Investor Relations website. Lastly, I'd like to note that Wael's prepared remarks today are being delivered using an AI-generated version of his voice, and he will respond to questions live during Q&A.

And with that, I'd like to turn the call over to Wael.

Good afternoon, and thank you all for joining. Last quarter, I said the actions we announced were a focused reset. The actions were not the strategy. They gave us focus and room to execute. I also said this would be a multi-quarter journey. Q3 was another step. My read is simple. We delivered what we said. The company is operating with greater focus and discipline, but one quarter of execution is not a return to growth. That work remains ahead. We met our Q3 ARR guidance and core ARR was flat from Q2. That is an early sign of greater stability. It is not yet growth. We also continue to expect to exit 2026 at approximately 20% non-GAAP operating margin. Rafe will take you through the quarter, the year-end outlook and our balance sheet plan.

Last quarter, I asked you to measure us in three ways. First, cash generation. Our cash outlook for the year remains on track, and we are reaffirming our guidance for approximately $130 million of free cash flow. Cash is not the finish line. Durable growth is, but cash tells you whether the operating model is becoming healthier and whether we have the capacity to keep investing. We intend to use cash on hand to retire our convertible notes due in March 2027. After that, the interest income tied to that cash will fall away. Our job is to replace it with more cash generated by the business and carry the discipline behind our year-end margin into 2027. I will leave the detailed 2027 framework to Rafe and our normal guidance process.

Second, execution in the core, especially exposure management. The major investment choices are made. We continue to support customers across our products while placing new growth investment behind detection and response and exposure management. The core is becoming more stable. The operating model is leaner. Ownership is clearer. In exposure management, the work is underway, but it is still not where it needs to be. We will let the evidence speak before we call it progress. We will stay focused on the heart of the enterprise market, customers that need enterprise-grade security, but also need fewer tools, less complexity and faster outcomes. Our strength in the mid-market is proof of what we can do. It is not a limit on where we can win. As I said last quarter, we are changing the path of the company toward durable growth, not managing for one quarter. We also need to be clear about the noncore portfolio. Our noncore businesses have strong technology, loyal customers and efficient operations. The issue is not quality. It is strategic fit. They are good businesses, but they are not the races where Rapid7 has the clearest right to win or where we will place the next dollar of growth investment. We are reviewing the best long-term path for each business under our new strategy. In Q3, we took the first step by announcing the end of sale for selected stand-alone versions. We will continue to support existing customers responsibly and give them clear paths forward.

Third, how we reinvest. As we enter 2027, we will keep shaping the business around the core. The quarters will not all look the same. We will continue to invest behind growth, but the discipline should remain. Discipline creates capacity. Strategy decides where it goes.

One place we are investing is the service layer. Growth starts with winning in our core. The service layer lets us extend that position and deliver the outcome, not only the product. Cybersecurity cannot stop at software that generates more alerts. Customers want continuous monitoring, investigation, validation, response and resolution. This is not a traditional people-heavy service business, and it is not a choice between product and service. Product builds the capability, intelligence informs it. Service delivers the outcome. Agents provide scale. People remain accountable. We are building an AI-first service model where software, agents, intelligence and experienced security experts come together as one system. People decide, agents do. Automation helps us move faster today. Agents let us do more across more data, more steps and at much greater scale. Our ambition is to deliver security operations center outcomes as a service with software-like leverage.

Customers consume the outcome, while automation and agents help our experts serve more customers and complete more work without cost rising one-for-one with demand. That creates a path to stronger service economics over time. That is why Mel Stone's role matters. As Chief Global Services Officer, she brings our global security operations center, MDR, service delivery and intelligence under one leader. Our product and technology team builds the platform and agent foundation. Mel's organization turns that capability into a repeatable service outcome. Under Mel, threat intelligence, vulnerability research, attacker research and labs come together as Rapid7 Intelligence. It closes the loop, turning what we learn into better detections, better service and better protection.

Rapid7 Intelligence is not a stand-alone product. It is the intelligence engine for the Command Platform, our service layer and our autonomous security operations center. Research should not end when it is published. It should end when protection changes.

Last quarter, I said AI needs a foundation, not another feature. Today, I want to introduce the next R in Rapid7, reasoning. The outcome must be resolution. Detection without reasoning creates volume. response without context creates motion, resolution creates value. More and more, the next cyber fight will be machine against machine. Defense must move at machine speed, but inside clear human boundaries. At our Boston Customer Summit, we walked customers through the model we are building, three colors, mission. Red agents probe like an attacker. Blue agents investigate and respond like a defender. Orange agents reason across both and help guide the safest path to resolution. People set the mission, policy and limits. People remain accountable. Kenzo is moving from acquisition to adoption. A growing number of customers across our base are now using early Kenzo-powered capabilities, giving us real-world feedback as we build toward our autonomous security operations center.

As we design and build it, the Autonomous Security Operations Center is a governed system where people, intelligence and red, blue and orange agents work together. The service model is designed for different ways to consume it, run by Rapid7, operated with the customer or added as an assurance layer above the customer's own security operations center. One service mission, different ways to consume it, AI first, vendor-neutral and sovereignty aware.

The summit was an important checkpoint. We showed what is operating today, what is in proof and what remains ahead. We tested where agents should act, where people must remain involved and what evidence is required to trust the outcome. That work is shaping the capability, the guardrails and the service model. Based on our current progress, we are working toward our first generally available release around RSAC 2027. We view that as version 1.0, not the finish line, but the first production step in a long and exciting journey toward increasingly autonomous security operations.

We are also working with leading partners across cloud architecture, advanced models and accelerated computing. Together, we are testing how the system performs before customers depend on it. Measure us across quarters by our cash generation, by execution in the core, including clear progress in exposure management, by how we reinvest and by whether that work becomes customer adoption, ARR growth and stronger long-term value. We are not declaring victory. We are building proof. We delivered what we said. Now we must turn that work into durable growth. My commitment remains the same, clear words, fast action, long-term thinking, and we own the result.

Rafe, over to you.

Thank you, Wael, and good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers, except revenue and balance sheet items mentioned during my remarks today are non-GAAP. Please refer to our earnings release and SEC filings for additional details regarding the presentation of our results and guidance metrics.

In the third quarter of 2026, I'm pleased to report that we exceeded expectations across all guided metrics. We ended the third quarter with total ARR of $820 million, $8 million above our guidance for the quarter. We reported non-GAAP operating income of $46.2 million. Free cash flow came in at $26.5 million. As of the end of the quarter, we had total cash, cash equivalents and short-term investments of $732 million. We are particularly pleased with these results as the team remained incredibly focused on our customers and executing against our plan even as the company undertook a significant restructuring in the quarter.

I want to begin by taking a closer look at ARR as of the end of the quarter. As a quick reminder, our long-term strategy is focused on our core platform solutions comprised of our detection and response business, which includes our managed detection response offering and our exposure management business. Our core platform solutions now represent approximately 85% of overall ARR, reflecting the gradual mix shift of our business towards our core products, which on a year-over-year basis, grew approximately 1%, led by our detection response business, which at over 55% of total ARR maintained its growth rate at approximately 5% on a year-over-year basis. Our exposure management business declined approximately 6% year-over-year, offsetting some of the growth of our D&R business. Within the Exposure Management segment, we continue to see healthy adoption of our Exposure Command solution as customers upgrade from older vulnerability management solutions. In contrast to the growth of our core solutions, our noncore products, which, as a reminder, approximately 15% of total ARR declined approximately 19% year-over-year, driving the approximately 2% year-over-year decline we saw in total ARR. This drop in noncore ARR was in line with our expectations as we have deemphasized the sales of many of these noncore solutions.

As we plan for the remainder of 2026 and beyond, each of the noncore solutions are being carefully evaluated, ensuring we optimize margins as well as seeking opportunities to migrate customers to core platform offerings where possible.

Our favorable ARR performance in the third quarter reflects our strategic focus on building and selling our core solutions and focusing our go-to-market efforts on customers within our ICP. This effort led by our Chief Commercial Officer, Allan Peters, is demonstrating tangible results as we saw productivity per rep show notable improvement over the prior year. Beyond the numbers, we saw demonstrations of this strategy paying off in key wins during the quarter such as a new logo win from a global facilities management and property support services company who turned Rapid7 for both MDR and Exposure Command out of frustration with their incumbent provider for a lack of innovation and limited AI strategy.

In Europe, a large religious organization recognized the benefits of consolidating their cyber needs across a single platform and purchased MDR, Exposure Command and our cybersecurity compliance solution. In a third example, a national U.S. manufacturer came to Rapid7 looking for a provider that could understand its business and security environment and restore confidence in running a managed SOC after a failed prior implementation with a competitor. We positioned our MDR, Exposure Command and Vector Command solutions for a comprehensive end-to-end solution. These wins and more like them demonstrate our product and go-to-market team's focus on selling our core solutions into our target market.

Within the product organization, our new Chief Product and Technology Officer, Dan Deklich, now five months into his role, is making sweeping changes and has started making investments across the product and engineering organization. He has accelerated his investments into our products by rebuilding his leadership team with experienced product and AI leaders, deploying and training the team on a modern AI-focused SDLC and launching the development of our next-generation solutions. These efforts are core to the anticipated 2027 launch of the AI-enabled solutions needed to address the dramatically more dangerous cyber environment our customers are facing.

Returning now to our financial statements. Total revenue of $212.4 million declined approximately 3% year-over-year, reflecting the declines in noncore product ARR we saw earlier this year. We finished the quarter with approximately 11,800 customers and an average ARR per customer of approximately $69,000.

Turning to third quarter profitability. We delivered total non-GAAP gross margins of 72.2%, which we expect to moderate in Q4 and beyond as AWS and AI charges ramp. We reported non-GAAP operating income of $46.2 million or a margin of 21.7%, favorable to our guidance. This upside to profitability drove non-GAAP earnings of $0.60 per diluted share. Free cash flow totaled $26.5 million in the third quarter. Our GAAP financial statements also include a $5.5 million noncash charge for the full write-down of a minority investment made in the prior year. The charge appears in our GAAP income statements under other income and expense. From a balance sheet perspective, we ended the third quarter with $732 million in cash, cash equivalents and short-term investments. Combined with our continued free cash flow generation and a $200 million undrawn credit facility, we are well positioned to repay our $600 million convertible notes due in March of 2027.

Turning to the restructuring announced last quarter. This restructuring marked a strategic shift in our business operations to drive efficiency and focus across the organization, aligning resources and investments to our core platform solutions. We also created capacity to increase our investments in cutting-edge AI-driven solutions that will improve customer experience and increase competitiveness in the marketplace. As noted above, this investment is underway, but it will continue into 2027 as we build out our leadership and team within the product and engineering organization as well as ramp AI-related compute costs. We continue to expect to incur total charges related to the restructuring announced in August of approximately $11 million. In addition, the company continues to evaluate opportunities for further efficiency. These restructuring charges will be excluded from our non-GAAP P&L results.

This brings us to guidance. We expect to end the fourth quarter with ARR of approximately $812 million. And on a sequential basis, we expect that ending ARR for our combined core platform solutions of D&R and Exposure Management will be approximately flat quarter-on-quarter with expected continued sequential ARR decline coming from our noncore offerings. For the fourth quarter, we expect total revenue in the range of $208 million to $210 million, a year-on-year decline of approximately 4% at the midpoint. This would bring our full year 2026 revenue to $841 million to $843 million, a decline of approximately 2% at the midpoint and continuing to reflect the decline in ARR we have seen year-to-date. Fourth quarter non-GAAP operating income is expected to be in the range of $40 million to $42 million, even as we have accelerated some product and engineering hires into the quarter. This would bring our full year 2026 non-GAAP operating income to $140 million to $142 million, an increase of approximately 4% at the midpoint or a full year non-GAAP operating margin of 17% at the midpoint. Fourth quarter non-GAAP earnings per share are expected to be in the range of $0.53 to $0.55 per share on approximately 82.1 million fully diluted shares. We continue to expect free cash flow of approximately $130 million for the full year.

To sum up, we executed well in Q3 and are doubling down on our prioritization efforts to invest in and improve our core product offerings, even while we maintain our focus on opportunities for cost management and improved efficiency, all of which gives us confidence in where Rapid7 is headed in its transformation.

And with that, I'd like to turn the call over to the operator for Q&A.

[Operator Instructions] Your first question comes from Brian Essex with JPMorgan.

Congrats on the better results. It's great to see the stability in the operations. I guess maybe to start, Wael, could you maybe walk us through, I guess, the profile of the sales organization, the changes that you've made there, how it was affected by the restructuring? And do you have the retention there that you need to build the maturity that's required to put yourself in a better position for growth next year?

Thanks, Brian. Great question. As you are aware, as I mentioned last call, I've been in the Board for over a year prior to me taking the CEO job, and I was part of the team that actually did the search and the appointment of Allan Peters, our CCO. So we've actually been working in the background, making sure that we have a sales organization that both stable and it can be able to actually help us through growth. So I feel very good about what we have right now and what Allan has been doing prior to me joining as a CEO and been working very closely in the last few months as we evaluate the resources, what is the best way to utilize them. And most importantly, as Dan basically catch up with all the great work he's doing on his end that we'll be ready with the expertise to be able to take that to market.

We have a big base of customers. That's really our focus right now, making sure that these customers are served, understand exactly where we're heading. We had actually a customer summit in October where we brought in a sample of our customers here in Boston, around 50 customers from all over the world to be able to test our story, our road map, also get some really frank feedback about where we are and where we're heading. We showed them what we have right now, what we're building and our vision, and it was extremely positive. It was not only positive for our customers, but it was very positive to our team. And I feel very good about how the team is actually organized right now.

Great. Maybe if I could follow up on that, too. Like what -- how does that reflect to what you're seeing in the pipeline? Do you have -- do you have a building pipeline in your core business right now that gives you confidence in growth next year? Or do you feel like maybe it's reliant on the products that you need to deliver like what you're planning for RSAC 2027?

That's a great question. And sometimes the apple-to-apple is something like this is my first year here. Alan has been a little bit over a year. He feels very good about basically building the pipeline. I think we were always going to try to be able to put more investment in the area that we believe we can get more return. But the discipline, the sales process he and his management team have put in place, it gives us really a good feeling and confidence that we have the system we need to be able to basically lean on.

Your next question comes from Mike Cikos at Needham.

And I like the comments as far as the stability that you guys are starting to demonstrate here. Wael, if we could just come back to the prepared remarks, can you just peel back the layers on the services component that you were speaking to as far as what the investments are that are required? How we should be thinking about those initiatives as far as execution and how that's expected to transpire in the model?

Absolutely. One of the great things, as I came to the company, I was telling the team the other day, the more I dig, the more gold I find, and we have an abundance of data. And as you know, we're not only providing our product as a software. We provide a service layer in the form of our SOC, where customers entrust us with all the form of data, so we can be able to help them to find that needle in the haystack. And we've done a very good job servicing plenty of customers that basically we process, I want to say, in the tune of maybe 250,000 alerts a day, over a terabyte of data that we crunch. And we know that as we move to the Agentic layer, this data will be definitely what we need.

But one of the things I needed Mike to do is, as I was sitting with my top team, I'm surrounded with an incredible team, Rafe, my CFO; and Allan, my CCO; Dan, our CPTO and Katie, my Chief People Officer, I knew that I needed to have another senior person that all think about how are we going to deliver this service layer at a software economics. That's extremely important. And I believe that's the future, not only for our company, but actually in our industry.

Cybersecurity wanted to be delivered as a service. There's always a problem how to be able to do that with the right margins. And that's really a major focus to the team. So that's why the addition of Mel, Mel has many years of basically experience in high-scale service delivery in the U.S. military and the command center and bring her to our team and bring that deep expertise and the focus, if you will. So that's basically when you peel the onion, this is the layer that I'm very excited about it, the data fabric and on top of that, the service layer that we can be able to deliver it at a software economics, if you will.

Excellent. And for the follow-up for you or for Rafe here, but I know that you were talking about the restructuring and how it's freeing up capacity to make additional investments. Some of those investments obviously already underway. Others expected to begin in calendar '27. Can you help us think a little bit more about where those investments are going to be taking place? Is it more on product and getting product ready in preparation for RSA as an example? Or is it feet on the street and reorienting the go-to-market? Can you just help us think about those AI-driven investments that you guys are alluding to?

Yes. You bet. Thank you. The majority is really within the product and engineering organization. I touched on some of the work Dan is doing, making changes on the leadership level, bringing in new talent to really build this modern AI-enabled SDLC, right? And that's some different players that some different leaders, but it's also putting AI to work for us in a lot of ways. So there's certainly an element of that throughout the R&D organization where there's investment on that side of it.

But then the products we're talking about here, even if it's Kenzo from the acquisition last year as we're getting ready to roll that out, but also the new products that Wael referred to earlier, both of those take investment from the team. It's people working on them, but it's also the technology and the compute, if you will, the AI-driven compute to make them come to life. And so there is investments going on in that area. But the quick summary is really within the product and engineering is where we're seeing the bulk of it.

Your next question comes from the line of Eric Heath at KeyBanc.

Well, maybe just to ask on the noncore business, if I could. I know you're evaluating some options and thinking about it carefully. But just any further color you can share on how you're thinking about that noncore business, some options and maybe the time line you're thinking of when you'd like to be able to come to a resolution on that. And once we get past kind of that decision or that time line, then we could see kind of the growth start to reaccelerate from there.

Yes. Thanks, Eric. That's a great question. Look, I always tell my team is actually, as we set the strategy, it's what's harder than basically deciding what to do is deciding what not to do. So the first few months, I spent a lot of time with customers, with partners, with my team, talking to basically some advisers to try to figure out what we have and what we need to be able to focus on. And we feel we have a very, very strong understanding of the interconnectivity and all the connected tissues of our platform and our products. So we have a set of what we call noncore. Noncore does not mean they are not important. They are actually healthy business. We have customers that they are loyal, and they are actually produce margins, and we did not take that decision by placing them noncore lightly.

For me, a core is a big part of the business that I'm considered the leader. I have the right to be invited and I have the right to win, and I need to put every single dollar of investment behind that so I can get my fair and in some cases, my unfair share. The noncore, it is basically a set of products that we do not have the right to win those races, not because we do not have a good product, but we don't have the size and the invitation to put us in the top 3 at the selection level. So that's kind of basically the definition.

So that Phase 1 was done. The end of sale announced to the customers. We spend a lot of time to making sure that these customers understand why we did, what we're doing and understand our strategy and why we're the partner for them in the long run. And we're getting a lot of positive feedback about the transparency and the decisiveness in that decision. Number two is we need to figure out what is the best thing we need to do for the shape of the overall business. That's why managing that runoff has to be very carefully assessed. We feel that it will not be symmetric, but we're hoping in a short order, we will basically have a better answer for the best way to manage that noncore.

That's great. And then quickly, one for Raf3. Sorry if I missed it. But last quarter, I believe we were talking about growth in free cash flow dollars in '27. So I'm just curious if that was still the guardrails that you're thinking about.

Yes. Thank you. We are going to defer all '27 guidance to our next earnings call.

Your next question comes from the line of Saket Kalia with Barclays.

Wael, maybe for you just on the core business. It feels like based on the guide for Q4, it feels like the retention rates there might be starting to stabilize or churn may be improving said a different way. What do you find is working there?

Then focus and the clarity to the team, and you probably saw it from Rafe script where you can see the shape of the business is moving from 80-20 approximately last quarter to an 85-15. So our sales team, our sales organization has basically got their marching orders. It's already been moving in the right direction, all hands on deck. Our precious customers, we are basically providing them with clarity with a road map, where we're going to be in the future and most importantly, how we're making sure that the outcome they're expecting from us is fulfilled and basically get closer. So that focus is really -- is helping, and we feel good about basically our efforts now is moving the needle for sure.

Yes. And the one thing I would add there is that as Wael mentioned, the organization has been extremely focused. That move, we've been calling out the last couple of quarters, more than 80%. I wanted to update people on the current blend. And you also saw the growth rate of our D&R business was the same last quarter to this quarter. So we're feeling like we're pleased with the work the team is doing. That focus is paying off, I think, is really helpful.

Yes. No, it makes a lot of sense. Rafe, maybe for my follow-up for you. We mentioned some end-of-life products. I know we're not talking about 2027 again, but just to sort of contextualize when that end of life would start to impact ARR. Could you just remind us what are the products that are going to be end of life? When will they be end of life? And roughly how much in ARR do they contribute currently?

Yes. Thanks, Saket. And just to clarify because it's hotly detailed around here, it's end of sale. So one of the things that we have in our noncore -- noncore is not one thing. It's quite a large range of offerings. But for example, our cloud and our AppSec solutions are end of sale as stand-alone solutions, but they are still available when you buy an exposure command solution where they're part of this overall set. And so that's one of the subtle distinctions here.

What we want the team to be doing is selling this -- the bundled solutions, if you will, or the combined solutions because that's where the customer gets much more value, and that's where we differentiate and really stand out. So cloud and AppSec are two pieces in there. Within the threat intelligence area, our digital risk protection, we're into sailing on that one. We still have a good deal of customers that will continue to use it. You can still renew, you can still buy more if you're already a customer. But we want that sales focus on selling our core solutions. And so we've announced that. It will take a few months before it becomes official. But even this year, when we look into it, the comp plan was already favoring our core solutions.

The comp plan, of course, set back in January. We'll continue that push, right? We can move a lot of it. So it's a relatively small number of new sales that were going to these products this past year. We're just going to be real crisp and clear with everybody about our go-to-market efforts, how we focus on that core product solutions.

Makes a ton of sense. It really just simplifies the price list is how I read it. And thanks for clarifying that it's an end of sale and not an end of life.

Your next question comes from the line of Josh Tilton at Wolfe Research LLC.

Maybe just two quick ones for me. Rafe, I preface the next -- my first question with, I really appreciate all the disclosure and the color that you give us into the moving pieces behind ARR. But if you kind of take away the segments, the categories, what they're called and we simplify it down here, are you outperforming ARR more than you did last quarter because things that are good are getting better? Or are you outperforming ARR more this quarter than last quarter because things that have been a drag have been less of a drag?

Yes, that's a great question. I think especially if you look relative to our guide, like as I called out in the prepared remarks, we went into the quarter knowing we're doing this restructuring and knowing that can be -- that is a tremendous distraction to the team, yet we saw the team execute well. We saw -- and it was split, frankly, between the new booking side of the house. It's still not the answer we want a few quarters from now, but we did better than we thought we would on new. We also had some notable good news on some of the accounts that were at risk in the quarter.

So I don't want to overstate this. It's subtle elements, but I felt like within some of the core solutions, we saw the team really rallying and hustle in and working well with our customers where we were able to achieve a better result than we had anticipated when we gave our guidance.

Okay. And then maybe just my follow-up. I couldn't help but notice the guidance for Q4 ARR is kind of in line with how you guided this quarter. Like maybe signaling aside and all that, like what gives you the confidence to guide in a way that kind of makes us feel like we could see the end of ARR declining on a sequential basis?

It wasn't centered around that. I will just tell you straight away. We are calling out that we will see a decline from the $820 million that we finished at down to the $812 million that we guided to. That said, like it's more just the way the math worked out that it happened to be the same number in all fairness. We go through like really exhaustive efforts with the team, with the RevOps team, with the sales leaders to make sure we have just as much visibility as we can about how bookings are going to come in, how renewals are going to come in to really do our best to form our guidance. And that's the hard work that goes into this to try to do our best and provide insight wherever we can.

I did call out in the script that we expect that core will be approximately flat sequentially and noncore will be what pulls the ARR down as we go forward. And frankly, we do expect that pattern is going to continue into the near future that we have visibility to. That's a key element of where the business is just as we really focus everybody on core and get these new products out and hope to build growth there. But that noncore drag is going to continue for a little bit.

Your next question comes from the line of Shrenik Kothari at Baird.

So, Wael, you had previously highlighted this particularly attractive customer segment of $100,000-plus opportunity. And today, you and Rafe pointed to improving productivity and also focusing on this ideal customer profile is beginning to produce these results. So just wanted to unpack like how is that opportunity developing in practice? Are you seeing these sort of average deal sizes in that range holding up as you become more selective? And also are you seeing a larger proportion of the new logos coming from these customers or not? Then I have a follow up.

Yes. As I mentioned, when we basically start focusing on the core, we also wanted to tune our ICP and the area that is very natural to us, and we have a very, very positive basically customer pull. So as we are aligning this, we're feeling good about basically the shape of the business. We're very natural in what I call it the heart of the enterprise. The companies that basically want to rely on us to take complex basic security jobs and simplify, provide them with a 724 around the world basically solution that they can be able to digest and ensure that they are basically more secure with us. We see that all the time. We see it even when we go and get into a side-by-side with one of our competition, how it's very natural when we are in our ICP that the deal can happen faster and quicker and our value proposition is more clear. So as the team is seeing that, I think our shifting is becoming easier and give us the confidence to actually put the wood behind there, if you will.

Got it. Very helpful. And a follow-up for -- you had previously acknowledged some near-term cloud cost pressure associated with Kenzo development testing. And today, you did mention the SOC efficiency still largely ahead and while also expanded on the AI-first service model to allow agents to support more customers without rising costs. So just -- I know you plan to provide more formal guidance in the coming quarter around that transition. But just how should we think about the magnitude and the timing of the transition? If you can just highlight like the progress there?

Yes. So I think the best way to think about the investments that are going on there, they're going to -- we're in kind of early stages, and we're in a little bit of, frankly, a time where we're developing that next generation or developing those products and solutions, but we still have to provide good support of our customers as we go through this, right? So we're building efficiencies in, and we'll start to see the fruits of that. We'd like to think over the course of 2027.

Wael mentioned in his prepared remarks, some of the Kenzo infrastructure, we're starting to move customers over that in their earliest stages and getting that up and running. So we're making very nice tangible progress. But that -- those offerings do a couple of things. They provide better service to the customer, and then they're going to also help us build greater efficiencies into our infrastructure.

Your next question comes from the line of Matt Hedberg at RBC.

Just one for me. There was -- obviously, we all saw the PHP vulnerability a couple of weeks ago. I'm just sort of curious, I don't think you mentioned in the prepared remarks, but any sort of comment on how something like that or other AI-based vulnerabilities might become a bit more of a tailwind for your business?

Sure. Absolutely. You know what? When I talk to customers every single day, I find myself have to answer those questions. And they really appreciate the efforts and the work we're doing to make sure that we're ahead, the amount of information we provide them, the partnership that we're doing right now with the frontier labs and making sure we're in the front end and working with them so we can basically be prepared.

So we're having those conversations all the time, and it's top of mind. And I'm very excited that some customers actually seek us and ask us what we think and we basically have a very constructive conversations about how we assist them. In this incident, we were prepared. We had the advisory, we had the information.

Our team was in front of it. We informed our customers. We've taken some of the calls and we assist them, sometimes assist them in their internal communication as we're finding that more of the executive and even the Board is asking about the status. And we're adjusting to making sure that our information is not only technical, but can also address the business needs.

Your next question comes from the line of Adam Borg at Stifel.

Maybe while on the changes that we've been making here, how do we think about the progress that you're seeing both in North America and international? Obviously, international is on a much smaller base, but seeing continued growth there with some lower pressure in North America. I assume that has to do with some of the mix. But any color on kind of the drivers of the two and then the opportunities that you see?

Yes. For me, I can't wait to basically see international do what I'm used to and what I love. we're making huge progress in the U.S., and I still think there's a lot of room as we focus in our -- basically our ICP and our core area. So the team is definitely ultra focused to making sure we have the right investment in the right area, and we have the right upside.

We have a decent international business, but there is a lot of upside. And we are starting to basically plan for next year, what is the appropriate investment and what areas where we can basically get some low-hanging fruit, and there is a lot of great conversations happening on that front.

Your next question comes from the line of Gregg Moskowitz at Mizuho.

Great. Rafe, you mentioned earlier that there was some good news with respect to some accounts that were perceived to be at risk this quarter. Anything that you can share anecdotally in terms of what it was that resulted in these accounts deciding to remain in the fold with Rapid7 as opposed to perhaps going elsewhere?

Yes. I think what I would point to is like the team is incredibly focused on making sure we're providing good services to our customers. We have regular calls with the team where we go through all the accounts. And on those calls, you've got Adam and his -- we got Dan and his leaders on the call as well as Alan and his leaders on the call. And we're looking at that several quarters ahead. Like we're just really trying to focus. And that tends to be on the more senior level accounts or the bigger accounts, but that focus of engagement and getting out in front of those accounts if somebody is having some struggles two, three quarters before the renewals up gives us the flexibility to get in and make a difference. And so some of that effort is stuff we started much earlier in the year, but we're still meeting as a team on a regular basis where we're all there to rally around.

And I just think that kind of discipline, but also just that focus on customer first makes a difference. And you don't get them all, but you make a difference to some of those accounts and you're able to satisfy the customer and they appreciate the focus and you can get your renewal.

Your next question comes from the line of Gray Powell at BTIG.

Congratulations on the better-than-expected results. So I think you may have hit on this already, but I just was hoping to get a little bit more color. So I mean, it was good to see detection and response ARR stable at 5% in Q3. It was growing mid-teens a year ago. So I guess my question is, do you think you can get back to that historical growth rate? What needs to happen? And is it more on the product side? Is it execution or something else that maybe we're not thinking about?

It's a great question. And I agree that this segment is growing, and we need to do better to actually earn our fair share as we used to do before. I think the main thing we needed to do and we're already doing is focusing on the ICP where we actually have the highest possibility for. As we move some time maybe in the ultra large, we basically had some headwind and that basically consumes some of our energy. Now as we corrected that and going into the sweet spot where we are designed and we have the right to win, we are seeing a lot of positive basically movement in the right direction. So that's the #1 thing.

As we also start talking to the customers more, as we said, we increased our engagement with our current customers basically about the future, the road map, what we're believing the future looks like, some of the work we're doing and the exciting work in agentic world and the investment we're making, I think that, that definitely helped customers to see that not only we can serve them today and we should have our fair share, but we should be the right partner for them tomorrow as well.

Your next question comes from the line of Joseph Gallo at Jefferies.

This is Grant Darling on for Joe Gallo. And I'll ask them as a two-parter. Maybe to start, there's been a lot of rhetoric from platforms and new entrants around expanding capabilities and exposure management. Are you seeing any change in customer buying behavior or sales cycles as that competitive landscape evolves? And then just to go ahead and follow that up, are you seeing any pricing pressure from privates, particularly impacting margins in MDR?

Very good questions. So in the first part, yes, that was the case in the beginning of the year. And as reality hit we're finding actually ourselves having more of a cooperative conversations with some of the big platforms and basically as customer realizing that what we do is an adjacent, it's not an overlap. And we're seeing that pressure of that as basically more clarity, more engagement with customers, more explaining where we fit and what our value proposition. We believe we have a pretty strong value proposition. And as we engage with the customer, I think that's getting a lot easier.

What was the second part? My apologies.

Yes. Just any pricing pressure coming from private? Just kind of when you think about your margins in India, are you seeing anything there or things pretty steady?

As I said, as our sales team now is focused on the core, and they basically have more of a clear ICP where we have a high level of winning. We have an incredible amount of reference customers over -- as you know, over 10,000 customers. We have a big scale. When we get in there, I don't think customers really are as price sensitive as you were before. They're more looking for a partner that can address today and the future. And they are more interested about what is exactly your AI strategy, how are you going to get there and basically how you can be able to cover me. And what are you thinking about now the Agentic world and some of the risks associated with it. So we'll find ourselves in the last mile talking about that more than talking about price.

Your next question comes from the line of Rudy Kessinger at D.A. Davidson.

This is Ben Smith on for Rudy. I was going to ask on the stand-alone products that you're doing end of sale on, have there been any customers that have expressed interest or purchased packages so they can still use those products? And then I had a follow-up.

Yes. I would first say part of the end of sale thing is they can keep utilizing the products, right? We're not taking anything away from them because we're not end of life now. So customers can renew existing customers, if they need more to expand, that's still a thing. So I think just that subtlety on that end of sale. And keep in mind, a good deal of our customers might have other products with us and also these stand-alone products that we have in the noncore bucket. So that was a long way of saying, yes, customers are still interested in buying us the ones that are on many of these products.

Got it. And then yes, maybe bigger picture, you're not giving 2027 color. But just want to ask, do you feel that core is now stabilized? And what would give you -- what could you point to that's giving you confidence that, that can drive maybe a return to positive ARR growth?

Yes. Look, I think it is nice to see the year-over-year growth rate in the same two years -- or two quarters in a row, if you will, the sign of stabilization. I did call out that we expect it to be roughly flat on a sequential basis. That's clearly not where we want to be, but it's where we are and how we're looking at the numbers. We have confidence though that we can get to return to growth because we're focusing on our core like never before. We've got some really great things in the pipeline for new products that will be in the core new product offerings and expansion. And just the way the product team is digging in to focus on those core offerings.

I think all of that adds up to a time where you feel better about the direction and the strength of the company and its focus, combined with the fact that the world needs our products more than ever because of all the changes in the broader macro. That's what excites us and makes us think that we can -- we're sitting on top of an opportunity that's going to take work and it's going to take time. But we think we can turn that into growth down the road.

At this time, we have reached the end of our question-and-answer session. We thank you all for your questions, and you can now disconnect your lines.

Fatima Boolani, jointly head up the software research team here at Citi. And I'm excited to put a pin on a very successful day 1 of the Citi TMT conference here with Rapid7, I've got the CFO, Rafe Brown joining me this afternoon. Thank you so much for being here.

Thank you for having us.

Excellent. Well, I want to get right into the meat and the heart of the matter here. Just the state of the union on the business. So Rapid7 has been through a series of strategic and execution pivot. So hopefully, hoping you can give us an overview of where the business is, where it stands today, both strategically and financially. And actually, what has changed most meaningfully in the almost 1 year that you've been CFO?

Yes. Thank you. Well, I think the hands-down biggest thing is we recently had a new CEO join us as well as the new Head of Chief Product and Technology. And I think those are the 2 last -- or 2 most recent elements of what's been a pretty big shift in the management structure across the board. I joined in December of last year. Allan Peters has joined. He runs our sales and marketing organizations. He joined in October.

So we have a very new team, but it's across the board. And I think that speaks to the overall changes that we're seeing at Rapid7 that I would say the passion by a number of us of the good things we can do and that we need to work together on. But a significant changes, whether it's on the product, the go-to-market side of the house, just as we're embracing the markets.

I would say one of the, I think, a background kind of core element to stick to my own area for a minute, though, is as I joined the organization, there was a few things we really wanted to take off the table. And that was -- we have a large convertible bond that's going to mature next year. We want to make sure we've addressed that. We now have more than enough cash on hand to do that.

We wanted to make sure we could provide clarity to the parts of our business that we felt was core, our core offerings. We break that out each quarter. So we've really tried to focus on our ability to express the story and make it really clear because as we're going through the transition, we don't want any distractions from the good things we're doing. We want to demonstrate that to our investors.

So you likely had a very long punch list of things that you wanted to address. And it's only 9 months. So we're not quite at the 1-year mark yet. So a lot of action and an action packed 9 months. So in terms of that punch list, if you can help itemize for us. And facets where you are outperforming versus the areas that you feel still have some scope for improvement against kind of your original target list that these are the areas I'd like to focus on?

Well, I think a few of the major priorities that just jumped off the page were one around how we guide the business both internally and externally. That was probably the hands-down biggest thing that I was asked to jump on. And we've really focused on that. The guidance is always somewhat difficult to build out the resource, but we've really -- the team has really rallied around it in terms of our ability to forecast.

And this is internal as well as the guidance we give publicly, really trying to be on top of that. That's been a big focus. I think we've made a lot of very good progress there. And then the clarity of the business, I think one of the things we would hear from investors a lot of times is the story was complex, right? Investors have many, many choices. They need to be able to see where we are, what we're doing and being able to break that out, the core versus non-core business, the breaking out of the details of our -- even within core, D&R versus exposure management. Getting those things unwrapped is really, really key.

And then I think internally, we've really tried to drill into our overall data management side of the house so that we can express clearly to the Board to leaders of both the good and the bad in any given quarter. And so we've, I think, made some really nice enhancements there. All of these things you can keep going for the rest of your life on. Where that leaves us though is that the parts of the journey where finance is really much more of an as a support role. On the product and technology side on the go-to-market side.

We're not on the front lines. Our partners are out doing that and they've been doing some really good work. But we're really digging in, given how new Dan is on the product side, that he's absorbing a lot of data, but he's now getting his feet under him with his organization. He's bringing in new leadership underneath him that's really been very exciting for a lot of us.

And setting that product strategy, we need to partner with him constantly to help. The finance person in me wants to jump right to an ROI. But frankly, the best thing I can do is help making sure he has the data he needs to make good decisions. And then as those products roll out or new changes come through, we'll, of course, monitor how that's going.

Rafe, you alluded to this, and I started my opening comments and a question around this. But the series of executive changes in the C-suite and the appointments alongside you in the last 12 months with Wael stepping into the CEO role, I think he's right about at the 100 days mark right now, and Allan Peters is joining the team as well. Where would you say we are in kind of the tenure and the stabilization of a lot of these changes here?

Because I think from an investor standpoint, there tends to be a fear or concern that there are second order changes coming down the pipe. So the masthead has changed. So we know that but sort of the second, third tier sort of management and organizational changes, where are we in the cycle of kind of flushing that out?

Yes. I would say where I think we're furthest along would be in Allan Peters organization. Allan, again, joined in October, he hustled to make some of the changes within his organization to get those in place by sales kickoff, right, to get the team started. And I think he did a great job of it, and we've seen some nice increases in rep productivity developed over the first couple of quarters of the year, right? That's a great sign that not only getting the team in, but having measurable definitive success. That's been very, very exciting to us.

With Wael joining, it's 100 days since he joined, but Wael was on the Board prior to this. So I think that helps us to a great degree, but it is a big change. Fortunately, Corey, our prior CEO, is Executive Chair now. So he's still available to us, but it's very much Wael leading the organization on a day-to-day basis. Wael is very structured in how he approaches the new job, he's run a number of off-sites or as he calls them camps.

So we just had the third one where we start with the -- get alignment of the of him and his direct reports. We expand that out then we expanded it out again. It's early stages at 100 days, but you see this were a big shift in the language we're speaking and the goals we're setting and some of the product development aspirations we have, we're rolling those out across the organization. And I think that's really helping us, if you will, to be on the same page. And hopefully, that helps us accelerate as we go through this change to start seeing the upside.

And just as a related matter, this notion of sharper goals, higher resolution focus on key areas. You have taken some actions on the workforce realignment and recalibration side. Again, where are we on that journey of stabilization as well, right? If you can kind of remind us about some numbers around that and how that looks?

Yes. So we announced on our last earnings call that we have about 12% of our employees were impacted by restructuring. Now prior to that, we had slammed the brakes on hiring. We had a pretty deep hiring freeze going on. So there was a significant number of other heads that would have otherwise been in the budget that were limited or were eliminated. Having that done and behind us is, I think, extremely helpful.

One of the things that goes with that though is like some of those dollars need to be reinvested back into the business, in particular on the product and engineering side. And so we will see that play out in the coming quarters. But I think that -- the one thing the restructure -- one of the many things that did for us is that it certainly assured our cash flow position, make sure we could -- we have a couple of bonds I mentioned making sure we're in a great position to take those over off the table.

I think the part of the story that is still in development, it would be fair to everyone is on that product and engineering side as Dan digs in to his organization and the product challenges and his meeting with customers, that vision can't help but be rounded out over the next few quarters.

I'll absolutely come back to this conversation as we kind of talk about the profitability and kind of the margin trajectory in the here and now and over the next 12 months. But kind of going back to essentially, a lot of the work, the hard work that's gone into portfolio reconstruction reconstitution in the last 12 months. There's been a lot of change there as well.

Can you maybe step us through some of the most consequential changes that you've undertaken in portfolio reallocation and resegmenting both from an offensive strategy, but also from a defensive strategy. And then any contours you can give us on the size of these businesses, right? I think you talked about the D&R business, the exposure management business and under command and control. So I would love to have you put the finer points on that. But just more broadly, what have been the most consequential changes in that reconstitution of the portfolio?

Sure. And just for everyone here, in the way we've communicated the business, we started really breaking out the business between our core offerings and our non-core offerings. That happens to be -- to a very great extent, how we're going to market. It's not just in the way we talk about it to investors.

So what we did is we said our core offerings are going to be our D&R business and our exposure management business. Together, they're just over 80% of the business. The remainder, the non-core side of it, if you will, is actually a number of businesses that are rather stand-alone solutions that have been important to us in many ways that -- but when we still look at the future, where do the investment dollars need to go into that core solutions, where we're going to put our go-to-market resource into those core solutions.

We have to win with those products and solutions. If you look at within that, we've got the D&R business, it's growing at over 5% or it's growing approximately 5%, and it's just over 55% of our overall business. So that's really the biggest piece of the business and growing quite healthily. We think there's tremendous opportunity for us to accelerate the growth in that side of the business.

We also think as we look at with the AI agents coming in, really impacting and finding so many vulnerabilities, it just underscores how important that core business is for us and how the 2 can work together and need to work together better over time as we look to unify the data streams better on the platform as we look to overly them with AI agents to help us be much quicker in the way we either help our customers directly, especially if you think on the exposure management side or how we run our SOCs on the MDR side of the house. So everything about our business, whether it's product, whether it's go to market, whether it's the way we're talking about it externally, is that segmentation around our core business. That's really key.

For the non-core side of the house, that it's a little tricky because there's a number of our customers that have core products, especially some of the older core products that they haven't yet upgraded as much as we want them to. But they also have some non-core solutions. And so managing our way through that to help our customers along that journey is going to be very, very important to us. Some of that's going to rest in products. Some of it is going to be the way we aggressively go about trying to upgrade and move the customers along.

And just on the non-core side, I think the delineation is about 80-20, right?

Roughly speaking.

Roughly speaking. So how can investors get comfortable or what sort of road map can you give to investors that the 20% of the business has attained maybe the trough levels of performance right? What's that line of sight because ultimately, yes, it's only 20% of the business, but it's also 20% of the business, creating a significant drag on your total performance. So any visibility that you can share on when we should expect this to asymptote?

Yes. So this is a question we wrestle with a great deal. It is going to take some time, some quarters for that to work through the system to be sure. What we are very much actively engaged on is trying to make sure we have a for our customers, putting our customers first as we go through these changes is going to be key. And I think from the investor perspective, the headache here is, of course, that you have this large piece of the business, which is not being productive, it's offsetting the growth of the rest of it.

But at least we can break that out so our investors can see where we are in that journey because it is going to take time in every 1 of the scenarios we draw. That said, well, if we can continue to sharpen our focus on core, reaccelerate that core, I think that's going to be what leads us out of it, and that's what's going to be ultimately the part that is driving overall business growth in the coming years.

So just shifting to the core side of the portfolio on the Command Platform and some of the cross-sell dynamics there, what's that Command Platform strategy you have in place today? How is this approach helping you push the value proposition of the platform versus just the bits and bobs of the individual product uptake?

Absolutely. So key to our business is this understanding that there -- there's great collapse that's happening between the moments that in traditional times an exposure would be found. It would be cataloged. You would have time to prioritize it, to fix it to get that in your system.

And then perhaps it was -- there was -- you would an exploitation that's something you would detect. All of that is collapsing more and more. So what we're very much trying to do is upgrade customers to much more of a unified platform. It's still -- there's very distinct functionality that are happening within that. But I think the Command Platform is the first part of this journey that's going to enable us to bring those -- that functionality together, bring those data sets together and to build the automation and hopefully had eventually autonomous SOCs that help really drive a better business performance or better customer experience over time.

But it's because the attack path, it may be the same path, but it has shortened rather drastically. And there's a great fear in the world that it's going to continue to shorten. So bringing that functionalities that does much more than 2 separate businesses and the process of managing exposures into a real-time effort where you're very much on top of them. Things are happening much quicker and that you have the insight of what the exposure management side of the house is doing, should there be an attack detected on the D&R side of the house.

Rafe, can you characterize for us what the internal barriers to adoption are to the fulsome Command Platform versus the external barriers. So are there some technological limitations or capabilities that you're very close to solving and that will create the big unlock -- or is it more awareness, education.

And then as a related matter, how has the exposure management opportunity generally changed for you coming out and from beyond your classic vulnerability management routes where I think the customer perception of that specific capability has changed and evolved pretty dramatically?

Yes. Well, I think on the technological side, one of the first things that I would point to is we did an acquisition of a company called Kenzo. It was very small. We did it earlier this year. But it was extremely focused on the technology and the technologists that came with that. But it speaks to bringing in that technology onto our platform that allows us to much more rapidly ingest a broader array of alerts from different infrastructure sets out there.

So being able to much more quickly be able to bring more data into our platform and adjust into that platform, super important. But then that's setting us up for the next leg of the journey to being able to rationalize that and make sense of that data. So this is one of those problems that all SOCs are facing, but the better you can -- the more data you can see coming into your system, the more alerts you can get, the better it can be, but it's also that much more data and alerts to have to work through.

So that is the technology unlock that. It really is underway, but it's going to be a journey for, I think, everyone in our industry about how do we very quickly bring all that data in, quickly get our arms around it and help separate out what are alerts for a myriad of reasons that are fairly innocuous versus those that are real threats to your organization.

So that's a tremendous amount of work that has to go on. Kenzo was a first big move in that direction, but it's part of this much longer journey and then that will -- ultimately manifest itself into a lot of platform work as we bring all of this together, that's really key. Along with that, I think is that the external elements you talked about is helping customers understand the threats and understanding what they're facing, whether they like it or not, right? Make sure we're super clear on that.

And for us, one of the benefits is because of the AI impacts on cyber have been so well pronounced. These conversations are now much higher. There's not a board out there who -- there are probably just 1 or 2. But generally speaking, there's not a board out there, where they're not asking about what's your cyber strategy. And I'm hearing about all these exploits or I'm hearing about all these vulnerabilities that are being found what are you doing about it? That shines a bright light on just how important the work we're doing is and the opportunity for us to get out in front of that.

So you've historically had pretty sizable market share in, again, the classically defined vulnerability management market. So as the definitional expanse of vulnerability management has changed, i.e., the definition is expanded, it's exposure management, it's more encompassing to capture more attack surfaces and search attack surface area.

How do you feel that the exposure management addressable market opportunity compares to the classic vulnerability management opportunity. And is the opportunity for you to capture more estate, so more volume of share in a customer's organization? Or do you believe that the lever is higher pricing, more pricing leverage or more premium pricing?

So within exposure management, the first -- the most obvious glaring thing for us to do is to -- is to capture more of that share, right? Our exposure management business is an opportunity for us to not need to do extraordinary things, but we need to get that business, coming along get it back up to where the market is growing, right? We've fallen behind that. We have a lot of work to do on that place.

People are familiar with the story, we'll know that the exposure management business is offsetting some of the growth of the D&R in recent quarters. We're very frustrated by that, extremely focused on it. But the path is very clear on the work we need to do that we think closes that gap gets that business growing and is a big contributor. And I think that's where we really have to focus on. We're just making getting more customers, bringing them on to the platform. That allows the engagement, they're earning their respect, their trust and showing them the rest of the work we can do for them.

So Rafe, a little bit of an elephant in the room question as it relates to what some of the frontier labs are talking about by way of their advancements and their core technologies and their large language models. So very deliberate focus on shoring up the health of the exposure management SKU and franchise for you. But at the same time, the realities of the ground have changed as it relates to some of these large language models are very, very capable at very high speeds finding some of this, right?

So how do you jostle with that dynamic, which is clearly different and has evolved in the last 6 months and maybe wasn't necessarily an issue last year.

Yes, absolutely. So I think, first of all, we have to really like all security -- or all security companies have security teams to go out and find vulnerabilities. And when we find a zero-day bug, like it's a great source of pride, it comes from great professionals, digging in it and -- but that's not what's driving our business on a day-to-day basis. And these advancements you're speaking of makes that very, very clear that by and large, finding new vulnerabilities is a business that's commoditized in part of the past.

The trouble is that they're very good at this and so there is a tremendous volume of vulnerabilities that become known and teams are drowning our customers or potential customers drowning in just the sheer number of vulnerabilities that are out there. And the pressure is super high. Like these are known vulnerabilities. What are you doing about it? And they have to report to it quarterly to their boards and their audit committee meeting.

And so all of the sudden, you have to acknowledge that from a moneymaking perspective, the finding vulnerabilities is commoditized, but the dealing with them to be able to rationalize and prioritize it, manage the upgrades of them has never ever been more important. And I think that's where -- that's where we really make a big difference with our exposure management solution.

And then frankly, the other part of it, and I'm sure there's plenty of examples where this has happened, but we feel like it can get worse is that the bad actors are also being able to get these more vulnerabilities and use them against companies. And that's where it's going to be just the pressure to deal with the exposures, but also to monitor and detect attacks just is off the charts, and it caused a lot of stress in the industry.

So on the one hand, parts of the way we thought of the business 5, 10 years ago are completely different and even gone, if you will, the remainder of the business, the battle that has to be fought has never been more important, and I think that's going to drive a lot of value to the industry.

So it sounds like the volume -- the voluminous amounts of CVEs that are kind of coming out as aided or facilitated by these labs. Actually, in theory, can provide a very lucrative bridge for you -- for your D&R business, right? It's a getting at -- so when we think about the broader opportunity in the security operations center, there's a lot of movement and interesting sort of renaissance from a spending standpoint there.

As enterprises generally speaking, rethink their security operations center stack, their architecture, their vendor strategy. Where does Rapid7 fit into that equation? And why do you feel that you will have a right to win in taking more than your fair share of some of those very juicy budgets?

Yes, absolutely. Well, I think if you think about our ideal customer profile out there, right, Rapid7 has always had a strong presence in the commercial market, kind of that midsized business, where they're big enough to have serious security needs, but they probably don't have the budgets.

And you also see where our data analysis makes it very clear that even in much larger organizations, for the right kind of organizations, those that are really, frankly, quite lean on the security side, we are a perfect fit. And so you look at that and say, that problem exists today, and it's only getting profoundly worse. They have to rely on other vendors. And we're in this unique position with a ton of knowledge built into our organization and teams built in it.

And we, right now, bring great product combined with human services and we're investing like crazy on the product side of that. I think that's going to be this big differentiator that a lot of companies, if you will, that outsourced SOCs, do it just person for person. They just throw bodies at that we're already well past that, but the work we're doing right now only further enables us to ingest more, to see more, to make sense of more data.

But plus part of our proposition on the D&R side is when you are under attack, you're going to want to talk to a human who's going to have the experience and the maturity to help you manage through that. So it's -- as the CFO, we hardcore trained to not want humans involved in things. But this is an area when things are really going south on that side of it. You need some element.

The key for us, though is to be able to meet the scale and the demands without having to throw bodies at it over time, throw technology at the scale, sort that down, identify the real attacks and then have that differentiated service. And that is something that our customers are extremely thankful for to get through very difficult times, but also to know that day in, day out, we're helping monitor their systems better than anyone else can.

Rafe, you've pre-answered a little bit of my next question. But when we think about the managed detection and response sub-header to the D&R business. What is the interplay and overlap with the overall SOC opportunity? And generally, how has your view evolved there?

I think you were talking about, hey, there's maybe some labor efficiency that you can add to kind of your value proposition. So how does AI enhance your revenue and operating leverage opportunities in this area and then bubbling that back up to the D&R at large?

Yes, absolutely. And within our D&R, our D&R, the vast majority of that is managed detection response as a business and how we really differentiate our value. I mean I think, first of all, as we continue to enhance our platforms and unite our platform and our data sets, it's going to provide a better service to our customers, right, being able to see so many more alerts and find those correlations, 1 attack might trigger a number of alerts, but they're on different pieces of equipment, different systems, very hard to rationalize for a human to do it other than going screen to screen to screen and being, frankly, just unlucky.

We can bring more of that together and our goal is to keep adding to our capabilities there. So you have to start with, we think working with us, you can get a service that you can't get by yourself, certainly running your own stock by using other tools. And that's tremendously difficult. I think the thing that we're looking at for ourselves, and even in the Kenzo acquisition, this was part of the formulation when we looked at it, because we are -- we are our biggest customer in terms of running SOCs is that we can bring tremendous value, while enhancing the overall offering, right, making sure that we can scale the number of alerts that come in to us, they scale the company without having to continue to do that person by person on the cost side of it.

So it's, I would say, first and foremost, you have to differentiate and do something that just can't be done with other companies. But then I think we can continue to do that. We talk about wanting to make sure we're providing this managed detection response with software-like margins. And I think that's a real key calling for us as we look forward to the coming years, being able to deliver that extra value to our customers, but also to our shareholders in an efficient way that's driven by automation, but still has that differentiated service.

Rafe, I wanted to talk about the path to growth reacceleration and acceleration for ARR. I know we have a lot of different conversations in different pockets, right? So maybe just to distillate in terms of the order of operations of things that need to fall into place and go right so that ARR trends start to rehabilitate, right? So how would you kind of stack rank the things that need to again fall into line for ARR to start coming up the curve?

Yes. Well, I think the vast majority of these are going to be on the product side. So on the MDR, the investments we're making those, the acceleration of our agentic work that we're doing on that. I think is going to make that solution much more competitive, more advantageous, driving growth in MDR that would be the very first step.

The exposure management, really drilling in on this, on the current customer base, the enhancements we need to make sure everybody gets upgraded to the latest versions of the technology and then continuing that platform expansion that brings that. And if we stopped right there, focus on MDR, focus on exposure management on the product side, I think that gets us there in the overall story, but that is the biggest driver.

We do have these non-core offerings. And it's a little more nuance there because there are several different solutions. But the biggest thing is making sure that platform is so strong, has enough of those features that we can migrate those customers over to it and make sure they're happy. And I think that's going to help the story. Some of the non-core offerings, getting through the decline quicker is probably the best thing that possibly can happen to us. We just want to do it in the way that's best for our customers.

And just as a related matter because it's a good segue into the next question I wanted to ask you about managing a very disciplined cost envelope as you kind of navigate some of these dynamics. You've still been able to produce operating efficiency in the business, right, driven a lot of rigor in terms of managing the cost.

So I don't think 20% operating margins have been out of the realm of possibility, right? So can you help us appreciate how much more scope is there to essentially run the non-core portfolio at a much more efficient level from here? And is that going to be the preponderance of the input to ongoing operating leverage because the core business is going to get all the love in terms of investment, right? So just in terms of the factors of influence on your ability to continue to drive operating leverage at or above 20%?

Sure. And with the restructuring we just did, we did talk about -- we've been talking all year long about improving margins as we exit 2026. So with this restructuring behind us, we were able to call it on the last call that we think we can exit the year with margins in that range. And I think that's a big first step.

A good deal of the cost rationalization was able to come out of the non-core. And I think that's very, very clear that to the extent we have some of these non-core offerings, we have to make sure they're contributing to the investment that's going on in the core. So I think there's big opportunity that's already underway. I think there's ongoing opportunity as we move forward. What will help us as an organization is having that crystal focus of where should each new dollar be invested.

And frankly, to go through the budget cycles, where should every dollar be invested in terms of making the strongest solution for our customers and then taking that to market. When we started the year, it was before we'd really broke out this core versus non-core, but already intuitively, the company was gravitated towards that direction, putting better sales incentives around selling core.

Well, that's only going to get sharper and sharper as we move forward. And so I think that is what's going to ultimately help us get the most bang for our buck when we're putting in dollars, whether it's on the product side, whether it's on the go-to-market side and getting results and returning them to the business.

Rafe, my last question for you is managing the business and setting expectations as Rapid7 moves through a period of tremendous change. You talked about data management, data quality, stronger signals being filtered into your guidance. How should investors sort of think about the quality of the inputs kind of going into the pie that you're making for all of us as it relates to guidance setting expectations. And then related to that, what are 3 things that give you a lot of confidence that you are going to see over the next 12 months, this real rehabilitation in kind of the trajectory of the business.

Yes. Well, I think in terms of the inputs, a lot of it is -- I mean, at the end of the day, it comes down to good teams working very hard together. I think One of the things that we've done is between Allan's organization and my team working together, we review forecast every Friday, we go over that.

And we work very hard to dig into those elements of it and really understand the nuances of the deals that we're looking at of the customer renewals that are coming up, it's -- to some great extent, it's spending a lot of time together. And frankly, creating competitive modeling within the team.

So you're talking about why there are differences and really wrestling. So if nothing else out of the debate, you understand where your risk items are. And doing that across the organization on financial data, I think, is tremendously important. We also have brought in some new leadership. We've moved people around within the finance organization to crispen up how we forecast the business, how we bring it together to our teams.

And then I very much try very hard to lean in with my business partners to bring them into the discussions, even when the discussions are tough quite early. We've met repeatedly with Dan and Allan about what next year's plan is shaping up. It's extremely preliminary. But to do next year's plan, we have to have a very clear view of where the products are, when the releases are happening, with how Allan and his team are looking at it.

All of that feeds into being able to give much better data. And then ultimately, my confidence for the future very much rests in the individuals we work with. We're blessed by strong leaders, who have very strong opinions and so we get to exercise those freely. But you get guys like Dan and Allan in the room, you get the teams together. That's what makes you feel like we can do this. We -- the path is so clear how to make things better. And as we make them better, we'll continue to help make them great.

I appreciate that, Rafe. Thank you so much.

My pleasure. Thank you.

Nice conversation.

Good day, everyone. My name is Kahalmani, and I'll be your conference operator today. At this time, I would like to welcome you to the Q2 2026 Rapid7 Earnings Call. [Operator Instructions]

At this time, I would like to turn the call over to Matt Wells, Vice President of Investor Relations.

Thank you, operator, and good afternoon, everyone. Today, we will be discussing Rapid7's second quarter fiscal 2026 financial results. We've distributed our earnings press release over the wire, and it can be accessed on our Investor Relations website. With me on the call are Corey Thomas, Executive Chairman; Wael Mohamed, CEO; and Rafe Brown, CFO. As a reminder, all participants are in listen-only mode and a question-and-answer session will follow our opening remarks.

Before I hand the call over to Corey, I want to remind everyone that certain statements made during this conference call may be considered forward-looking statements under federal securities laws. These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include, among other things, our outlook for the third quarter and full year 2026, our expectations regarding fiscal periods beyond 2026, our transformation and restructuring initiatives, our strategy, priorities and capital allocation, anticipated operational improvements, investments in our core platform and AI capabilities and our expected growth drivers and financial performance. These forward-looking statements are based on our current expectations and beliefs and information currently available to us. While we believe any forward-looking statements we make are reasonable, actual results could differ materially due to a number of risks and uncertainties, including those contained in our filings with the SEC. Reported results should not be considered indicative of future performance. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events or otherwise, except to the extent required by applicable law. Further information on these forward-looking statements and risk factors are included in the filings we make with the SEC, including the section titled Cautionary Language Concerning Forward-Looking Statements in our earnings press release. Additionally, over the course of this call, we'll reference non-GAAP measures to describe our performance. Please review our earnings press release and filings with the SEC for our rationale behind the use of non-GAAP measures and for a full reconciliation of these GAAP to non-GAAP metrics. These documents, in addition to a replay of this call will be available on the Rapid7 Investor Relations website.

And with that, I'd like to turn the call over to Corey.

Welcome to Rapid7's Q2 2026 Earnings Call. I join you today in a new role, but with the same passion and purpose to ensure that organizations of all sizes can get the best results from their security operations. I have worked with the Board and especially with Wael over the last year to revitalize our team, improve our execution and fully leverage the opportunity that AI is providing.

As part of that work, it was clear that we have significant opportunities, but only if we tighten our focus on our core offerings, sharpen our alignment and execution around those offerings and deliver a more efficient model. The Board and I recruited Wael, whom I have known and respected for many years to do exactly that, deliver on Rapid7's full potential in the midst of one of the most exciting moments in technology. In many ways, Wael is accelerating a plan he helped developed. In other areas, he's providing sharper focus and leadership as you will hear in his upcoming comments. Before I hand it over to Wael, I want to take a moment to acknowledge the incredible work of our colleagues at Rapid7, whose passion and care for our customers and their deep and energetic embrace of innovation continue to inspire me.

With that, I turn the call over to Wael. Wael?

Thank you, Corey, and good afternoon. Since this is my first earnings call as CEO of Rapid7, I want to use my time a little differently. Rafe will take you through the quarter, the actions we announced and our guidance.

I want to focus on our strategy, the operating discipline behind it and how I ask you to measure our progress. I have known Rapid7 for years. Long before I joined the Board, I saw this company at its best, moving fast, earning customer trust and winning in the heart of the market. Joining the Board gave me a much closer view of the company, its people and its potential. The closer I got, the more I liked what I found. Rapid7 is a good company ready to be great. It is not broken. It has reached a ceiling. The issue is not our assets. It is how we focus our resources and energy. Breaking through requires clear choices, strong execution and an operating system that can repeat success at scale. That is the work I signed up for.

Transformation is not about changing everything. it is about having the discipline to change the few things that matter most and doing so consistently over time. Over the past year, we put the leadership team in place for this next chapter. We added a proven Chief Financial Officer to strengthen operating discipline, a Chief Commercial Officer to help us scale and win with customers and the Chief Product and Technology Officer to build an AI-first platform. We now have our leadership team, operating model and capital allocation aligned behind one direction.

Since stepping into this role, I have spent my time listening to customers, our people, partners and many of you. Three things are clear. First, focus matters. We do not need to win everywhere. We need to be exceptional where we can win. Our clearest right to win is in the heart of the enterprise market. Customers that need enterprise-grade security, but also need fewer tools, less complexity and faster outcomes. Our leadership in the mid-market is proof of our strength. It is not a limit on our technology or our market. We will continue to compete for larger enterprises where our platform is the right fit. These customers want fewer, better partners, not more tools. That is where Rapid7 has earned the right to win.

Second, outcomes matter more than products. For years, Cybersecurity answered complexity with more complexity, more tools, more alerts, more consoles, more people. Customers do not need another dashboard. They need less risk, less complexity and faster action. Our opportunity is to connect exposure management with detection and response to move from finding problems to resolving them. For many customers, that outcome will be delivered as a service. Skilled security people are hard to find. They need a trusted partner that can bring the platform, the expertise and the work together.

Third, the way security work gets done is changing. AI should not become another label. It should change the work. Automation helps us move faster today. Agents let us do more across more data, more and at much greater scale. Attackers are moving at machine speed. Attackers only need to find the scene between an exposure and the fix, an alert and the work needed to investigate it or a decision and an action. Defenders need the same reach and speed with people remaining in control. People decide, agents do. In this model, agents are not just features inside a product. They become part of the service layer, extending the reach of our security experts and helping us deliver outcomes faster and at scale.

We acquired Kenzo because AI needs a foundation, not another feature. That foundation connects data, agents and human decisions across the tools customers already use while keeping customers in control of their data. We want AI to fit into our customers' environments, not force them into ours. Building that future requires focus now. The changes we announced affect colleagues who have contributed to Rapid7. I want to thank them for what they have given to this company and to our customers.

These actions are a focused reset. We are not shrinking our way to the future. We are reshaping the company so we can invest more behind the parts of the business that will define it. We are simplifying the company, aligning our cost structure with the core and creating room to invest. We are concentrating our growth investment behind detection and response, exposure management and the AI foundation that connects them. We will continue to support customers using our other products. This is not simply a cost action. We will reinvest a meaningful portion of the savings in our core platform, the people building it and the AI foundation behind the next generation of our products. 70 days is not enough to complete a transformation. It is enough to set direction and show how we will operate with speed, clarity and accountability.

Operating discipline creates choices. As Rafe will explain, the actions we announced put us on a path to exit the year at approximately 20% non-GAAP operating margin. That is not the destination. It is evidence that we are building a healthier company, one with more capacity to invest, innovate and generate durable returns over time.

In the second quarter, we came in slightly above the guidance we provided. Detection and Response continued to perform well. At the same time, total ARR declined. Exposure management is not yet where it needs to be and other parts of the portfolio continued to pressure our results. The current direction of ARR is not good enough. We are acting on it. This is a multi-quarter transformation. We are changing the path of the company toward durable growth, not managing for one quarter. As we sharpen our focus, some parts of the business may face pressure before the benefits become visible. At times, we may need to simplify before we can accelerate.

Let me leave you with the framework I ask you to use when measuring Rapid7 over the coming quarters. First, look at the cash generated. Cash is not the finish line. Durable growth is. But cash tells you whether the operating model is becoming healthier and whether we have the capacity to keep investing. Second, measure this transformation over several quarters, not one, look for stronger execution in the core, better outcomes for customers and meaningful improvement in exposure management. Third, watch how we reinvest. We are putting resources behind the platform, the people and the AI foundation required to return Rapid7 to durable growth. We have hard work ahead, but we also have what matters most, strong customer trust, deep security expertise, a clear place to win and a team that cares deeply about our mission.

I have believed in Rapid7 for years. The more time I have spent with its people, its customers and its technology, the stronger that belief has become. We know this transformation will take time. We will not ask you to judge us by promises. Judge us by execution. Judge us by whether quarter after quarter, this company becomes more focused, more disciplined and more capable of delivering durable growth. That is how we intend to earn your confidence.

Rafe, over to you.

Thank you, Wael, and good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers, except revenue and balance sheet items mentioned during my remarks today are non-GAAP. Please refer to our earnings release and SEC filings for additional details regarding the presentation of our results and guidance metrics. In the second quarter of 2026, I'm pleased to report that we exceeded expectations across all guided metrics. We ended the second quarter with total ARR of $824 million. We reported non-GAAP operating income of $28.9 million. Free cash flow came in strong at $31.9 million with collections healthily exceeding our internal expectations. As of the end of the quarter, we had total cash, cash equivalents and short-term investments of $702.6 million.

I want to begin by taking a closer look at our ARR as of the end of the quarter. As a quick reminder, our long-term strategy is focused on our core platform solutions comprised of our detection and response business, which includes MDR and our exposure management business. Our core platform solutions represent over 80% of overall ARR and grew approximately 1% on a year-over-year basis, led by our detection and response business, which at approximately 55% of total ARR grew approximately 5% on a year-over-year basis. While our overall exposure management business offset some of the growth of our D&R business within the exposure management segment of our core offerings, we continue to see healthy adoption of our Exposure Command solution driven by both new customers and customers upgrading from our older vulnerability management solutions.

In contrast, our noncore products, which, as a reminder, are less than 20% of total ARR declined in the quarter, driving the sequential decline we saw in total ARR as we focus our resources toward growing our core products. As we plan for the remainder of 2026 and beyond, we see opportunities to optimize margins for these stand-alone noncore solutions as well as opportunities to migrate customers to core platform offerings.

As Wael mentioned, our organization is undergoing a significant transformation. Our new Chief Product and Technology Officer, Dan Deklich, just two months into his role, is making changes and investments across the product and engineering organization. We expect these investments to strengthen our core platform solutions, accelerate innovation and deliver meaningful product capabilities throughout 2027. We expect, however, that these efforts will take time to translate into ARR growth.

Returning now to our financial statements. Total revenue of $210.9 million declined approximately 1.5% year-over-year, reflecting the declines in noncore product ARR we saw earlier this year. We finished the quarter with over 11,500 customers and an average ARR per customer of approximately $70,000. Turning to second quarter profitability. Total non-GAAP gross margins of 71.7% were down approximately 215 basis points year-over-year, consistent with our expectations, driven by year-over-year increases in staffing of our global security operations centers and increased cloud usage for product improvements. We reported non-GAAP operating income of $28.9 million or a margin of 13.7%, favorable to our guidance. This upside to profitability drove non-GAAP earnings per share of $0.44 per diluted share. Free cash flow totaled $31.9 million in the second quarter, driven by strong collections. And from a balance sheet perspective, we ended the second quarter with $702.6 million in cash, cash equivalents and short-term investments. Combined with our continued free cash flow generation and a $200 million undrawn credit facility, we are well positioned to repay our $600 million convertible notes due in March of 2027.

Turning to the restructuring announced earlier today. This restructuring marks a strategic shift in our business operations to drive efficiency and focus across the organization, aligning resources and investments to our core platform solutions. We are also creating capacity to increase our investments in cutting-edge AI-driven solutions that will improve customer experience and increase competitiveness in the marketplace. In terms of approach, we first eliminated non-headcount spend wherever possible. Unfortunately, approximately 12% of our workforce has been notified that their roles are impacted by the restructuring.

From a financial perspective, as a result of the efficiency gains already underway as well as the impact of the restructuring announced today, we expect to deliver 20% non-GAAP operating margins in Q4 of 2026 compared to 13.7% in the second quarter, fulfilling our commitment to improve our cost run rate as we exit 2026. We expect to incur restructuring charges of approximately $10 million to $11 million, the majority of which will be paid throughout the third and fourth quarters of 2026. These restructuring charges will be excluded from our non-GAAP P&L results. The cash expenditures will, however, be reflected in our operating and free cash flow results. As such, for the remainder of the year, the cash benefit of reduced head count will largely be offset by the associated severance-related costs as well as targeted reinvestments into our product and engineering organization. Therefore, while weighted toward the fourth quarter, we are maintaining our expectation of approximately $130 million in free cash flow for the full year 2026.

We believe this restructuring will allow us to improve free cash flow in 2027 over our 2026 guide despite a lower ARR base as we enter 2027, investments we are making to modernize our products and SDLC process and the reduction of our interest income that will occur once we use our invested cash to repay our March 2027 convertible bonds.

This brings us to third quarter 2026 guidance. We expect to end the third quarter with ARR of approximately $812 million. And on a sequential basis, we expect ending ARR for our combined core platform solutions of D&R and Exposure Management will be approximately flat quarter-on-quarter with the expected sequential ARR decline coming from our noncore offerings. For the third quarter, we expect total revenue in the range of $208 million to $210 million or down approximately 4% at the midpoint on a year-over-year basis. Non-GAAP operating income is expected to be in the range of $34 million to $36 million or a margin of 16.7% at the midpoint. Non-GAAP earnings per diluted share are expected to be in the range of $0.44 to $0.47 on approximately 80 million fully diluted shares. Updating our full year fiscal 2026 guidance, we expect total revenue in the range of $837 million to $841 million, a year-on-year decline of approximately 2% at the midpoint. We are raising non-GAAP operating income guidance for 2026 to a range of $129 million to $133 million or a full year non-GAAP operating margin of 15.6% at the midpoint. As I mentioned earlier, this implies a 20% non-GAAP operating margin in the fourth quarter. Non-GAAP earnings per share are expected to be in the range of $1.78 to $1.83 per share on approximately 79 million fully diluted shares. We expect free cash flow of approximately $130 million for the full year, in line with prior year performance and a free cash flow margin of approximately 15.5%.

In conclusion, our solid execution in the second quarter, combined with our focus and prioritization efforts to improve our core product offerings as well as our commitment to manage costs and expand operating margins positions Rapid7 well for the transformation ahead.

And with that, I'd like to turn the call over to the operator for Q&A.

[Operator Instructions] Our first question comes from Rob Owens with Piper Sandler.

As you look across the product set and in particular, your exposure management platform, and I know you said that things will get better from here and you're looking at adding to the portfolio or adding to the capability. When you focus on that, is this a function of coverage? Or is it lacking functionality that your customers are looking for? Just trying to understand directionally where you hope to take this technology.

And I'll just ask the follow-up right away. In terms of customers that haven't moved to your more comprehensive capability, especially given the threat environment that we're in right now, what is your sense as to what customers are doing here?

Thanks, Rob. Very good question. First of all, it's nice to actually be here, and I look forward to work with all of you. It's been a little bit over two months. When I was on the Board, and as you know, I actually started a year ago -- over a year ago with Corey on the Board, and I looked at the overall business, it was very clear that there was part core and noncore. And as I actually got on the seat, it was very clear to me that most of the decline happened in the noncore. Nonetheless, there's a lot of work we needed to do on the core side. So the restructure that actually Rafe talked about was to shift some of our focus to the core and making sure that we have our weight on it because we have really a good position. We have a lot of customers that use us. We have the right to win. And most importantly, we are invited every single day. I sat on a lot of customer calls in the last two months, and I can see that we're actually in a better position.

But to answer your question on the exposure management, there is definitely some work to do on focus. We were spread very thin, try to be able to address all our portfolio. And now we are basically shifting our focus on the core side and making sure that we are actually also making some investments so we can get our fair share in that market. We are invited, which is good. We're shortlisted because we are one of the leaders Nonetheless, we can increase our win rate by having more focus and obviously, having the right investment. And I'm very excited about the addition of Dan since Dan is actually -- is working very hard to making sure that not only new features, but the AI-first methodology is implemented in all our product line. The second question was...

The migration.

What are customers doing in this environment? Yes.

When I talk to customers, they actually -- they talk about how can you not only find things but actually fix it. And I'm very excited that we play in these two subcategories, the exposure management as well as the detection and response. And I do believe the AI first basically structure will allow us to be able to provide that for customers. But customers are actually buying every single day. They are not waiting and wait and see. That's what I thought when I came in. It will be a wait and see. They're waiting for the AI. They're actually -- they just want to make sure that the right vendors are moving in the right direction, and they are looking for solution that not only help them to identify what's going on, but also fix it and take them through that journey.

Your next question comes from the line of Jonathan Ho with William Blair.

Just wanted to understand, first of all, Wael, I really appreciate the detail that you're providing. Can you help us understand the opportunities to reaccelerate growth? Like where do you specifically see sort of these ability to focus paying off? And it's always been challenging to show operating leverage while trying to reaccelerate growth at the same time. Can you help us understand sort of the balance between these two?

Thank you, Jonathan. And it's a very good question, and I always ask myself when I basically -- before I started, the most question I ask myself, are we in a category that it's big enough and is growing fast enough to be able to get us the growth we're looking for. And you cannot buy that. And we are very fortunate that we are in two big categories. And even in the vulnerability management and basically the migration into exposure, it almost like feel like it has a refuel of interest again. So there's two categories that we have very strong position. We are definitely a leader. We have the right to win, and we're invited to participate, and that's itself extremely important.

How can we basically find growth? The way I look at it is a sequence. This is not going to be a one quarter turnaround. It's going to be multiple quarters. And the way I think about it, first, the cash generated, it will be able to demonstrate how well and how precise we're running the business. Number two, we need the noncore to clear, and we already basically understand what that is, and we're making all the right structure to allow us to do that. And number three, we need to stabilize the core itself.

Within the core, there's a lot of great assets, a good position, but there's some more work we needed to do. And that's why we are refunneling part of the investment and put it behind that. And fourth, we will get back again to growth. So I believe the category we're in will allow us to do so. The work we're doing will allow us to get there faster.

Excellent. And just in terms of the strong margins that you guided to in the fourth quarter, I just want to better understand, I mean, is this a starting point then for 2027? Or can you maybe help shape what the endpoint looks like in terms of what you want to ultimately achieve?

When I was at the Board, I was actually part of the work on Kenzo. And I was very, very excited because it can be able to allow us to do two things. Not only we can be able to provide services at scale with a software-like margins, but it will allow us to connect our solutions together with a common data structure. So I believe that basically the AI-first work that Dan is doing, it will allow us to not only maintain the margins that we're providing today, but actually sustain it even better. And I will pass it to Rafe. He can share with you how we're thinking about it. We want to run a business that's profitable, high margin and at scale. And the only way we can be able to do that in the category we are in is to be able to make sure that our gross margin is best-in-class.

Yes. Jonathan, I would add -- just to add to that, one of the things that I think we're pleased to be able to talk about today is we talked about improving margins as we went through 2026. We're delivering on that. And I think that was an important goal for us. That balanced growth that Wael is talking about is how we really look out across the next few years, frankly, about how we're focusing. We want to invest in the products so we can drive growth. That is incredibly important, and we think that will be a big driver of valuation over the longer term. But we also realize that the margins on the bottom line incredibly important. So we've taken a big step today.

We're obviously not giving 2027 guidance yet, but it speaks to our commitment and our focus, and I think we'll continue to maintain that focus on being very smart about how we invest and also keeping an eye constantly on the bottom line.

Our next question comes from the line of Fatima Boolani with Citi.

Wael, you counted a number of ways in which you're setting the foundation for running a more streamlined business and a streamlined execution. But specifically, I wanted to ask you on the noncore product portfolio. Is the eventual conclusion or end game there to deprecate most of that portfolio on a stand-alone basis?

I think you earlier did talk about transitioning some customers out of the noncore and providing them a bridge into the core. I was wondering if you could help us a little bit around is the entire noncore portfolio eligible to move into the core or perhaps there is an opportunity to deprecate and/or rationalize some of what's in that portfolio under the auspices of just becoming more efficient as an organization. And then I have a follow-up as well, please.

Sounds good. Thank you, Fatima. And those are very good questions. The way I look at it at the noncore, certain categories that require different type of investment if you're going to be competing with the pure players. And those races are not the one that we're actually going after. We're focusing all our energy and our investment behind the ones that we're already a leader and we can participate and basically grow with those categories. Nonetheless, we have an incredible amount of technologies and our customer base is intertwined. So some of those technologies will basically be served -- servicing our customers from the vignettes of our platform.

So we are basically looking at every opportunity to make sure that we can provide outcomes to our customers, but also not to chase certain races that the market already decided and the pure-play game is not going to be ours to win. There is enough for us to win. There is a big market that is pulling us, and we need to put the appropriate investments so we can make sure that we can have our lion's share of those subcategories as well.

As a matter of fact, I believe there is a category envy, like the neighboring industry players, they are already coming from EDR and we see there's a lot of action in MDR. So we'll see some competition coming sideways. They don't have the right to win because they are not vendor neutral like we are. They don't really have the strength and the depth that we have. We have thousands of customers relying on us every single day. So we really need to focus to make sure we defend our turf that we have earned and that may make us actually deemphasize in some subcategories that we will not be able to actually chase. We have to make some choices.

Understood. Very clear. And then you mentioned earlier that the core of the portfolio is around finding things, but then being able to also fix them, right? So this whole patch management and remediation window that has effectively vanished against the innovation that we've seen out of the large language model providers. So I'm curious just from an asset management, patch management perspective, what intellectual property you have there? And why do you feel that a detection and response angle to solving that approach is the right way versus a traditional asset management or patch management intellectual property?

Thank you. We are in a very fortunate position. Over the years, we have assembled some deep technology, deep expertise, and we understand our customer environment extremely well. Sometimes we see the alerts before they even enter. And sometimes we are actually integrated within the customer where we can actually work with them to be able to tackle some attacks and making sure that we respond swiftly.

But what we saw in order for us to do this the way the market is going, we needed to have a common data backbone. -- that when we have a common data backbone that it allow us to leverage customers' assets instead of asking them to replace it. So from an architecture perspective, we basically had to focus on that. That's also going to be the basis for the agentic work that we're actually working towards. And with that, we can be able to do way more than what we're doing today. It's the combination between our expertise and our people and the future agents, we should be able to actually close those gaps. And there's going to be many gaps actually in the future more than today. And customers are asking us, how can you be able to help us at scale. And that's really the work that we're doing right now in the platform. And we see that customers will be coming to us asking not only to find the vulnerabilities, not only to make sure that it's exploitable, but help them to close all the gaps, all the scams and help them to fix -- the ultimate answer is patching, but there is a lot of things you can be able to do if you cannot patch on time.

Your next question comes from the line of Brian Essex with JPMorgan.

Maybe first of all, Rafe, thank you again for another good quarter of transparency. We really appreciate the level of detail. And then maybe for Wael, would love to understand what you're seeing in the pipeline. It seems as though we're in kind of an unprecedented time here for some of the business that your core segments are exposed to. So I would love to know -- are you seeing an acceleration in pipeline? And if you are, it seems as though the assumptions around the core business are relatively conservative. If you could maybe kind of contextualize your outlook for that business, how conversion win rates are kind of transpiring and what your expectations might be for potential upside, downside to those expectations given what you're seeing in the environment on the customer side? And then I've got a follow-up for Corey.

Sounds great. And thank you, Brian. So the way I look at it, like I just talked to some of my team members who came back from Black Hat and the excitement and the talk around basically our solution, it was very much notable. Nonetheless, I see customers actually now exploring more than buying as they're basically trying to figure out who are the players that they're going to need to be putting bets behind. And they're actually asking a lot of questions about exposure management and detection and response, a lot of questions. And some of the questions is related to what type of investment do you need to make, what type of basically integration need to happen? And what is our vision and philosophy when it comes to agentic? And what do you need to basically be prepared to do? And also, what is the connections between exposure management and detection and response and how we see that.

I cannot really wait for this week to passes by. It's been a very difficult week for us as a company where we actually had to make some major restructuring. But I am very positive that we should be able to participate. I actually participated in a lot of customer calls in the last few weeks and the last couple of months. And to my surprise, the customers actually asking us for answers. We have 10,000-plus customers who've been doing business for years. The level of confidence that we can be able to give them answers is definitely there. Nonetheless, there is some more work we need to do to sharpen our story and connect it together. And that's going to be my job in the next couple of months.

And Brian, I would just add on a couple of the points you called out there. Where I think we've been very pleased as the year has been developing. Remember, the sales leadership team was really brand new at the beginning of the year. We continue to see productivity per rep go up. The team has really done a lot of work focusing on their pipeline generation efforts.

And also, frankly, as a precursor to the things we're talking about now on a regular basis, really directing the team's efforts so they make sure we're selling our core platform solutions. And we could see strong evidence of all three of those elements coming into play in Q2. So I think Allan and the team have done a great job there. It's part of the longer journey. It's got to be paired with the product releases. But when we look at the competitive deals that we went head-to-head against our well-known competitors, like we win because of great sales execution combined with the product that's there today. So we have room to get out there and win. And I think that's always super encouraging to us as we gain momentum under new leadership on the product side, we really hope that's going to play out in a very positive way. It may take some quarters for it to become large enough and evident enough for everybody on this call, but we're really encouraged by those elements, just good execution in the trenches, if you will.

Got it. I really appreciate the color. Maybe a quick one for Corey. Just because, Corey, you have the context here. From a restructuring perspective, I mean, you guys have gone through a number of changes over the years back in 2023, I think 18% of the workforce. And as Rafe just mentioned, you have new sales leadership in place. I would just love to -- if you could just wrap some context around the changes that you're going through now how they're different than ones that you've gone through before and what the environment is for attracting and retaining talent. We feel free to interject as well. But Corey, just because you have that context, historical context, I would love your insight.

No, absolutely. And context is important. So I think the biggest change, especially from the last time that we did this is we have a lot more clarity today. Keep in mind, today, we enter with doing this with a completely revised leadership team that's operated at this scale, that's actually done turnarounds, that's done growth. So we enter it with a strong team. We enter it with clarity of knowing where we need to focus and frankly, where we need to defocus. And so we do this work with more purpose in mind and more clarity about like where we're going and what we want to become. And frankly, a very inspired view of the work that we could do for our customers in the future.

When Wael talks about sort of the reallocation of focus and investment, it's something he's quite serious about is that we are investing and building something that's not just relevant, but leverages lots of the great technologies and lots of the great work that we've done and builds on it for our customers.

So, I think today, we're doing it from a place of clarity and focus and not that it wasn't reported. We knew the right things that we needed to do before, but we're still evolving the direction. We have a lot more clarity about where we need to actually go, and we have a team that actually has the experience doing it. Absolutely.

I appreciate. Thank you. Yes, I'm sorry, go ahead.

Yes, no problem. That's okay. Just to follow on what Corey said is from day 1 and my partnership with Corey on the Board and as a CEO was understanding the culture of the company, making sure that everybody understands why we're doing this, understand exactly the compositions and the options. And in the last couple of months, regularly, we've been communicating with the team, basically the finding, the structure and the whys.

So as basically Corey said, everybody is -- to my surprise, actually, the leadership, the new and the existing and even the second level and the third level, the embracing of the change was there. And this has all been fueled by conviction that we're actually in a place where we can service customers in a way that the customer want us to serve them. And that's really what's driving all these changes.

Your next question comes from Joseph Gallo with Jefferies.

Wael, there's a lot of changes, and you've talked about product a lot on the call, but can you just talk a little bit more about go-to-market refinement? Any more changes expected there? With the 12% of jobs impacted, is that also impacting the go-to-market organization?

And then just as part of my follow-up, Rafe, how are you embedding all of that uncertainty and job impact in guidance? When we look at your guide, is it more prudent than the previous guidance that you've given? Or is the right read that ARR decline should worsen versus the past two quarters?

Thank you. When we actually have been looking at this, we've been looking at this before I started. On the Board, Corey and the team have been actually looking at how we can be able to reshape our company into the future for growth. So the addition of Rafe for precision and Allan as a CCO for scale and Dan for the AI first, that was actually always from day one in the structure. On the go-to-market, I had a partnership with Allan when I was actually on the Board and today as a CEO and make sure that any restructuring we're making, it will not impact the scale we need to be able to actually continue with our transformation.

It's a multiple basically sequence. And I believe the way we actually did the restructuring, we try to be very, very careful in a couple of areas. Number one is the -- anything to do with customer journey pre or post, we make sure that we have all the right resources that allow us to get there safely. We need to protect our customer base. We need to protect our turf. We need to show up when customers invite us, and we need to be able to have our fair share win rate.

When Rafe basically mentioned many times, actually, we get invited and we get shortlisted and we get selected. But even when I examine the time when we do not get selected, I feel we can improve that and we can actually increase that win rate. And Allan is laser-focused on it. He has done a very good job, taken our existing great go-to-market team, augmented it with basically done it before team members. And I think the combination will allow us to be able to navigate. Rafe?

Yes, on the guidance side, obviously, this is something you look at when you're looking across the team. As Wael mentioned, the reorganization, every group participated in the reorganization to one extent or the other. There was -- and it will always be a very big focus on those individuals who, frankly, touch customers are on the front lines, whether it's on the customer success side or on the new sales side. So we tried to be very, very prudent as we looked at where savings opportunities had to be taken. But it is something we considered as we are forming our guidance.

Your next question comes from Meta Marshall with Morgan Stanley.

Maybe a question. You noted Dan has been doing some significant work for a couple of months. And I know that there has been a lot of work being done over the last year to kind of add a lot of features into the MDR product. So just how do you think about -- obviously, the product will be continuously evolving, but when should we kind of think of judging milestones in terms of kind of the products for both exposure management and MDR kind of being where you would like -- closer to where you would like to see them?

And then the second question, just on MDR, just any pricing commentary of what you're seeing in the market would be helpful.

Great. Yes. We've been actually doing a lot of work on the product, not only in the last couple of months before then for the last year. And I see that with the win rate and how we can basically win some of the RFPs coming our way. And we will continue to basically make the right investment.

On the D&R, I sat with customers and I can see who are the competition. And most times, actually price was never the differentiator. They're looking for a partner that can be able to help them and can be able to be there, and they're looking for a lot of references. And we have plenty of references that we can be able to furnish to those customers to give them the comfort. I've talked to some customers. And when we basically talk about the sensitivity, I did not see that the price sensitivity -- there's a customer that we're talking to, it was mostly about the service level, the ability to evolve into the agentic and the AI world that was the #1 priority for them.

And then when you talk about basically the exposure management, I think it's just focus. I think we just needed to put more focus and let the team know that this is definitely not only core, but it's very much a priority because it will help us to complete the journey of our customers. Not only we can find things we can be able to fix it. The connection is extremely important. There's a huge opportunity with our platform to be able to do so. So overall, I think there's a lot of work done, but there's a lot of work need to be done as well. but from a modernization perspective. So the way I always talk as a team, AI first is going to be always part of our design. Vendor neutral is extremely important in what we do. Number three, connecting basically our exposure management with our detect and response, so our customer can get the highest value from our platform and a greater outcome into the future.

So that's the way that Dan is actually managing his priorities, and he's done a lot of progress in the last couple of months, and I see that the next quarters we'll see that manifest itself and then increasing our win rate as we participate in more RFPs and more customer requests.

The next question comes from Adam Tindle with Raymond James.

Okay. Wael, you mentioned that you're asking investors to judge you on cash generated over time, and you're addressing profitability now and generating cash, which is especially important with that debt instrument coming due in March makes total sense. Then beyond this, I think you mentioned your other thing that you asked investors to judge you on was how you reinvest. And that's the part that I wanted to ask you about as we kind of squint forward. You've been on the board for other initiatives that involved accelerating hiring. Today, we're making the decision to restructure. So what would be different about that period of time where you're investing once we get to that point? What have you learned? And what might be different as you enter into that phase?

When I was at the Board, it was very clear that there is definitely a core and noncore component in our book. It was very clear and making sure that we have the right categorization was very important. As I said on the seat, I was pleasantly surprised that most of the decline happened in the noncore. So I thought I was going to come in. I'm going to try to do some basically shifting and showing the team why we needed to be able to focus on the core more and deemphasize the noncore, but it was very, very clear. And the work was done for me when the majority of the decline was happening in the noncore.

But the other part that was very surprising to me is the appetite of our customers to talk to us and work with us and want us to give them more. Like I knew the subcategory that we play in are attractive. And as I said, there's a category in where I saw myself in the outside endpoint players are trying to become in the MDR because they know there is projects, there is budget and there is action. So they're trying to get in. Although they don't have the right to win, we have the right to win, we are actually invited. And that made me feel stronger about accelerating the restructure that fast and redirecting our energy into these two important subcategories. They are growing -- some of them are growing fast. The others will actually start growing faster, and we need to be ready. There's a lot of work we need to do to make sure we can really get our fair share from that upcoming growth, if you will.

Great. Maybe just a quick follow-up, and this might be for Rafe. I just wanted to ask for a little bit more quantification around the restructuring, if possible. What maybe hits in Q3? What is incremental in Q4 because it's quite a ramp on EBIT margin. I imagine there's dollars of savings to the extent that you can maybe just help us with the quantification of that?

And secondly, Rafe, sorry to throw two at you, but I would also be interested in the cash cost of the restructuring. I couldn't help but notice your strong cash flow guide for fiscal '26. So just wondering how you considered that when you looked at the $130 million, I think, what you guided to for cash.

Yes. Thank you. I think in terms of the split of the benefit, and you could frankly, see this looking at the operating income guide between Q3 and the full year, kind of gives you the full view. Q3 is obviously -- it's -- the restructuring is happening partway into the quarter. And obviously, especially as we look around the world, the discussions are ongoing that's pursuant to local law. So Q3 is -- we will not see that much of the benefit really when all things being equal. Q4, you start to get a much cleaner view of that. So you have a -- you can see that full impact because it will be a quarter where, by and large, we'll work through all of that. So that's what is really driving that big increase we're projecting for Q4.

On the cash side, you're spot on. Again, we do have the severance costs. And as I mentioned in the scripted part of the call, most of those severance costs will fall in Q3 and Q4, and that offsets essentially a lot of the savings that we are getting from the restructuring. So you kind of -- we've been calling out $130 million -- approximately $130 million of free cash flow all year long. So we're really just staying with that and working towards that number. It will be more back-end loaded, just the way the timing of the collections goes as well as the severance costs and whatnot from the restructuring.

At this time, we have reached the end of our question-and-answer session. We thank you all for your questions, and you can now disconnect your lines.

Good morning, everyone. Thank you for joining us. My name's Brian Essex. I cover mid-cap and large-cap software for JPMorgan, and I'm excited to have Rapid7 with me today. To my right, we have Corey Thomas, the CEO of the company; and then to his right, we have Rafe Brown, the company's new CFO. So Corey, Rafe, thank you so much for joining us. I appreciate it.

Thank you for having us.

Thank you for having us, Brian.

Yes, maybe to start, Corey, if you can help me maybe frame out your perspective on the shift in the environment, the threat environment that we've seen over the past 6 months or so and how that's impacted your business just overall?

Yes. I mean, look, I think that -- if you go back, attackers have been adopting AI technology. So you've seen attacks move from low and slow to much faster. And so that's having customers in the detection and response space do, frankly, fast cycle upgrades to their capabilities. The bottom line is that they're looking for how do they get more coverage, faster response, faster detection and better scale. Lots of them are starting to actually move beyond just traditional SIEM. It's been a bit of a tailwind for the MDR players, but it's also been a bit of a pressure point to actually cover more of the environment at lower cost.

One of the entrants has actually coming in is what we call the AI SOC players where they're really focused on using AI to actually detect and monitor the environment. We acquired an AI SOC player so player in the past couple of months to actually deliver the capability because it really does matter, the speed and scale matters. So that's a big change in the environment overall and that's also impacting the market. The other one that you can't miss is sort of like Mekhos and the impact on the exposure management market where it's essentially vulnerability discovery on steroids. And so the pace of vulnerability discovery is actually now happening at a -- maybe exponential is not the right way, but at a very accelerated rate.

It's probably exponential.

It's probably exponential. We don't know yet. They're holding -- the government is holding lots of the stuff back. So it's somewhere between hyperaccelerated to exponential overall. But it also has lots of noise. And so it's catalyzed a reinvigorated interest in exposure management and how you actually separate out vulnerability possibility from vulnerable -- vulnerabilities that are exploitable in the overall environment. How do you actually have active remediation in the environment? How do you have active containment in the environment? So -- which is nice because that's been a recategorization of customer interest for something that was trending down in priority on exposure management to actually really accelerate and impact towards the must-have critical focus areas. So those are the 2 bigger dynamics that are happening right now.

And I thought it was really interesting. One of my takeaways from this week as well as recent earnings in general is just maybe a vulnerability renaissance, if you will.

Yes, absolutely. Yes.

Cognizant calling it out, Check Point this morning calling out exposure management, in part vulnerability management. Tenable certainly flagging that and your commentary as well. And then maybe to add to that, it seems as though, based on industry conversations I've had over the past month or so, CIOs are freaking out a little bit about threat environment...

CIOs are definitely freaking out. So that's why I say like half of our -- so the inbound interest has been like amazing at the same time as people are trying to figure it out. Remember that the model -- well, OpenAI was a bit more liberal. We're part of the -- post closure, we tried their Trusted Access program. To be fair, Anthropic tends to be more open. They have some restrictions on how broadly they can actually make it available. And so lots of CISOs are trying to figure out like what's the extent, but CICOs are having their own freakout money about they're preparing for the tsunami. And we're spending lots of time talking about how they'll deal with and manage the significant influx as expected of vulnerability. So again, it's made the vulnerability discussion a much more strategic discussion than it was 2 months ago.

Yes. And how does that -- I mean, how does that convert to an impact on your business? I mean, you have -- recently, you've kind of split things up into core and noncore, I guess.

And exposure is in core. I mean it's a headwind to core, but it's still in -- it's in core. Look, the #1 thing that we can actually do to -- and core is a growing business overall. But the top thing -- and we know how to actually it to grow and accelerate and have great growth in the D&R space, like that's not a mystery. We know how to do it. The only mystery that we were solving was how to do it at the right profit margins that we actually wanted. And we think that our internal investments with our acquisition have actually tackled that profit margin challenge. So we're very excited about the growth potential there. But we had exposure, which was a headwind, which was -- it was 2 pieces to the headwind. As part of it, our historical mid-market customer base was not sort of like a growth-oriented customer base for that. But the other one was that exposure management was just had been dwindling in the priority stack. This escalates up the priority stack. It creates new demand drivers for people to actually look beyond what's good enough and now they're looking at things that frankly fall down and what we consider sweet spot is, understand exploitability, managing remediation at scale and some things we have to invest in, which our team is doing organically is how do we actually make it faster for people to respond.

And so those are the areas that we actually think are catalyst. As far as time frame is, I think people are still in the stage where they're trying to understand the significance and the impact. And so we're not looking at this as sort of like a next quarter time frame because right now, customers are just trying to come in and say like, "All right, how big is the impact? What can you do for me?" And they're planning for it, but this has flipped around to a potential upside to the exposure management business. And then we're just trying to figure out like, "All right, how sustainable is the catalyst?"

Any visibility in terms of like how they're shifting priorities within the budgets? I Know, it's always been -- I know I've done surveys in the past and others have as well. It's always been endpoint network identity have been the top 3, maybe you put data security up there...

Monitoring has been up there. I think the monitoring has been at the top because people have to monitor the environments. And so I think that exposure has not been top 3 and 4, 5.

But how is the most recent environment maybe shifted? How they're thinking about changing the prioritization within their budgets?

We'll see if it ends up being true or not. Look, in some perverse ways, CICOs love public things because it gives them an excuse to ask for extra money without having to make the trade-off thing. So like a number of them are planning to actually go out and harass people like Rafe and be like, you know what, this is a global crisis, I need to actually do it. So we'll see whether that actually works or not when it deprioritizes along the way. But a number of the CISOs are trying to scope it to actually figure out, like, okay, it's a big enough like it's framed as a -- when the White House is involved, other people [indiscernible] this whole crisis like I can get extra money for this. And so that's what we're seeing in a number of people. We'll see whether that lands or not.

Yes. That brings me to maybe an adjacent point. It seems like in the spending environment, you had IT budgets where security might be a subset of that. You've had AI budgets where your Chief Marketing Officer may be pursuing an agentic coding project for an application to help them penetrates these markets and you have to secure that. In some cases, I think CISOs are saying, "Well, I'll run it for you pay for you, [indiscernible]." And then you've got incident budget, which is a little bit extra.

What are you seeing in terms of access to each of those segments of spend within your customers? And is there maybe an acceleration point if you get incident budget spend across your platform?

Yes. Look, so it's clear that customers are looking to get incremental budget across. I mean, so I actually think that, that's where we are -- look, security budgets have been tightening. And this tightening is that it's not declining. It's that what we hear from our customers. They have to do more with less incremental spend. So it would be unfair to say that like the security budgets have been shrinking. They haven't been shrinking. They've not been expanding. And security teams were used to expanding budgets because a lot of their mandate is uncovered. And so they were trying to figure out how to tackle the uncovered mandate.

Now they're actually -- they've been asked to actually do more with less. And -- but in this environment, like the incident budget, I think people are hoping that it can be more incremental spend.

Great. Maybe to kind of pivot on that, too. I think, Corey, you explained 3 primary modes of the business: cost efficiency at scale, exploitability context, trusted autonomous response. But how do we think about -- maybe 2 things. One, how does Rapid7 win head-to-head against larger platform players? And then second is what -- how durable is the moat around your business? I think a lot of investors looking at vulnerability management, you see Mekhos not only identify vulnerabilities, but engineer exploits and patch vulnerabilities. And they're extrapolating the speed of innovation that we're seeing on those platforms to some kind of a terminal impact to particularly vulnerability management exposed vendors. So how would you explain; one, the moats you currently have around your business; and then two, the durability of those moats longer term?

Yes. So I'll invert the risk because I'll answer the question around me because it's important to understand like exactly what it is and this will go to like the durability and how we actually think about it. So one, it is vulnerability discovery at scale. It's incredibly powerful. It's incredibly cost-effective overall. Just to be clear about what it would mean to actually do vulnerability management at scale running Mekhos or some version of Claude across your whole environment, which is typically, when you run things generically across your environment, you want them to be self-contained and tightly controlled. So the idea of like having like AI -- general AI, when ramp after across your environment, is not actually practical for most organizations. It's not wise for almost any organization.

By the way, Anthropic would say -- I mean, if you go -- I mean, I don't know how many you have it, but like if you go log in to Claude Cowork right now, it is -- they say explicitly, you can auto run all the instructions, you should not do this. And that's not going to change any time soon. Like the even minor errors can cause catastrophic damage. So they don't recommend it either. They're not suggesting it. And so it's an extrapolation without mirror is what I would just say. It's just like it is something that will be both dangerous and something that neither OpenAI or Anthropic suggest that you should actually do. So that vector about like running it rapidly across the environment and having it do the operational things, you want things that are operational to be tightly controlled and well managed. So that's just -- just to be clear about that.

Now let's actually get to what the actual core modes are. First, let's just zoom out like the simple mode in the world is that customers want people that are just going to task off of security. So our goal is to actually be the #1 security outsourcer, like we want to actually use technology to actually run -- allow people to run and scale their security operations program. People are hungry for that. It requires both technology. It requires the use of AI and technology. And it also requires deep services expertise.

We are one of the few players who have, at scale, established service expertise leveraging technology, increasingly leveraging AI, and people want to actually get a great outcome of security management at lower cost.

Just to be clear, our whole mission and ambition is a moat in and of itself, it's that like most organizations are not actually marrying the best of services with the best of AI in a technology infrastructure that lowers people' cost over time. So that's one. Now when you actually get to -- and I think your question is in regards to the moat around the general Frontier models and what -- because I think there's a different moat in security versus the Frontier models. But on the Frontier models the reason that we think that it's a misunderstanding of it, there's a couple of things. So one is that we're designing to actually run and allow people to have an outsource-centric AI security program at scale cost effectively. The Frontier models aren't designed to actually do that cost effectively. In fact, we use a lot of the Frontier models. And half of what we're actually doing is adding deep knowledge and context and actually making things cheaper and more efficiently where it doesn't make sense to use a model for something because it's inefficient from a cost perspective.

The second thing is our technology runs ramping in customers' environment. So we have to actually do that safely and securely. And so the second piece of the equation that we're actually heavily focused on is like how do you actually use AI at scale across customers' environments safely and securely.

The third thing, which ties into it is that like increasingly, people have to respond in machine time to both exposures and to incidents. And we're building a framework that allows sort of like, yes, it leverages AI, but it's not just AI, safe response. And then the third thing, it's an incredibly complicated complex world is we -- there's not a world where we can just trust just technology for cybersecurity.

So we're building the people and expertise to actually -- and we already have it today. We're doing this at scale today to actually augment the technology. They're providing knowledge, insight and depth, but they're also like handholding customers through incidents. They're dealing with the politics in our customers' environments about where to prioritize their security, defense and spending. They're helping people with their remediation. They're actually talking to the management teams. And when people are outsourcing a business is you can't just -- because security has issues along the way, you can't just be like, oh, I'm the CISO, I outsourced it to a company that's just AI, and I have a crisis is I can go through a chatbot. People actually want to actually -- they actually do need to actually do it because it's complex. You have to engage with incident responders, you have to engage with lawyers, you have different compliance regimes across the world. People do matter there. Now we're scaling the people in an order of magnitude better than we've actually ever done before, but that matters.

Great. That's helpful. And then maybe to switch gears a little bit. So Rafe, we knew each other at Mimecast. You did a great job there. What brought you back to Rapid7? I mean, what was that process like? And what do you see as the opportunity with the company?

Yes. Thanks, Brian. Well, first, I'm coming up on my 6-month anniversary, right? So now I've gotten onboarded and cranking away. Look, I mean, to be honest, I try to look at these things not so differently than our investors that come to an organization. And I think it stems from, first, at the highest level, are we happy with the markets we're in? And I'm -- not just cyber, but the MDR market, the exposure management market, both are very large, both are growing, and both we have a right to win and compete and play in. But also, I felt like one of the things that was really important to me, there was obviously a lot of changes going on in the business and -- which have only accelerated over the last few months with everything Corey was just saying. But at that earliest day of evaluation, I really wanted to dig in and see is this a management team, a leadership team that's ready to dig in, make changes and not fight yesterday's battle, but to dig in and see what's coming next and how to get ahead of that, right?

And I feel very comfortable with that. Under Corey's leadership, we've got also a number of new leaders on the team or people in new positions. Allan leading the sales organization, Julian leading the customer success organizations. It's people who are passionate about the opportunity and frankly, in some cases, frustrated about what some of the things they needed to knock down and take out to accelerate our business. And so that's the environment I'm looking for. This is the team that -- I think it's a great company to work for, but it's also a team that's just determined to win and to grow. And if you're in a context with great products, great history, great market, you can figure that out. It may take a few quarters, right, and that's what we're living out.

So that's where I started. And I think it's only just played out -- the people often ask what surprise me. I mean, what surprise me is just how much things are changing, how quickly things are changing with the developments coming from the platform providers. But if anything, I think that could be an opportunity for us, right? So in areas where we might have ordinarily been playing catch-up, we can say, well, we're not even -- that's not the fight anymore. We're going to just try and accelerate what we're doing and get out there and serve our customers and make sure we're helping answer tomorrow's problems.

And all of that, I think, sets us up for, first of all, a lot of work and -- that we need to do to deliver on that, but there's tremendous opportunity for us.

Right. And how would you describe, I don't know, either both for Corey or for you, the magnitude of changes or the breadth of changes that you had across both sales and operations over the past year or so? It seems as though it's pretty significant. And I think investors here are starting to feel for -- kind of feeling for a floor. Where are we at the stage of change, and when can we expect kind of like a baseline where, all right, well, now that the organization is in place, we're seeing the productivity, we see the opportunity in front of us, and then we're just like executing on a bigger pipeline now.

I mean, we will tag team it. So one, I've been heavily focused on, for lack of a better term, I hate to use the term upgrading, but like is getting the right management team for the moment that we're actually in. So that's been a heavy focus over the course of last year. And by and large, I think we actually have done that, and I feel very good about where we are there. The second thing is we've got to do some work to actually just be clear about our target model, which the team is coming in, Rafe, Allan, Julian and others have coming in and be clear about like, all right, what's the target model, what does it take to get there? And then the execution velocity to actually move to that target model. And we've activated the company to actually the pace of change. Now -- and that's happening fairly quickly.

The nice thing that I feel good about and Rafe commented about in the earnings is that we're already seeing some yield and benefits of that overall. And so I would say, from an operational perspective, we know where we're going, we know what needs to be done. We're in the process of executing on that and driving the -- and driving the change on that. I actually think that's all going to be net positive for the business. I think the question is where is the floor on the growth dynamic? I think that part of why we actually broke out shows that we have positive growth in the core, a lot of visibility and we're very comfortable with that growth dynamic.

We're addressing how we actually manage the noncore, which, while smaller, it actually impacts total growth, and we just want to be transparent about that, and we'll talk more about that later.

Yes. And Brian, what I would add, there're some of the changes, especially for investors who would see it on the financial statements, right, that started before I joined the company, right? There was some prioritization of headcount additions that happened in 2025 and those costs obviously carry over to this year. But there're things like improving our coverage in the SOC. Corey was just talking about how we're going to automate a lot of that work to be able to maintain and improve margins over time. But we had to make some additions there just to deliver great customer experience. And likewise, we've built out a low-cost center for engineering and for some of the other functions, right? Some of those come with costs that came on board in 2025 and obviously, carry into '26. But we're now getting to the point where we can start seeing some efficiencies from that work paying off for us. So there is that part of the transition that I would say we're several innings into, but then there're some things that are much newer, like, for example, the Kenzo acquisition that's, frankly, accelerating our AI SOC development journey that we were already on, that's fairly new.

So there is a bit of a combination, but I think what we're really prioritizing around is making sure we're providing great value to our customers, that we're meeting today's challenges and that we've set ourselves up to have the balanced growth. And I think that's really key for us as we think about our financials over the years. We want to see our core products growing, period, right? And we're working to make that happen by good investments in products and good prioritization of resources across that. And then we want to see margins improve over time. And you can see it a little bit just in our guidance between our current quarter guidance on non-GAAP operating margins and the full year. And what we've talked about is we're just very relentless in all of our internal planning of looking, not just at '26 deliverables, but '27 margins and how do we manage margins as we go across a longer time frame managing that run rate, if you will.

Great. Great. And maybe, Corey, what have Allan and Julian done within their organizations in terms of the magnitude of change? And are all those changes complete at this point?

So I'll break it down in each case. So Allan has brought in a primarily new management team. And he did that fast. He did [ that in ] Q4. He had like the structure the team, the comp plans in place, the ICP clarified and the focus on alignment done as we enter Q1. So I would say that is -- I never want to say they complete a CEO. So I'm never going to say that because he might be listening. But I would say that is substantially done in lots of ways. And now it's about the execution and yielding the results on that.

Julian is a bit different because Julian had 2 mandates when he actually came in. One, he had -- well, 3 in a way. So one, he had to scale the service so that we can actually be a best-in-class partner, and he's still working through that. Like he -- our brand is going to be people are differentiated to technology as they actually rely on technology to do more and more of their workflows and they outsource more and more of their workflows. So best-in-class team, best-in-class customer experience, but to really make the customer experience thing. He's still in the process of that.

The second thing is he has to actually do more of that at lower cost. And so like it's a challenge, but like it's a -- we have to deliver extraordinary customer service and experience, and we have to do that while improving our margin profile over time. So he's still in the middle. And he does need some technology to do that so that people do the things that they can do uniquely, but technology actually provides some of the scale behind the people overall. And then the third thing that he'll do, which is not a this year thing, which is a go-forward thing is that we are going to be offering AI security services across more workloads over time. Primarily, it's detection and response today. But we will be sort of like taking that very successful MDR strategy and doing it on exposure vulnerability and risk management. We'll be doing on compliance. Those are the 2 next big workloads that we've got massive amounts of feedback that customers want to be able to outsource to our AI center services. So he's got that mission mandate, too.

Got it. And how much of the growth that you anticipate is from existing customers versus new logos?

That's a great question. And so, this year, we're looking at primarily, I think, centered on new logo growth, although it's always been a balance just to be clear. So it's a tilt, not a -- it's a tilt like this, not a tilt like this [indiscernible] say it like that, although I did it backwards for you all. The -- as we go forward, though, as we deliver more of the AI services workloads, we do think there's a big opportunity to sell more to existing clients. And we've got lots of interest in how people can -- especially in Mekhos [indiscernible]. Some of this is like, okay, I can't hire more people. And so like when are you got to -- some people are gambling like, hey, you're looking to actually allow us to outsource more of the exposure management services, when can I do that? And what's the readiness for that? Likewise with the compliance services. So again, it's early there, but like I think over the next year, in 2027, I think that starts to change a little bit.

Got it. And for both of you, I think you mentioned the Kenzo acquisition. And I think you're clear that it's more of a -- more an IP acquisition than a revenue acquisition...

Yes, and lots of revenue. Great technology, but they were just going -- like they had a couple of nice really marque customers that [indiscernible] scale, but it wasn't substantial revenue deal.

Yes. So how would you describe what it brings to the table? And then when can we expect the impact to financials from that effort?

Yes. So I will take it. What it is, it's actually -- it's an AI technology base that allows people to actually to monitor environments at scale using AI with incredible efficacy rates and accuracy rates. So that's what it does. And actually, monitors for attacks at scale, processing all the security alerts and telemetry and allow -- and it does that incredibly accurately. We were so impressed with the accuracy and efficacy of that. What are the benefits of it? The first is a ICP, TAM benefit, so ideal customer profile and TAM. One of our biggest drawbacks on growth in the MDR space was that customers wanted us to actually monitor more and more of their environment because they have to have full coverage of scale. And doing that with just technology and just people would pressure gross margins. So we actually contained ourselves to the parts of the environment that we could actually do that fit our gross margin profile.

So we essentially capped our TAM and MDR to things if the TAM that fit within our gross margin profile. This removes that cap. So it actually opens up the full TAM and it opened up sales force. And so not just you, but our sales force is just like when can I actually start being uncapped. So we're doing the integration work, but that's a big deal because that's actually a tailwind to growth. That's why we feel good about the growth potential there because it's not like I have to go something new. We just have to stop saying no to actually the types of deals that we can actually do. So that's a big one. So that's the tailwind to the company.

The reason we love this acquisition because like we look at it, it's like, all right, where do we want to spend money is it was a double whammy. The other side of it is it allows Julian and the team to run the SOC more efficiently and allows our people to do more strategic work for customers. So it actually improves our gross margin profile on the MDR business. And so like when you can address -- improve TAM and improve your gross margin profile over time, that's a big deal. So that's why we're doing rapid scale because it was early stage, we are like we're making sure it scales and meets all of our needs. We have proof points on it. We're integrating it right now, modifying it, merging it with some of our technology. But as we exit this year, those are the 2 big things that actually impact. And we love things that actually have that dual impact on both profitability and growth.

Got it. Super helpful. Maybe for Rafe, I think a lot of people focused on the dynamics of core versus noncore, so thank you for breaking that out. I think it's very helpful. I think we get the core business and what's happening there. With respect to the deterioration in noncore, how should investors think about that? What are the drivers? And at what point does that become maybe an immaterial fact to growth -- overall growth of the company?

Yes. No, this is again just for everybody's benefit. We talked about on the call that over 80% of our business is core, right, which is the D&R and the exposure management side of the house. And so this noncore, which by default is less than 20%, that's a piece of the business where there's actually several different products within that. And we wanted to separate that out because as some of these good things that Corey is talking about continue to play out, we want to make sure everybody has good clarity on that and what we're doing there.

But when we look at the noncore side, we do see it's driving, based on our guidance, the sequential decline in ARR is really centered in this noncore piece. So what we're actively doing right now is going through and looking at each one of those products. And I think once you fall into a noncore or other bucket, you have to have a stated strategy for each product. And we have to evaluate them and look at how that impacts our customers' experience overall, but also evaluate against what we need from an internal perspective, make sure they're contributing good cash to the bottom line, make sure if they're older products or whatnot that they're funding the new investments that are going on. And that's a piece of it that we're very much in the midst of right now. Actually, the -- what we've shared with investors is came out of how we've been thinking about our business about really having strong priorities.

Now even at less than 20% of the business, it's still a meaningful amount of the ARR. And so we think there's ongoing opportunity there to make sure contribution margins are really solid, make sure we have really clear mandates about what salespeople can and can't sell or we do tend to incent our sales people to sell core more than these other things. But I think this is one of those developments over the last few months as I've come up to speed that first having this breakout, then diving into each one of those solutions and making sure we have a clear strategy. The reality is it's not a one size fits all solution within them. Some of them have much more crossover to customers between customers that are big platform owners also have some of these. So we -- it's going to take some work to pull this apart. We want to make sure we're really clear on how they're growing relative to each other, make sure that you can shine a light always and see how we're doing with our core because that's what's going to drive long-term value in the organization and then make sure we have a clear strategy for each one of these.

And we can add color on that over the over the coming quarters.

Got it. And then how are you thinking about balancing growth and profitability over the next few years? I think it's certainly great that you're showing us profitability. I think investors would prefer growth as long as you don't deteriorate the level of profitability that you have. But how do you throttle the 2? And how do you think about the trajectory over the next couple of years?

So I think what's really important for us is to have growth in core, right? That's the #1 priority. I'll take growth everywhere it wants to show up. But like how we're thinking about that business is we need core to be growing. It was growing 2% on -- when you take D&R and net it against exposure management, we'd love to see that accelerate. And we think there's great opportunity to accelerate that business. And so that's priority 1 plane and simple. But I think on the bottom line, we have to see margins improve over time, right? We want to make sure we've got good solid cash flow. We've got to make -- we've got to take care of our debt obligations. We've got to make sure we have the capacity to invest as opportunities come up. And so it is a balance, right?

So I think what we're going to be seeing is making darn sure core is growing and invest accordingly, making sure overall that we have margins improving over time.

How much of an improvement over time? I don't know that investors really want to see 100 basis points of improvement per year, but -- because they know that you have the leverage to do that. So as long as you can give them a little nugget...

Yes. I mean, investors can see like on our bottom line guidance, we expect margins to improve as the year goes on, right? I think the overall framework is we want to make sure, first and foremost, that we have the cash on hand to pay off our debts, that we have the cash on hand to run the company and make investments as we're going along and then make sure we get return from the investments we're making, right? And I think, like you said, if something really is taken off, the smart thing to do is invest in that growth trajectory. So it's, again, really getting in there and have that control over the dynamics of the business on a micro area, so you can have that situational awareness to make those decisions. I think that's what's going to play it out.

So in a context where you got margins improving over time, it's almost on the micro is more important than what we're doing.

Got it. And then how do you think about it? I mean you mentioned servicing your debt, so you've got a big convert coming up next year and plenty of cash to service that debt. You have an undrawn revolver and then you've got a tranche later on. How do you think about the level of flexibility that you have to service that debt versus what you have to invest in the business to grow?

Yes. So -- and just for everyone's benefit, we have a convertible bond that matures in March of 2027 of $600 million. We have -- this quarter, we finished the quarter with $670 million on the balance sheet. It's all in a current position. So we feel really good about this first maturity, and we have the line of credit and our ongoing cash flow, I think puts us in just a really solid position that we can pay that debt and have the cash to run the business, right, to make sure we're in a very comfortable space there.

When you stretch it out to the next convertible maturity, that's out in 2029 of $300 million, just our ongoing annual free cash flow build, we're comfortable with our plans that we'll be able to take that and again, maintain that position of pay off the debt, make sure you've got cash on hand to run the business. But like tuck-in acquisitions like the Kenzo acquisition that came up, you always have to be mindful of those and prepared to take advantage of opportunities. And so I think that's important and that's why it helps to have that $200 million undrawn line of credit on top of it.

But I think take -- managing cash is the first part of the job for the finance team. So I think we've got a great line of sight on taking care of the debt and then it's making sure we have the cash to run the business and make strategic investments, whether it's organic or a tuck-in acquisition or something like that.

Got it. Thank you for that. With that, we're out of time. So Corey, Rafe, thank you so much, really appreciate it.

Thank you so much, Brian.

Good day, everyone. My name is [ Kaha Ilani ], and I will be your conference operator today. At this time, I would like to welcome you to the Q1 2026 Rapid7's Earnings Call. [Operator Instructions]

At this time, I'd like to turn the call over to Matt Wells, Vice President of Investor Relations.

Thank you, operator, and good afternoon, everyone. We appreciate you joining us. Today, we will be discussing Rapid7's first quarter fiscal 2026 financial results. We've distributed our earnings press release over the Wire, and it can be accessed on our Investor Relations website.

With me on the call today are Corey Thomas, our CEO; and Rafe Brown, our CFO. [Operator Instructions]

Before I hand the call over to Corey, I want to note that certain statements made during this conference call may be considered forward looking under federal securities laws. Such statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include our outlook for the second quarter and fiscal year 2026 and the assumptions for fiscal periods beyond that period and our positioning strategy, business plan, operational improvements and growth drivers. These forward-looking statements are based on our current expectations and beliefs and information currently available to us. While we believe any forward-looking statements we make are reasonable, actual results could differ materially due to a number of risks and uncertainties, including those contained in our filings with the SEC.

Reported results should not be considered as indicative of future performance. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events or otherwise, except to the extent required by applicable law. Further information on these forward-looking statements and risk factors are included in the filings we make with the SEC, including the section titled Cautionary Language Concerning Forward-Looking Statements in our earnings press release.

Additionally, over the course of this call, we will reference non-GAAP measures to describe our performance. Please review our earnings press release and filings with the SEC for a rationale behind the use of non-GAAP measures and for a full reconciliation of these GAAP to non-GAAP metrics. These documents, in addition to a replay of this call will be available on the Rapid7 Investor Relations website.

And with that, I'd like to turn the call over to Corey.

Thank you, Matt, and welcome to everyone joining Rapid7's First Quarter 2026 Earnings Call.

Let me start by sharing insights from the influx of conversations we've been having with customers as they navigate the rapidly evolving cyber landscape. CIOs and CEOs are telling us the same thing in different ways. Advances from frontier models have fundamentally accelerated the threat environment and outpaced operating models built to defend against it. Vulnerabilities can now be discovered and exploited autonomously and attackers are moving at machine speed. This fundamentally rewrites the value equation and security. The premium is no longer on detecting threats faster after they emerge, it shifts to preemptive exposure management, autonomous detection and remediation at scale, closing the Windows attackers exploit before they can be exploited at all.

This is precisely the environment that plays to our strengths. And that's why our investment in the AI SOC and preemptive security operations are resonating so strongly with customers. This shift we're enabling from reactive to preemptive, from human scale to machine scale is not a marketing refrain. It's the only viable path forward for teams that need to anticipate where attackers will move next, prioritize the exposures that actually matter, and respond at the speed of modern attacks. Customers are looking for a partner who can unify their data, apply AI with the right context drive remediation at scale and translate all of it into measurable outcomes. That is exactly where we are focused.

The core platform we're building across Detection and Response and Exposure Management is becoming the foundation customers turn to as they modernize for this new threat reality. By unifying exposure and inspection on the Command Platform and combining AI-driven operations with the depth of exercises that we built over 25 years we're giving customers a single coherent way to reduce risk, disruptive tackers and build durable cyber resilience. The opportunity in front of us has never been clearer, and our conviction of this strategy has never been higher.

Turning to the first quarter. I am pleased to report that Rapid7 delivered outperformance against all guided metrics. ARR of $832 million and revenue of $210 million were driven by sustained growth in our Detection and Response business, offset by trends in other parts of our business, particularly our non-core stand-alone offerings. Non-GAAP operating income of $24 million exceeded our guidance and helped drive strong free cash flow of $33 million. Our quarterly results reflect a greater focus on balancing strategic investment in driving scale in the business.

In Detection and Response, ARR growth of approximately 7% was driven by strength in MDR business. Our approach to delivering AI-enabled SOC, combined with deep services expertise continues to receive strong market validation. And in this quarter, we added a new Fortune 500 customer and a 7-figure ARR deal.

In Exposure Management, we'll continue to simplify the migration process of upgrading our large vulnerability management base and to the exposure Command Platform. Our approach to a unified AI-driven exposure platform continues to resonate with new and existing customers. In this quarter, a large Fortune 500 customer consolidated on Rapid7 as their exposure platform of choice in a competitive deal cycle.

In the quarter, we acquired Kenzo Security, an agentic platform built to run security operations autonomously and at machine speed. This is a direct accelerant to our AI SOC vision. Kenzo's data mesh ships customers away from a per alert investigation model to a system-driven one. Coverage scales with the environment, not headcount. This unlocks two things: a meaningful tailwind for MDR growth; and a path to higher contribution margins through software-driven efficiency. Most importantly, Kenzo opens a door to the full MDR market. Rapid7 is evolving into a preemptive genic security platform that accelerates the entire SOC, delivered either as a managed service or a self-managed platform. By combining deep MDR expertise with exposure-driven visibility into vulnerabilities and attacker behavior, Rapid7 enables organizations to detect, investigate and stop threats earlier.

We also continue to innovate on our Exposure Command platform, delivering two major capabilities: onetime validation for cloud environments; and data security posture management to strengthen proactive exposure reduction across hybrid environments. In plain terms, we no longer just tell customers what their vulnerabilities are, we tell them which ones are actively being exploited in their environment. Onetime validation determines what attackers can actually reach in production, and DSPM maps where the high-value data lives and who has access to it. Together, they collapse the noise and surface to the small set of exposures that actually matter.

These steps accelerate the playbook we shared with you in February, strategically investing in our AI-enabled SOC to deliver preemptive security infrastructure while also deploying expert talent towards high-value customer engagements that AI cannot replicate.

Turning to customer wins in the quarter. Rapid7 continues to be the partner of choice for global organizations securing complex, on-prem, cloud and hybrid environments. The go-to-market changes, Alan, our Chief Commercial Officer, put in place at the start of the year are beginning to bear fruit. We are running a sharper, more focused organization and productivity has improved. While it's still early, the operating discipline we're committed to in February is beginning to take hold. And we believe that as an organization, we can continue to drive efficiencies over the middle term.

And this quarter alone, a Fortune 500 mining company with global operations selected Rapid7 as is an MDR provider of choice in a 7-figure deal. This was a long competitive sales cycle in which our SIM and detection response capabilities stood out to their security leaders. Rapid7's history managing cloud, hybrid and on-prem environments and strong technical knowledge helps submit this decision.

After years of only covering a portion of its environment, a global Fortune 500 aviation manufacturer expanded with Rapid7 as their preferred global exposure management provider in a large 6-figure deal. The capabilities of our Command Platform, combined with our in-house technical talent or resident points during the expansion process.

And lastly, a leading health services provider selected Rapid7 as their MDR provider of choice in a large 6-figure deal. Previously, subsidiaries of the organization use the spirit tools and lacked unified coverage, Rapid7's ability to address challenges at a regional and local level, in addition to a unified coverage across ecosystems stood out to security leaders at the organization.

Now before I pass the call to Rafe, I want to dive deeper into implications of the unprecedented shift to frontier models bring to the security landscape. And I want to be clear that this market shift is a long-term tailwind for us, not a threat. Vulnerability discovery has been accelerating and commoditizing for years, driven by advances in AI coding and reasoning and frontier models like Anthropic's Mythos and Google's Big Sleep have made that trajectory undeniable. Mythos those surface more than 2,000 previously unknown vulnerabilities in 7 weeks. That is a new baseline.

But here's the part of the stories that headlines miss, but Mythos commoditized vulnerability identification, finding bugs and codes. It has not commoditized the operational reality of managing those vulnerabilities across complex enterprise environments. It does not commoditize detection and response, it is not commoditized exposure management. If anything, it makes it all the more essential because the volume and velocity of findings every enterprise has to act on is about to increase dramatically.

The value is migrating in 3 directions, and Rapid7 is at the intersection of each trend. First, remediation of scale. The Command Platform provides a granular visibility and tracking required to manage thousands of [ filings ] across hybrid environments. Combined with our SOAR capabilities, and Kenzo's agentic AI, we are moving from traditional patch management towards AI remediation, identifying flows and deploying fixes autonomously.

Second, Detection and Response, a faster discovery cycle on the attacker side means a faster spot cycle on the defender side. Kenzo accelerates our MDR service from AI-assisted workflows to autonomous machine speed investigation. Detection is no longer the bottleneck. It becomes a precursor to near instantaneous response.

And third, preemptive exposure management. Our March releases of runtime validation and data security posture management, move exposure command from continuous assessment to continuous validation, telling customers, which exposures are actually exploitable in their environment against their sensitive data given their identity surface.

This is the shift the market is describing. It's a shift that Rapid7 has been building towards. More vulnerability sound means more demand for operational platform that turns findings in the outcomes.

To close, this is the moment of real change in our industry. We have the data foundation, we now have a step-change AI capability accelerated by Kenzo, and we have the expertise customers do not get from a model alone. The team is executing with urgency. The operating discipline is taking hold, and the work we're doing this year sets up share gains we expect to deliver over the medium term.

With that, I'd like to pass the call to Rafe to discuss Q1 results in more detail and our updated 2026 guidance. Rafe, over to you.

Thank you, Corey, and good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers, except revenue and balance sheet items mentioned during my remarks today are non-GAAP. Please refer to our earnings release and SEC filings for additional details regarding the presentation of our results and guidance metrics.

In the first quarter of 2026, I'm pleased to report that we exceeded guidance across all guided metrics. We finished the first quarter with total ARR of $832 million. But let me add a bit more color. I've now been at Rapid7 for 5 months, making this a good opportunity to step back and share some of my observations which I think will also help you better understand our underlying mix of businesses as well as the rationale for the strategy we are pursuing. A key takeaway is that while many people think of Rapid7 as a VM and D&R provider, that categorization of our business is incomplete. I believe that the business should be thought of in two distinct groupings.

First, our core platform solutions group, comprised of our Detection and Response solutions, which includes MDR, and our Exposure Management business, which includes VM and Exposure Command. These core platform solutions constitute more than 80% of our total ARR and have been the sustained growth driver in our business in recent years. As you know, we have different underlying trajectories within core platform solutions, led by our strong MDR business and work underway to return the exposure management business to growth. These core platform solutions are where our business is focused. As such, the performance of our core platform solutions is the clearest indicator of the ongoing transformation within Rapid7, and they are the solutions where we are concentrating product development and go-to-market resources.

The remainder of our business mix or second grouping consists of stand-alone non-platform offerings. As customers have shifted towards platform-based offerings over the past few years, these stand-alone non-platform products have declined on a year-over-year basis, while they remain profitable, and we continue to support our customer using these products, stand-alone non-platform offerings are not central to our strategy. As a result, they have experienced declines and have been the driver of the sequential net ARR declines we have witnessed in recent periods. With the benefit of that context and framing, let me unpack our Q1 ARR performance.

Our core platform solutions, which now total over 80% of our overall ARR, as I shared moments ago, grew approximately 2% on a year-over-year basis, led by our stronger software in the group our Detection and Response business, which had approximately 55% of total ARR, grew approximately 7% on a year-over-year basis. While D&R growth was partially offset by our Exposure Management business within these core platform solutions, we remain pleased to see ongoing momentum in our more holistic Exposure Command offerings, driven by both newcomers and customers migrating to this new platform. We are not where we want to be across all elements of our core platform solutions. But reaccelerating the growth of these core platform solutions is the focus of our strategy and where we are placing our bets, as you heard Corey describe in detail earlier.

In contrast, our non-platform products declined in the quarter, driving the sequential decline we saw in total ARR. As we plan for the remainder of 2026 and beyond, we see opportunities to optimize margins for these stand-alone non-platform solutions as we take steps to improve the alignment of our investment resources to our growing core platform solutions.

Returning now to other important metrics. Total revenue of $209.7 million declined 0.3% year-over-year. Within this, product revenue of $204 million was flat year-over-year and services revenue declined slightly. We finished the quarter with over 11,500 customers and an average ARR per customer of approximately $72,000.

Turning to first quarter profitability. Total non-GAAP gross margins of 72% were down approximately 280 basis points year-over-year, consistent with our expectations driven by improved staffing in our global security operations centers. We reported non-GAAP operating income of $24.4 million or a margin of 11.7% favorable to our guidance. This upside to profitability drove non-GAAP earnings of $0.36 per diluted share. Free cash flow totaled $33.4 million in the first quarter, driven by strong collections.

From a balance sheet perspective, we ended the first quarter with $670 million in cash, cash equivalents and short-term investments. In addition to these resources, we have a $200 million undrawn revolver in place. Our cash and investment balances, undrawn credit facility and continued free cash flow generation give us confidence in our ability to settle our March 2027 convertible debt upon maturity as well as fund ongoing operations.

This brings us to second quarter 2026 guidance. We expect in the second quarter with ARR of approximately $820 million. And on a sequential basis, we expect in the ARR for our core platform solutions, D&R and Exposure Management will be approximately flat quarter-on-quarter, with an expected sequential ARR decline in our non-core stand-alone non-platform offerings. For the second quarter, we expect total revenue in the range of $207 million to $209 million or down approximately 2.9% to the midpoint on a year-on-year basis. Non-GAAP operating income is expected to be in the range of $24 million to $26 million or a margin of 12% at the midpoint. Non-GAAP earnings per diluted share are expected in the range of $0.33 to $0.36 on approximately 78.3 million fully diluted shares.

Updating our full year fiscal 2026 guidance, we expect total revenue in the range of $836 million to $842 million, a year-on-year decline of approximately 2.4% at the midpoint. We are raising non-GAAP operating income guidance to a range of $112 million to $118 million or a full year non-GAAP operating margin of 13.7% at the midpoint. As previously highlighted, the business exited 2025 with a higher expense run rate, reflecting 2025 investments across people, technology and our India global capability center. By closely managing ongoing investments, we expect non-GAAP operating margins to improve to the mid-teens as 2026 progresses, and we remain focused on continuing to improve operating margins in 2027.

Non-GAAP earnings per share are expected to be in the range of $1.52 to $1.60 per share on approximately 79.4 million fully diluted shares. We expect 2026 as free cash flow in the range of $125 million to $135 million for the full year, flat with prior year performance at the midpoint and a free cash flow margin of approximately 15.5%.

In conclusion, there is a tremendous opportunity for cybersecurity companies who can help their customers respond at the incredible pace of new vulnerabilities and increasing attacks. Rapid7's core platform offerings of Detection and Response and Exposure Management are uniquely positioned to help companies navigate these threats, which we believe presents a long-term growth opportunity for our business.

And with that, I'd like to turn the call over to the operator for Q&A.

[Operator Instructions] Our first question comes from Michael Cikos with Needham.

Can you hear me okay?

Yes, we can hear you just fine.

Terrific. So I just wanted to start out with the guidance we have here for the ARR and thanks for splitting out the core versus the non-core. Could you help us think about that core ARR business? Where are we specifically with the exposure management and helping that business start to see growth versus some of the headwinds we've seen in recent quarters.

Yes. I mean, Rafe and I can tag team it. So our exposure management, we're happy that we're seeing the stabilization. I would not say that it is a growth driver, just to be clear. It's not -- but we're seeing a stabilization and improvements that we would expect, and we see good leading indicators of that business is sort of like set up to improve, but it's nothing that we can claim sort of success or improvement on. We're still working with the upgrade cycle and the noise environment. We are optimistic that the backdrop of what's happening in AI gets customers refocused back on the need to actually take Exposure Management, seriously as a priority because there was lots of noise before about all the things people can focus on. And we're certainly heartened by the early conversations, but that's not something that we will translate directly into a forecast or guidance at this stage.

Understood. And for the follow-up here, again, I know we're navigating the core versus non-core ARR components. If I'm just looking at the guide we have here on the ARR for Q2, and I know you guys are only guiding a quarter out at this point. it is less than what consensus had been thinking about here? And I'm just looking to see, can you give us a flavor for what the shape of the rest of the year looks like? Are any other things we should be mindful of as we navigate the next couple of quarters since we are only getting that ARR data point from a guidance standpoint on a quarterly basis.

Well, we're only guiding the current quarter right now. And as Rafe says, we're getting a firm, we want to make sure that we have the transparency as we go through it. The one thing I'll comment on is, clearly, in the first half of the year, we're seeing the non-core, which I talked about other before, decelerating off at a faster way. Our core is still a net positive contributor.

As that plays out, we'll see how that plays out and whether we see the acceleration in exposure the impact of D&R. But I would just say, just to give you revenue guidance, we feel very good about that. We have a lot of confidence in all the measures that we actually got on, but we'll keep you updated as we actually go along, but we're not going any further breakout right now.

Our next question comes from Matthew Hedberg with RBC.

This is Mike Richard on for Matt. It made a ton of sense when you were talking about the changes with Mythos and the other frontier models and how that can act as a tailwind for Rapid7. But I was wondering about how these changes are impacting customers. Is there a confusion in the market around frontier models and vulnerability discovery and what that means versus exposure management? Or do they sort of get it? Just any details you guys can provide on what the customers are thinking right now?

Mike, it's a great question. So one, I think there's probably more confusion with investors than there are with security experts, which we understand which is what I wanted to clarify in my prepared remarks. Most customers look there's two class of things that are going on is customers are having expertise on staff and they're expecting a lot more sort of like scale of vulnerabilities and confusion. And what we're hearing from them is the need to really focus on exploitability, understanding what's on the environment. Focus on understanding reachability, what's happening and then remediation organization management at scale which requires to understand the attack [ surface ]. These are all things that we're focused on.

And frankly, though, we are accelerating our own efforts to make sure that we make it easier for customers to understand what are the vulnerabilities that matters most, because what you're seeing is a lot of real bins, a lot of noise. And what we want to make sure is that like as things served for customers, they are remediating and addressing the most important things first as quickly as possible. And that's the stance we're taking there.

And what we've seen so far with customers is that those that are in the know, they understand that they're focused on it and they're asking us, how can you help me actually manage the complexity. I'm going to have a lot more to manage There'll be a lot more real stuff that I actually have to address, but there's going to be a lot more noise too.

Now there's -- I would say a lot of customers that are less mature in their cycle, and the word vulnerability is vulnerability. But again, I actually think that what you'll see often in security is that the knowledge does get out there, they will have to respond. They won't be able to remediate everything that's in place all at once. And so they, too, will actually have to understand it.

I think the tricky part for investors is vulnerability, whether you do discovery or scanning or vulnerabilities [ and codes ], it all sounds the same. But they're very different, like [ code ] level vulnerabilities are very different than the vulnerability management, which is very different than exposure management. exposure management is about addressing the things that are actually exploitable and the vulnerabilities that actually lead to compromise and doing [ it ] at scale across the environment. So there's differences, but use the word vulnerability, definitely can cause some nuancing infusion.

That's super helpful. Yes, that's super helpful. And just as a quick follow-up, maybe just taking a step back from a macro perspective. Are you seeing any change in customer behavior as it relates to maybe geopolitical uncertainty or even just AI budget crowding out as we've heard of more and more enterprises sort of running up on their AI budgets and not impacting other areas of enterprise software spend.

Yes. I mean look, I actually think everyone is trying to figure out what's the right way to budget and plan for it. That is an obvious thing that -- I don't know an organization all over the world is not trying to figure out like what's the right AI strategy? How do I budget for it? How do I plan for it? And how do I deal with the leapfrogging that happens from time to time? But I would just say [ universally ], to be clear, this is a year where more than ever we're seeing regardless of what the domain is, customers are looking for how do I actually start showing real benefits and little outcomes for the technology. It's moving from pilots to delivery.

And this is the thing that actually makes you excited about the investments that we've made organically and with Kenzo is that customers are in this [ show-me ] stage, and they're looking for how can you actually help me scale. And in our case, is how do we help them scale their secure operations because I hardly know any customers that are getting a lot more people allocated to the teams, and so they're looking for technology and services to scale their security operations, and that's where we're focused. Thanks again for your questions.

Our next question comes from Joe Gallo with Jefferies.

I just want to ask one high level one and one explicit about 2Q. So a high level, you guys are investing in areas of growth, MDR, go-to-market, integrating AI, how should we think about the trade-off between stabilizing ARR growth and maintaining gross margins going forward? Any guardrails that we can think through?

Rafe and I can tag team this. Our team has a very clear mandate is that we have to scale margins over time. And we feel that we have the right setup for that. If you think about our MDR business, which is our fastest on business that also historically has had, frankly, less contribution margins at scale than some of the other businesses, that also is a business that we expect the gross margins to expand. That was a big part of the Kenzo [ thesis ] is that we can deliver better service and better efficiency and better cost leverage. So we're quite excited by that, we can deliver our customers a better experience and do it more efficiently, which is good for our investors too.

And so just to be clear, as both myself and the management team have a mandate that we have to actually expand margins over time. But we are willing to make tactical investments to make sure we're going in the right way. It was absolutely the right thing to do this year as we saw the tsunami of cyber risk coming in to customers to make sure that we were properly staffed in our MDR environment to manage that and respond to that and make sure we're delivering a great quality of service. which leads to long-term retention and expansion. We know that we can actually do more AI and automation to actually do some of those SOC services over time. But we feel very, very good that we made the right decisions to make sure that customers are set up well, but we are managing the business to expand margins over time.

And I would just call out, as we mentioned in our remarks, we do continue to expect to see bottom line margins improving as we go across 2026. And we're very actively -- when we do planning, we roll it out and look at it at those carryforward numbers to make sure we're very conscious of run rates going into the next year. So I think we talked about -- in 2025, we saw some investment, and we knew that would impact year-over-year comparisons as we go through the first part of the year. But you'll start to see the benefits of that and see those improving margins even here in 2026 as we move to the back half of the year.

Okay. No, that's very clear and really helpful. Maybe just a follow-up on -- I just want to understand exactly what our takeaway should be with your 2Q ARR guide, right? So 1Q declined $8 million quarter-over-quarter, you're guiding to another decline of $12 million. So I'm just trying to understand like, is that 20% of the non-platform business? Is that churn getting worse? Is it lower expected new business for the 80% of the business that's growing. We're 1 month into 2Q. So I'm just kind of curious what you're seeing in 2Q that kind of indicates that new ARR might be a little bit worse than you saw in 1Q?

Yes, I would just say, look, in 1Q, even though we're not actively -- even though we expect other or the non-core to actually turn and it's not a quarter -- in focus, it's not quarter investment. When we see acceleration, we take a more cautious outlook about what that does. We definitely saw acceleration. We're not adding new. So it's really just churn, just to be clear, and that's of the stand-alone non-core businesses. We saw acceleration then in Q1, and we are taking an appropriately I think, thoughtful viewpoint of that as we actually go into Q2. And we also just want to predict that we're going to overcompensate for that by acceleration of core. And so that's the primary driver, and that's the primary takeaway that I have now. I think that's far I can give the comment here.

Yes. And I think that's exactly right. We want to share that color on what's exactly going on there because it's really important for everyone to see that are where our core business is, how it's been growing and have that clarity because that's really going to be the long-term future for the organization. And those products will be the ones that we're taking to customers on a regular basis. So we hope by breaking that out, that again illuminates exactly what's going on.

Next question is from Adam Tindle with Raymond James.

Okay. I just wanted to continue on the topic of core versus non-core. And if I was to rewind back, Corey, I know the strategy was to really create a lot of synergy between the platform historically. So I guess as we fast forward to today and having one piece of the business that's understandably kind of non-regrettable churn or in decline, how are you managing the impact on core while non-core churns, meaning, I imagine there's some customer overlap. Why would churn in the non-core piece, potentially not impact core? What are you doing to mitigate that potential risk?

No, it's exactly the right question. Look, when you -- wherever you have dynamics and just to remind you, like non-core is things that are on the lower on the priority list, but it's also stand-alone business, some of the legacy stuff there. You hit the nail. You hit the core point, is that, as you manage these things, you know what we have to do well. We have to nail how we help customers gather security operations and the core of that is the preemptive platform with Exposure Management and Detection and Response and how we weave that together.

Now as you said, there is a subset -- not all the customers are overlapping, just to be clear. We have a healthy amount of stand-alone customers. But for customers that are overlapping, their experience matters deeply. And so our teams are actively working to make sure that we deliver those customers the right experience. But also in the world of rapid innovation at the pace of AI, we're rapidly rolling out new services that are adjusted their need and we're expanding their scoping their experience with them. If you look at some of the announcements that we've been making, we've been picking up our pace of innovation and our pace of things that were actually communicated to the market.

And frankly, our pace of what we're actually providing customers as part of their existing subscriptions. And our view is if we do that well and we keep delivering on that, we're actually adding more strategic value in areas that matter more and therefore, we can actually really continue to focus in on those areas. But as you know, these type of transitions have to be managed well and it's something that we're focused on to right now.

Yes. Rafe, maybe just a quick follow-up. You talked about, obviously, silver lining here has been profitability. And I think you mentioned mid-teens operating margin in fiscal '26 and through in that you expect to continue to improve in fiscal '27? Understandable that obviously not providing official guidance on '27, but that's helpful to give us a sense of trajectory of the business.

I guess as you think about that, it's uncommon that we see platforms that are undergoing growth pressure that are still able to scale and not experience that lack of leverage on the downside. What are the drivers in terms of your confidence in margins in mid-teens and continue to improve in fiscal '27? And any parameters that you'd like to set just so we can understand what continued to improve in fiscal '27 might mean?

Sure. I think what's given us confidence as we go through '26, is like, first of all, you'll recall that there was a great deal of investments across people and technology last year, opening up the India center. All of those things happened in 2025. So especially in the early parts of the year, the year-over-year comparisons, [indiscernible] burnt of that cost uptick. But a lot of that work was in place to help build efficiencies in our organization, giving us locations where we can give great productivity at an affordable rate. It's extremely helpful. Having SOCs that are around the world on a global basis, extremely important to our customers, but also important to our efficient operation. So as we get people ramped up and get that part of the business locked in, that's what really is offering some efficiencies for us.

And we're also being very careful in 2026 about cost management and just across the board, we're making we want to deliver on that commitment we've made about our margins. And so we're being quite cautious about where we spend. And some of this plays out really is when we start talking about core versus non-core, being really clear about where we should invest because we think that will drive long-term growth versus where we need to be more moderate in how we manage those costs. So all of that coming together is giving us what we're planning for 2026 and giving us confidence is we really look -- need to be looking at those run rates as we leave this year into next.

Next question comes from Jonathan Ho with William Blair.

I just wanted to maybe dig a little bit into sort of this emergence to the Mythos models, like how do we think about the broader opportunity set around MDR and CTEM evolving with that AI landscape. And just your product specifically maybe you need to change to address sort of the emerging landscape.

Yes. So let's just -- and if you could mute your phone, please. Great question, Jonathan. So I think that you have to first understand what's changing for customers in order to understand frankly, what the work that we're doing that's valuable and the work that we need to do different, I think that's a very good question, Jonathan.

So the first thing was changing for customers. Customer [indiscernible] of 0 days. They want to see a much larger volume of vulnerabilities. They're going to see more exploitable vulnerabilities, but the amount of vulnerabilities that they want to see are not all going to be exploitable. So the ability to actually figure out what really manage is going to [indiscernible]. The ability to actually manage remediation at scale entire conference. If you could do remediation, in months before they figure out which stuff matters and manage the remediation in days as appropriate matters and the things that should be weeks and [indiscernible], we have a massive remediation backlog overall.

The pace of what you're looking at is being able to exploit vulnerabilities at speed and pace, dwell time is actually shrinking. So what you're going to see is people are going to have to go from detection quickly to actually active response. That's another significant change overall. And so when you put the picture together, customers are going to be dealing with both, the speed, the scale and the need to respond quickly without breaking things.

So what does that actually go? So let's just break down a couple of things. So one, Rapid7 has had a long history of focusing on exploitability, and our security researchers are accelerating and moving our models and upgrading those to actually deal with the increasing insertion that we expect and the speed to actually really discern what's explorable from what's not exploitable.

The second thing is we actually -- as we built out our overall Exposure Management framework, we believe that vulnerabilities are not the core thing that matter in themselves. It's the intersection of vulnerabilities, how devices and networks and technology is configured, as well as the controls at environment. After all, that's what exploitability is. It's the reachability, combined what controls are in place, what's configuration, combined with what's vulnerable. We understand that better than most organizations in the world.

And then the last piece that we just invested in is Kenzo, which is actually [indiscernible]. So the things that we're changing from there is we're upping the visibility and the understanding and the ability to quickly process what's exported in the environment. We're accelerating the investments in our remediation management to help customers track and manage remediation across the environment we were already bringing forth the Kenzo for actually instantaneous detection, but we're also investing heavily in leveraging our understanding of both the configuration surface and the control surface to actually help customers understand what the best interdiction or immediate intervention options they have to contain attacks, because they will have to respond in the moment and sometimes the 4 mediation is not available.

I know there was a lot out of it. Those are the things that are changing for the customer, the things that we're investing in, and frankly, the things that we're accelerating and changing in our environment, in our technology segment.

Our next question is from Eric Heath with KeyBanc.

All right. Maybe one Corey, one for Rafe, if I may. So, Corey, I mean lasting as been out for about a month and it feels like there's a lot of urgency out there. So just curious what impact you've seen thus far in 2Q in the pipeline. And then for Rafe, I very much appreciate the color on the platform growth and the guidance. But any specificity you can give on how net new ARR 1Q was for core platform? And then just how we should think about maybe the exit rate for the non-core platform products as we exit 2026. .

Yes. I mean, I'll hit it before Rafe actually hit on part before. With last in, I think there's two things. There's a small cohort of our customers who have actually seen it in access and they want insights into how we help them deal with the true exploitable ones and also the volume and the noise. And that's very straightforward. And that feedback and that engagement with customers is driving some of the strategies that I talked about earlier.

And then there's those that are on the outside and trying to figure it out. And frankly, they're looking for a perspective about how much does this change their technology strategy? Do they have to put all new projects on hold and just do remediation for the next 6 months. And if so, what type of remediation. So I think they're a assessing mindset, just to be clear, and that's why we're still in the early days because lots of organizations don't know what the magnitude of the impact is specifically for them.

Yes. And then just to add a bit more color on the first quarter. I would say, first of all, we were really pleased with the sales organization and their hard work in Q1. You'll recall that -- we had a new leader, Alan joined late last year. He made a few changes on the team even in -- even as we started this quarter, and yet the team really executed well, very much hustled, and we saw an uptick in productivity across the quarter. We saw just good execution on a lot of operational details that are just really important to running a sales organization. So I think hats off to the sales team on delivering good results there.

And that translates into our core platform solutions where you saw, first of all, within core, the Detection and Response business, which is now 55% of total ARR, and I think that's a little bit more color than we've shared in some of the past quarters on that. Growing at 7% on a year-over-year basis. So that's new net of any churn we had in the quarter. So that's a really strong leader. And that, combined with Exposure Management solutions, which rounds out the core solution, that total group was growing at 2%. So good execution on the top line, good work from the product team, helping our customers and just execution all around make sure that, that core numbers were growing in the first quarter.

The next question is from Shrenik Kothari with Baird.

So just a follow-up to Jonathan's question and Corey, thanks a lot for the color the [indiscernible], the value or shifting or reshift towards remediation and scale and the exposure validation. That makes total sense. Just in terms of monetization opportunity and timing wise, just wanted to get your thoughts in practice. Like how do you think that, that shows up in this post frontier model world? And terms of MDR in terms of the urgency for exposure command upgrades in terms of run time validation and just a broader platform. And then I have a quick follow-up.

Yes. Look, our current plans, it is a -- it's not even a single, probably a double user base [indiscernible]. Just to actually get a catalyst to actually help move the priority of exposure management back to the forefront, which actually helps significantly with the VM upgrade initiatives and focus. So that's our focus. We're not looking to actually charge incrementally for it. We think we actually have a modernization plan that's already attached to it. And so seeing the VM to Exposure Command acceleration in the Upgrade program is where we plan to primarily see the monetization. And again, we're accelerating some things in line with our strategy. We'll refocus and tightening, but we were on this path about how you actually manage remediation at scale, how do you actually really assess exposures from both a control and a configuration standpoint. And then the last thing you had to do active [indiscernible] overall. So I would to say the focus hasn't changed. But from that perspective, we should see the monetization there.

On the MDR side, it's going to be interesting because I think the thing that I'm talking to most customers about is how do they -- if customers are getting comfortable, they know now that they will have to enable active response and do more automation and more AI-driven response across their portfolio, and they're getting comfortable with that. Our goal is to actually lead that discussion with Trust. That is an expansion area, that's an investment area. It's a potential monetization area, which is a little bit too early there. That's one of the biggest incremental areas out sales focus, that we're recalibrating resources for is how do we actually shift the active response to machine speed while ensuring that we can actually do that safety based on our knowledge of the overall tech surface and control surface and the continuation surface.

Very helpful. And just a follow-up, Rafe, you talked about, of course, prudence in the non-core guide and more confidence in the core platform growing. Just in terms of the go-to-market changes, there have been put in place [indiscernible] Corey mentioned productivity improving. Just can you unpack a little bit like what's happening in the plumbing. Like are you seeing -- just again, in your words, Corey, I mean, is there a healthier mix of more singles and doubles now? Is the child source pipeline become more efficient? Is there more better upgrade motion to like which funds are showing up?

Yes. I mean the big one is the rate [indiscernible]. Alan has really tightened in the focus on making sure that we're actually selling the core, which is, again, the D&R and exposure and the MDR platform integrated capability. So one thing is that when you actually have a strategy, you're not actually selling all over the place. So we actually have a tighter focus there. We're seeing tighter pipeline builds in those areas, and more focused, consistent execution.

Yes, and the biggest thing is that like as we set targets, we actually hit the targets. Now we all want to actually see acceleration and we want to see the growth go faster. But I will say that we actually have the confidence in the trends of how we're seeing the business performance starting to actually shift. We want everything to go faster, but we're seeing the confidence in the -- both the management and the visibility. That gives us a lot of confidence about like how we actually see the year standing now.

Next question is from Meta Marshall with Morgan Stanley.

This is Abhishek Murli on for Meta Marshall. Congrats on the quarter. I wanted to touch on Kenzo Security and kind of where that product sits in the road map in the context of AI-driven investigation. So can you kind of clarify what capabilities have already been incorporated into customer workflows versus like what kind of remains in development? And then should we think of it as more of an improving of productivity or a customer-facing remediation? And kind of just any further details on that.

What Kenzo is excellent is that -- both the data mentioned in their model was extraordinarily at doing investigations of scale. So it was an alert processing engine that allowed you to come in and process alerts from all over the environment. We're active to integrate [indiscernible] right now, just to be clear. So it's not like a derm integration. It's probably the biggest thing, and we all like, a, that has to happen fast and it has to go fast. So the team has come in. We're in the process of integrating in. We'll be rolling it out to customers starting in the next couple of months, we will roll it out to the rest of -- this year rolling out to the rest of this year. But that's the biggest thing. So if you say like what's the core of what Kenzo does. It is an AI platform for actually processing alerts and doing high-quality investigations at scale.

To add some context, specifically for investors and for people the call is that typically, what a SOC analyst who typically does this is they get an alert in and one, they have to make sure it's not deduplicated. I would to say over time, SIM's not doing a good job with this. D&R systems like Rapid7 did a good job with a deduplication. So we've already been making advances here. But then you have to go out and actually do all of the knowledge collection and contextualization to actually say, what's all the data I need to get at [indiscernible] actability out, whether this is real or false. And then what you actually have a sense of whether it was real, then you actually had to actually do another level of investigation to figure out like how bad it was in the environment and what you actually need to contain and remediate there.

That took days, just to be clear, hours and days. Kenzo is excellent at doing that a massive volume massive scale in machine speed. And so it's much faster, and it has better efficacy rates overall. So we're both taking it in, we're applying the model, and we're extending the model out. to actually hit not just alerts but a much wider range of data sources as we go forward. And then the other part that we're actually at in to Rapid7 is that because we have so much deep knowledge of the environment, is we have a much wider range of response options that are available.

Now again, that is new development effort that's happening to -- I don't want to get too far down the path. But customers do need to know how they can actually respond at speed and scale. Some of that is going to be used in our technology, some of that's going to be using third party technology. But we have the brains to know which type of controls and systems to leverage and scale, where that has existing controls, where they had some new start-ups that are actually in the space that actually make changes in the environment. We have that knowledge and that expertise to actually know what's the most efficient to apply at scale based on our knowledge of the environment.

Our next question is from Adam Borg with Stifel.

Awesome. I'll just stick to one. Maybe, Corey, you talked really, I think, at length in a good way about out of the frontier models are driving increased vulnerability identification, but that's really where the tailwinds begin for you. And I think you talked about customers understanding how these frontier models fit in and investors may be a little bit more confused on their role over time. And maybe just to that latter point, if you could help us understand like what's preventing these frontier models for moving just from identification of vulnerabilities more towards the exploitability, the reachability, the prioritization and the remediation that you talked about because they seem to be talking that they're moving in that direction. And any way you could talk about the moats that vendor like yourself has to prevent that from occurring would be really helpful.

Yes. So there's three different moats that matter. And I think -- just to be clear, I don't want to say versus the frontier model because we actually leverage frontier models inside of Rapid7. So anyone who's not leverage in frontier models is like just not going to be relevant.

So I want to be clear. This is about where they actually use cases and don't -- so that's more -- I want to frame that up and we -- there's a couple of things that are actually significant clear moats that actions do. One, it's just like if anyone's actually use frontier model to any environment at any scale, you actually know you have to actually discern what's the cost of the activity you're actually doing. So someone can actually go scan and do exploitability analysis in the environment and do all of that. But just to be clear, they're paying a lot more than what you actually get for the same information in the core vulnerability management system. They're not designed to do that.

Now could they build specialized thing and specialized software to actually do that? Potentially, yes. But again, you are -- then you're just building the product and you can actually say you're actually building the product and you have not. So but that's one, it's like cost does matter, and actually do it efficiently at scale and at cost as someone who's tested out some of these systems in the environment trust me, you can run a fair amount of money in what you think is a very straightforward scan. And by the way, that's proven out in their own data that they actually go. So I would just say we actually can't miss it.

The second thing that you have to say is that like it's not whether it's vulnerable, it's actually exploitable in the environment. And exploitability means you have to understand not just the vulnerability. You have to understand the configuration of the complete environment, and you have to understand the controls and the overall environment and how they intercept. Now you could make a technology to do anything, but that is actually specialized it's both knowledge and data that we've optimized around to understand the question about what's actually both exploitable, what's reachable and how is that configurable in the overall environment.

The last thing when you actually get to the core one about how do you actually want to actually take action and respond in the environment. And look, I have a high trust, but I don't think anyone wants a foot tier model in their environment, running rampant in the environment that can actually make configuration changes, do active defense, active response in the environment. For models that updated all the time without [ serious ] visibility and understand what can change and by many of the authors on admission is just like that's just not the way that most people are going to have the trust to actually deal with security.

So to get to the core names is that we have deep expertise to understand another domain. Yes, AI does a lot. By the way, it's an accelerant for us. The cost of doing these things at scale does matter to customers, and it will matter to the customers over time. And then when you think about the autonomous response, you both need the knowledge base, but you also need to trust. And this is why I say, like, we're building active response, but it's built on a system of trust and knowledge. And that's a big deal because you do not want your active response being too smart and being too clever, because if you get the keys, where these systems can take over and actually have access to make any type of change in the environment overall. You can have very minor errors that actually calls [indiscernible] for organizations.

And again, most CEOs and frankly, most IT people know that. And so they're looking for things that actually do the mission and do it well and do it cost effectively. I know that was long-winded, again, we're adopters of the technology, but it's important to understand that we like to be constrained there too.

Our last question comes from Gray Powell with BTIG.

Okay. Great. I just want to make sure, can you hear me?

Yes.

Yes.

All right. Excellent. I think you hit on this before. But I just want to circle back on sort of the non-core products and how we should think about that trend line stabilizing over the next 12 months? So just if I'm doing math correctly, ballpark terms, I would assume that non-core is maybe a little over $150 million in ARR. Q2 guidance implies that it's down about $10 million. Is there a level where that -- where we should think about that number stabilizing? And then they are existing customers. So like why is there not an opportunity to upsell them on the platform? Is there like a conversion opportunity there?

Yes. No, thank you for the question. I think the best way to think about what we're trying to do is build out robust platforms that are attractive to our customers. And I think a couple of things. First of all, some people -- some of our customers have platform offerings, but may have also bought something stand-alone that's out there, right? That is part of the equation.

And as Corey mentioned, like it's very important that we take care of these customers and that their whole experience with Rapid7 is very important. We do think there is also an opportunity for those who may not have a platform solution that the best thing for them is to migrate on to 1 of our platforms, right? And we're looking for technologies that we can integrate in and make that platform more rich. So that's really our #1 focus around those customers.

I wanted to break that out because this trend has actually been going on behind the scenes for some period of time for the last few quarters. of where you'll see those stand-alone non-core offerings, that's actually where we've had more of the challenges on the renewal front. But what we're really calling out here is we're focused -- we're building attractive platforms with robust technology, and that creates that upgrade path for many of our customers, but it also allows us to focus on meeting the demands of the market at present.

Thank you, everyone, for joining. This concludes today's call. You may now disconnect.

Good day, everyone. My name is [ Kehlani ], and I will be your conference operator today. At this time, I would like to welcome you to the Q4 2025 Rapid7 Earnings Call. [Operator Instructions] At this time, I would like to turn the call over to Matt Wells, Vice President of Investor Relations.

Thank you, operator, and good afternoon, everyone. We appreciate you joining us. Today, we will be discussing Rapid7's Fourth Quarter and Full Year Fiscal 2025 financial results. We've distributed our earnings press release over the wire, and it can be accessed on our Investor Relations website. With me on the call today are Corey Thomas, our CEO; and Rafe Brown, our CFO.

[Operator Instructions] Before I hand the call over to Corey, I want to note that certain statements made during this conference call may be considered forward-looking under federal securities laws. Such statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include our outlook for the first quarter and fiscal year 2026, any assumptions for fiscal periods beyond that period and our positioning, strategy, business plan, operational [Technical Difficulty] and growth drivers.

These forward-looking statements are based on our current expectations and beliefs and information currently available to us. While we believe any forward-looking statements we make are reasonable, actual results could differ materially due to a number of risks and uncertainties, including those contained in our filings with the SEC. Reported results should not be considered indicative of future performance.

We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events or otherwise, except to the extent required by applicable law. Further information on these forward-looking statements and risk factors are included in the filings we make with the SEC, including the section titled Cautionary Language concerning Forward-Looking Statements in our earnings press release.

Additionally, over the course of this call, we'll reference non-GAAP measures to describe our performance. Please review our earnings press release and filings we make with the SEC for a rationale behind the use of non-GAAP measures and for a full reconciliation of these GAAP to non-GAAP metrics. These documents, in addition to a replay of this call will be available on Rapid7's Investor Relations website. And with that, I'd like to turn the call over to Corey.

Thank you, Matt, and welcome to everyone joining us on the call today. I'm excited to be joined by Rafe Brown, our new CFO, who joined Rapid7 in early December. Rafe will offer some initial impressions on Rapid7 and the opportunities he sees in his prepared remarks. Rapid7 exited fiscal 2025, delivering outperformance against our Q4 ARR, revenue and profitability guidance. We ended 2025 with ARR of $840 million and total revenue of $860 million, both ahead of guidance.

In the Q4, we saw sustained new deal activity for our industry-leading MDR offering and encouraging growth within our Exposure Command platform. Throughout 2025 and more specifically during the second half of the year, we made strategic investments across key product growth initiatives to strengthen our position as a leader in AI-enabled security operations. We did all of this while continuing to generate significant cash flow, exiting 2025 with $136 million of operating income and $130 million of free cash flow.

These investments enhance our security offerings with AI and machine learning capabilities, consolidate customer environments on a unified platform with our managed AISOC and enable our team to scale operations globally. Additionally, we just concluded our sales kickoff with the broader go-to-market team. It was our most impactful SKO years and a great opportunity for Chief Commercial Officer, Allan Peters, and his team to outline their priorities to reenergize the Rapid7 growth engine.

We expect to see tangible benefits of this organizational change throughout 2026 as we develop muscle memory with these new processes. Before I turn to business updates, I want to take a moment to address the broader landscape because I think context matters for how investors evaluate our business. We are operating in a period of significant disruption across the software sector, driven by a fundamental reevaluation of what AI means for software businesses. I understand why investors are asking hard questions.

The rapid advancement of agentic AI capabilities has created real uncertainty about the durability of many software business models, particularly those built around per-seat pricing, thin workflow layers or point solutions that can be replicated or disintermediated. I want to be direct. Not all software businesses are positioned equally in this environment. And cybersecurity is fundamentally different. Let me explain why we believe Rapid7 is on the right side of this divide.

The security operations market is defined by 3 characteristics that make it structurally resilient and, in many ways, a direct beneficiary of the AI transformation happening across the enterprise. First, the threat environment is accelerating, not simplifying. AI is enabling attackers to move faster at greater scale and with more sophistication than ever before. This is not a theoretical risk. It's happening right now, and it's driving an urgent reevaluation of security postures across the enterprise.

The regulatory environment is simultaneously becoming more complex and more fragmented around the world. This combination means that the need for comprehensive expert-led security operations is growing, not shrinking. Second, security operations cannot be reduced to software alone.

Unlike categories where an AI agent can trigger an API call or bypass the user interface, effective security operations require the integration of broad telemetry, proprietary intelligence, real-world expertise and yes, human judgment, particularly during incidents where the stakes are the highest. This is a market where outcomes depend on the combination of technology and deep domain expertise, not one or the other. And third, our business model is anchored on outcomes and value delivered, not seats.

Our pricing is tied to the scope of environments that we protect and the outcomes that we deliver, which positions us well as the industry evolves towards outcome-based and usage-based models. This is the lens through which I ask you to evaluate Rapid7. We're not a wrapper of a generic model. We're not a point solution. We're a platform built on the broadest proprietary security data foundation in our market, continuously enhanced AI-driven productivity and innovation and delivered through deep services and technical expertise that customers depend on to navigate an increasingly complex world.

Now turning to the evolution of our business. The cybersecurity market is changing, and that presents us with phenomenal opportunity. AI-driven attacks are escalating in both pace and sophistication, stretching security teams thinner than ever. At the same time, regulatory requirements continue to expand and fragment globally from the EU's evolving framework to new compliance mandates across Asia Pacific and the growing patchwork of U.S. state-level requirements.

This is driving a reevaluation wave across enterprise security. And the winners in this market will be the vendors that can deliver on 3 things simultaneously. First, a broad proprietary data foundation that provides complete situational awareness across the attack surface, not just what you connect natively, but the ability to integrate, normalize and contextualize data from across a customer's entire environment.

With over 500 integrations, our Command platform provides the broadest data foundation in our market, and this data advantage compounds over time as we train our AI capabilities on real-world security operations data that no competitor can replicate. Second, AI-powered productivity and innovation that continuously improves the speed and accuracy of detection, prioritization and response.

Our expert-trained Agentic AI workflows are built on years of SOC expertise, trained in live playbooks and redefined through real-world analyst feedback. These are not generic models. They are purpose-built engines that improve outcomes in real time. And critically, we view AI innovation as a continuous engine, not a one-time product release. We're accelerating our pace of AI development and expect this to be a sustained differentiator.

And last, deep services and human expertise that help customers navigate complexity that software alone cannot address. With a decade of experience managing our own 24/7 global SOC and that of our customers, we have built an expertise layer that is essential, not optional for effective security operations. As attacks grow more sophisticated and regulations grow more complex, this expertise becomes even more valuable, not less. Our managed services don't just monitor.

The investigate, respond and remediate with the context and judgment that only experienced security professionals can provide. The convergence of these 3 elements: data, AI and expertise is what defines the durable security operations platform of the future, and this is precisely what we're building. The framework guiding our investment and innovation is underpinned by a shift from reactive to proactive security postures, combined with outcome-driven service offerings.

We are working to introduce more AI capabilities into our MDR and exposure offerings and evolving our platform to help customers get ahead of threats rather than simply respond. And throughout 2025 and particularly during the second half of the year, we made strategic investments across key product growth initiatives to accelerate our transformation into a leader in AI-enabled security operations, one that enables customers and organizations to take a preemptive posture towards security operations.

These investments augment our existing security offerings with AI and machine learning enhancements, consolidate customer security environments under a common UI and our leading managed AISOC and position our team to drive scale across our global footprint. In detection and response, we have a significant opportunity to continue leading with our MDR offering.

We made strategic investments to evolve, enhance and scale our solutions while building on our expertise as one of the only providers in the market with a decade of experience managing our own SOC. In 2025, we expanded our MDR coverage to enable management of third-party alerts in a vendor-agnostic fashion. We streamlined analyst workflows with our AISOC for MDR and Incident Command, and we started to expand our addressable market to larger enterprises by leveraging our AI-powered services.

We're also continuing to build on our partnership with Microsoft. Just last month, we launched closer integrations such as MDR for Microsoft that provides 24/7 expert monitoring and native response across the entire Microsoft Defender suite. This collaboration also extends to exposure management by unifying Microsoft telemetry with Rapid7's Command platform to proactively identify and close security gaps before they can be exploited.

In exposure management, our evolution is anchored around up leveling our Exposure Command platform with AI tools, native telemetry and open data integration, curated intelligence and automation to deliver a unified system for risk remediation. Differentiating features such as AI-generated vulnerability scoring and active risk scoring combine technical severity with real-world threat intelligence, enabling security teams to begin patching zero-day threats before competitors who typically wait for official industry scores.

Attack path analysis visualizes primary attack vectors and allows security teams to focus on patching critical vectors rather than low-risk issues. And our remediation hub provides a single destination for remediation across both exposure management and detection response, reducing mean time to detect, respond and remediate. When we combine our leading detection response and exposure management solutions with outcome-driven AI-enhanced service offerings, we address the core issues customers are facing in the market today.

And when we do this, we're playing offense. In this quarter alone, a leading offshore drilling company reselected Rapid7 as their SIEM provider of choice. After being unable to achieve business outcomes promised by a competitor, this return customer saw real benefits from the investments that we've made in our products over the last few years. Our ability to effectively deploy, coupled with the service level capabilities such as MTC and Vector Command made this 6-figure competitive win back stand out.

One of the largest sovereign tribal governments in the country became a Rapid7 customer after a competitive deal cycle and displacement in which we showcased the benefits of consolidation and the integration into our MTC offering. This high-6-figure deal underscores the unique value proposition we can offer, delivering service outcomes on top of leading technologies. A strategic MSSP provider selected Rapid7 as they continue to expand within the state, local and education vertical.

Our detection response solution provided the features and confidence they needed to deliver outcomes for their clients. We are consolidating a mix of competitive solutions and in-house monitoring onto the Rapid7 platform. These wins share a common thread. Customers are choosing Rapid7, not just for the technology, but for the combination of technology, data breadth and expert-led services that deliver measurable security outcomes. This is our differentiation and it's durable.

Turning to our go-to-market priorities. We're focused on operationalizing our strengths to accelerate growth. We just concluded our sales kickoff with the broader go-to-market leadership team, and it was our most impactful in years. Allan, having completed his leadership team build-out has crystallized his vision of a unified market approach across global sales, marketing, partners, customer success, and sales operations.

With new leaders and plans in place, the team is executing a more focused sales motion with tighter alignment between marketing and sales to improve demand quality and conversion and a refined customer success strategy designed to improve retention. Refreshed incentive structures are better aligned to drive net-new growth, renewals and cross-sell. These initiatives are still early-stage, and our growth flywheel will take time to build momentum.

However, the groundwork is in place to improve execution and drive sustained performance across product, marketing and go-to-market and become a share taker over the medium term. In detection and response, ARR growth of 7% was driven by MDR ARR growth in the high-single digits. As we drive product transformation to deliver increased value through our AI-enhanced SOC, we are positioning to take share as the MDR market evolves.

We believe this market has significant runway and the combination of AI-driven efficiency with deep human expertise creates a compelling and defensible offering that is difficult to replicate. In exposure management, we're focused on simplifying the migration of our core vulnerability management base to our Exposure Command platform.

By removing friction from the upgrade engine, we are helping our core VM customers migrate to a unified AI-powered view of the attack surface, a move that replaces fragmented tools with integrated contextualized risk visibility. I want to spend a moment on how we're thinking about growth because this is where the AI transformation of our industry creates real opportunity for Rapid7, and I want to be transparent about the work underway.

We're actively pursuing 3 parallel initiatives that we believe will drive both near-term efficiency and medium-term growth acceleration. First, we're shifting significant portions of our operational services work to our AI layer and redeploying our expert talents towards higher-value customer engagement. Today, many of the repetitive pattern-based tasks within our SOC operations, alert triage, initial investigations and enrichment are being systematically transitioned to our agentic AI workflows.

This is not about reducing our commitment to service. It's about freeing our experienced security professionals to focus on what they do best, helping customers navigate an increasingly complex threat and regulatory environment, providing strategic guidance during incidents and delivering the kind of expert judgment that no AI model can replace. The result is better outcomes for customers, improved unit economics for Rapid7 and a services model that scales more efficiently as we grow.

Second, we're strategically redefining our portfolio of solutions. By proactively integrating advanced AI models into our core offerings, we're ensuring our solutions remain at the cutting edge of efficiency and performance. Rather than maintaining the status quo, we're choosing to prioritize innovation over legacy, making the deliberate decision to shift resources towards high-growth, future-ready product areas.

We believe this is the right trade-off, accepting near-term headwinds in parts of the portfolio that face structural pressure while concentrating our investment and energy on the areas where we have a clear differentiation and durable growth potential. Third and most importantly, our core growth engine is the extension of our AI-enhanced services layer. This is where we see the most durable opportunity.

Customers need a partner who can bridge the gap between the rapid pace of technology change and the operational reality of securing complex distributed environments under growing regulatory pressure. Our ability to deliver AI-driven efficiency alongside expert-led services integrated on a single platform with the broadest proprietary data foundation in the market is what sets us apart and what we believe will drive share gains over the medium term.

At the core, our growth will come from extending this AI services layer, delivering AI to help our customers keep pace with technology changes, paired with the expertise to navigate a complex and rapidly evolving security landscape. Our anticipation is that the investments we made last year will begin to yield dividends in our AI orientation this year.

But just as importantly, we're fundamentally transforming and upgrading our engagement models this year to ensure that both our business and our customers are resilient in the face of regulatory and the threat environment we face today. In closing, I want to leave you with this perspective.

The increasing pace and sophistication of attacks is driving a meaningful shift in how security budgets are allocated. Customers are looking for vendors who can deliver measurable business outcomes, not just technology, but a combination of data, AI innovation and expert services that actually make their organizations more secure. We believe this plays directly into Rapid7's strengths.

Our business is built on proprietary data that becomes more valuable as we scale AI capabilities that continuously improve through real-world operations and a services layer that builds lasting trust and partnerships with security teams. This combination, data, AI and expertise is the foundation of a durable cybersecurity business and is what differentiates us in a market that is increasingly skeptical of software-only approaches.

Rapid7 is investing across our platform to deliver security operations that give customers the ability to stay ahead of attackers. Our long-term strategy of integrating exposure management with detection and response is proven to be where the market is heading. Our Command platform data mesh integrates more complete security data, including third-party sources into our AI engine for true scale and efficacy.

And our services layer allows us to build lasting trust and partnerships with security teams, supporting them where they need us most. We are confident in this strategy. We're moving with urgency, evidenced by our recent leadership additions and organizational changes to improve our execution and capitalize on the significant opportunity in front of us. I look forward to sharing incremental progress throughout the year. I'd now like to pass the call to Rafe to discuss our financial results and guidance in more detail.

Thank you, Corey, and good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers, except revenue and balance sheet items mentioned during my remarks today are non-GAAP. I want to begin by sharing how happy I am to have joined Rapid7. This is a great company, doing incredible work to protect its customers around the world. And moreover, I believe there is tremendous opportunity to build shareholder value in the coming years.

In this fourth quarter earnings call, I'm pleased to report that we exceeded our guidance across revenue, annual recurring revenue, ARR, and operating income. For the quarter, we generated total revenue of $217.4 million, growing 0.5% year-over-year. This brings us to a total of $859.8 million of revenue for the full year 2025, growing 1.9% year-over-year. For the quarter, we recorded product revenue of $209.1 million, growing at 1.4% on a year-over-year basis.

Professional services revenue for the quarter totaled $8.2 million compared to $9.9 million in the fourth quarter of 2024. Our year-over-year results reflect an intended shift in our operating model toward greater utilization of our partners for professional service delivery, allowing Rapid7 to remain focused on its core offerings. Our ending ARR of $839.9 million was approximately flat year-over-year as the business digests a mix shift towards our faster-growing detection and response business, which currently constitutes just over 50% of our ending ARR.

On a year-on-year ARR basis, our D&R business grew at approximately 7% in total with the MD&R portion of the business growing in the high-single digits. We continue to believe that the managed detection and response market is a significant opportunity for us, and we are focused on unlocking the value in this market with our AI-enabled approach to preemptive security.

Within our exposure management business, there are encouraging signs that our investments in modernizing and upgrading our offerings are taking hold. For example, our Exposure Command offering saw rapid adoption in Q4 by both new and existing customers. Turning now to profitability. Our Q4 non-GAAP operating income of $30.1 million or a margin of 13.9% was incrementally ahead of expectations.

The sequential downtick in margin reflects the continued ramp of 2025 investments discussed in prior earnings calls across our global capacity center in India, our go-to-market teams, product teams and new organizational leadership. It is worth noting that we will carry this higher Q4 expense base into 2026. However, as the investments take hold and the efficiencies they bring materialize, we expect operating margins to expand as 2026 progresses.

I will provide more context in the moment when we discuss our 2026 guidance. For the fourth quarter, we posted non-GAAP earnings of $0.44 per diluted share at the high end of our guidance range. For the full year, we delivered non-GAAP operating income of $135.7 million or an operating margin of 15.8% and drove non-GAAP earnings of $2.08 per diluted share. Our fourth quarter free cash flow was $32.3 million, bringing us to a total of $130 million of free cash flow for the full year 2025.

We finished the year with over 11,500 customers with an average ARR per customer of approximately $72,000. From a balance sheet perspective, we ended 2025 with over $659 million in cash, cash equivalents and government securities. In addition to these resources, we have a $200 million undrawn revolver in place.

Thus, our balance sheet position, strong free cash flow from operations and available undrawn credit capacity gives us confidence in our ability to settle our March of 2027 convertible debt upon maturity. Before we turn to our 2026 guidance, I would like to share some initial observations. It has been an energizing first 2 months with Rapid7. The security market is in the midst of a dramatic change.

Likewise, Corey and the leadership team are focused on taking Rapid7 to new levels, ensuring we meet our customers' increasing demands for excellence as we protect their businesses from an ever more dangerous threat environment. As such, Rapid7 is well positioned to take advantage of a growing market opportunity. Within the company, there are a number of areas where we must continue to improve, both in terms of focus and execution.

In addition to the go-to-market efforts Allan is spearheading and which Corey discussed, we have the opportunity to improve our focus across our portfolio of offerings and in particular, to prioritize investments in the products and revenue streams that are core to our future.

In my role as CFO, I'm focused on the following key objectives: improving financial forecasting, driving measurement and accountability across the organization, focusing and shifting our resources to align with our core products and growth strategy, expanding non-GAAP operating margins as we move across 2026 and into 2027 and focusing on free cash flow as a core operating metric across the organization.

As we turn to guidance, I would like to begin by sharing that we have been refining our financial projection models over my first few weeks with the company. Our philosophy for providing guidance works to ensure transparency with investors while setting realistic meetable expectations for company performance. I would like to note that while we continue to provide full year revenue guidance for 2026, we have decided at this time to not give full year ARR guidance.

While we have a clear view of current trends across our business, we have several new leaders in place, and we are implementing key improvement initiatives across sales, marketing and our customer success and support organizations. As such, we believe visibility into ARR is best reflected on a quarterly basis at this time. This brings us to our first quarter 2026 guidance. In the first quarter, we expect ARR of approximately $830 million or down 1% on a year-over-year basis.

While we are optimistic about the leadership changes and strategy that have been implemented in our go-to-market organization, we do not anticipate the benefits of these changes will impact Q1. The total first quarter revenue is expected in the range of $207 million to $209 million or down 1% year-over-year at the midpoint. We expect non-GAAP first quarter operating income in the range of $19 million to $21 million or non-GAAP operating margin of 9.6% at the midpoint.

As previously mentioned, margins in Q1 will be pressured by higher expense envelope entering the year in addition to seasonal expenses such as our global sales kickoff. Non-GAAP earnings per share is expected in the range of $0.29 to $0.32 per share on approximately 77 million fully diluted shares. Turning to full year 2026 guidance. In fiscal '26, we expect total revenue in the range of $835 million to $843 million or a decline of 2% year-on-year at the midpoint.

Non-GAAP operating income is expected to be in the range of $108 million to $116 million or a non-GAAP operating income margin of 13.3% at the midpoint. As stated earlier, we made a number of investments during the second half of 2025. As we move into the second half of '26, we expect these investments will yield improvements in the efficiency and operation of our business, moving our non-GAAP operating margins into the mid-teens.

Non-GAAP earnings per share is expected in the range of $1.50 to $1.60 per share on approximately 78 million fully diluted shares. Free cash flow for the year is expected in the range of $125 million to $135 million, flat with prior-year performance at the midpoint and a margin of approximately 15.5%.

As a reminder, the company is focused on free cash flow as a core KPI in 2026. Please refer to our earnings release and SEC filings for any additional details regarding the presentation of our results and guidance metrics. And with that, I'd like to turn it over to the operator for Q&A.

[Operator Instructions] Your first question comes from the line of Meta Marshall with Morgan Stanley.

Great. I appreciate the question. I guess just in terms of some of the changes that you were mentioning in terms of tighter marketing and sales, refined customer success, refreshed incentives. Just how would you measure or kind of expect where some of those changes should be seen first? And kind of what milestones are you holding yourselves to see evidence of those changes?

Yes, great question. Look, I think there's a number of different areas. But I think one of them, we're looking at sort of increased sales and marketing productivity and efficacy. We think we can actually grow faster while doing it more efficiently. That's a clear-cut one that actually stands out, and we think that's pretty opportunity. And that aligns across, frankly, product and marketing and the go-to-market teams and the overall engagement.

Specifically, when you think about the customer side of the house, look, one of the bigger opportunities we have is customers are frankly looking for more services, more customization, more depth, not less. And so scaling that leveraging both technology but also people and the expertise is a big focus area for us so that we're actually able to do more work at greater levels for our customers while still, frankly, maintaining or improving our gross margin profile.

That's one of our bigger pieces of investment and focus we've had over the last year. Customers have not been looking for less services, less engagement. They've been looking for partners who can do more with less, and that requires both technology and some of the people, talent and expertise.

Your next question comes from the line of Jonathan Ho with William Blair.

Okay. Perfect. So I just wanted to understand in terms of the segments of the market that you're prioritizing, can you talk a little bit about what you see as sort of the core growth businesses going forward? And what are some of the changes or areas of focus that you can implement to sort of drive that acceleration?

Yes. Look, I think our biggest growth area is still going to be detection response, which is still growing. We think it has capacity to grow faster. That said, as you think about like our core addressable market is that midsize or mainstream enterprise. Think about like employees from -- organizations have employees from 1,000 to 20,000 employees. For there, we're focused heavily on making sure we can provide the depth and quality of the service experience.

We think we're only addressing part of the total addressable market there. So our big focus right now is unlocking the full addressable market. Now that said, lots of the competitors we have are especially a private are actually doing at lower total gross margins, and we're very focused on delivering quality service and quality experience at the right gross margin profile. So that's the first one is that detection and response market, which does include AI services.

But exposure management is an important part of the puzzle there. And so I would just say that's another core focus area. We do think about that being an integrated part of the stack, not a stand-alone focus. And so if you think about where our focus is, it's about how do we actually bring together security operations that bring together exposure management and detection response.

So we think about that flowing into a single integrated offering. Some of the things that we're less focused on are some of the legacy on-prem, which -- much of which has been upgraded to our Command platform, but we're still working through the upgrade of those technologies and capabilities to the Command platform.

When you look at the core market that we're focusing on, it's that mainstream enterprise that is, frankly, our historical base. We have, I would just say, moved slightly out of that over time. And I think one of the things that Allan and the team are bringing back in is a tight focus on our core customer and our core customer profile, which we think is a good thing for both acceleration and win rates.

Got it. And then just -- yes. Just as a quick follow-up. So when we take a look at your decision to not offer the full year ARR guidance, can you maybe walk through the rationale for that? And what maybe has to happen for that visibility for you to be comfortable to bring that back?

Yes, thanks, Jonathan. As my prepared remarks mentioned, first and foremost, we thought it's really important to put out guidance that is meetable and clear to align everyone. And so that's why we have confidence in the near-term ARR guidance. For the longer term, we felt that revenue was the best metric for the current time. And this is largely because of all of these changes that are underway in our business across whether it's the sales organization, marketing, customer success and support.

And so the total of all of those factors coming together that led us to this decision. There's a number of us that are new, including myself in the organization. As we see the trends establishing themselves as we see these investments begin to bear fruit, we will reconsider given full year ARR at that time.

Yes. I would just say we -- look, this is not a moment where we can be slow. And so we decided that we had to actually move fast, but what we didn't want to do was attempt to be overly precise when we actually have a new team that's actually coming in driving execution fast. We're holding ourselves accountable for driving improvement, both in growth and in cost structure as we go across the year.

The cost structure is a little bit easier to focus on, especially when you look at free cash flow. I would just say the growth piece of it that because of the last couple of years, we were just really focused on actually just starting out with where we have clarity. And then as we actually show the improvements, we'll update you, of course. And then as the new folks that are on board get situated in place, my expectation is we'll be able to continue to provide commentary and visibility.

Next question comes from Rob Owens with Piper Sandler.

I guess I'll pick on the guide a little bit, too, and I can appreciate that there's a tremendous amount of uncertainty, both with the changes that are going on within Rapid7 that you talked about, Corey, but also just where the market is. But the Q1 ARR guide does lend to significantly more churn, I think, than you've probably been seeing. And so I would just love a time frame.

And I realize it's hard to commit to an ARR number given all the moving parts right now. But when would you hope that some of these investments that you've put in place will start to bear fruit and you can see some stabilization in that number? And I know that historically, you do see some seasonal weakness here in the first quarter, but obviously, you're giving us accelerated churn in the numbers here. So I appreciate the thoughts.

No, it's a very fair question. Look, I think part of what you see, I think you're referring to both the net ARR, which sort of indicates that churn is growing faster than the new. What you see there is that, look, we clearly -- if you look at D&R, it is a positive contributor in the environment. We need that to grow faster, frankly. There are some aspects of the business that we've broken down before in the other category that are negative. We've had pressure on parts of the traditional VM business.

We need the D&R business to grow faster. The biggest thing that we're actually doing on that is we're actually focused on the growth being in line with our gross margin expectations, and we're taking a fairly disciplined approach to that, which means that we have to be gated somewhat still, even though we're starting to take in and increase our addressable part of our TAM. We are unlocking that now.

So we started unlocking that late last year. And we expect that to improve over the course of the year and for that to actually flatten out. The exposure management piece, we are in the middle of upgrade cycle. What I would just say is we saw good unit trends existing in Q4. We were very slow last year overall, but we did not want to straight-line some improvement that we saw in Q4 throughout the whole year.

But I would just say we have positive indicators there. So to answer your question, Rob, is D&R, we actually have pretty strong confidence that you'll see that continue to improve over the course of the year. So we'll have a good midyear check-in on the D&R side, where we'll provide commentary and discussion about what's happening overall there. The exposure piece was definitely slower last year.

It did improve in Q4. Just to be clear, I think that was in some of the early comments, but it's not where we want it to be. And so again, there, we don't want to actually straight line some of the early improvements that we saw in Q4. I hope that helps with a little bit of how we're thinking about how we're looking at. It is very fair question.

No, that does. I appreciate the color. And obviously, given the software Armageddon or whatever we want to call it that we've seen recently, I appreciate your comments earlier around the defensibility of cyber and the domain expertise and couldn't agree more. But that being said, I'm curious, where are conversations with customers right now relative to AI, the potential threat of AI? And what are they asking of Rapid7, if anything?

Yes. I mean look, that's the one that's actually clears, and this is where this is also the time where on one hand, you never love as you're seeing some of the growth things that we have for last year for us to make an investment. That said, in retrospect, I feel great about the investment because we are moving on the AI. The #1 thing that customers are asking for us is they want us to do more to help them do more with less. Like we think about AI crowding out budgets, but it's also crowding out staff.

And as customers are dealing with increasingly complex environments, they're absolutely demanding that their providers be able to tackle more and to do more with less. So that's why I say that they're looking for us to actually leverage AI. Now there's a lot of customers that want to actually -- they want transparency in the AI. So part of the -- what we're working with our team on is not just solving the problem, but it's showing you work on how you solve the problem because security folks are skeptical.

And so we're not mission complete until we actually both deliver the AI velocity that customers want, but that we actually do it in a way that's trusted. So that's one thing that customers want. But then they actually want you to actually do more. So we have lots of customers that are looking for us to actually take on more of their operational workloads. And frankly, we can't quite address all of that right now.

That's why we are upgrading and investing in sort of like getting richer, deeper expertise even as we sort of like deliver more AI solutions to take on part of the work that actually some of our people used to do. Customers want to scale their security operations. And it's not just their technology buckets that they're trying to figure out how to get the most out of. They also for their teams are being asked to do more with less.

The next question comes from the line of Brian Essex with JPMorgan. The next question comes from Joseph Gallo with Jefferies.

This is Grant Darling on for Joe Gallo. I wanted to ask first just about outside of AI customer consolidation trends, how are those impacting your win rates and deal sizes? And then in conversations with customers, what is most important for you to be a beneficiary of this trend?

Yes. It's a great question. It's interesting. So we are benefiting from it. I would just say we do have to actually improve the delivery of how we actually simplify that for customers. And so we see this as an area -- it's our biggest area of winning. It's also one that we actually have some improvement to go. I think one of Allan's big focus areas is to simplify the proposition, the storytelling and the packaging about how we actually deliver the consolidation story.

Rapid7 has traditionally been -- because we're a security company, we tend to believe in not overpromising. And so we tend to underpromise, overdeliver, which isn't always the greatest thing in a hypercompetitive sales cycle. And so part of that is how we actually tell the story. The thing that we're focused on the more substantive level, though, when it comes to consolidation is how do we actually be the best at actually integrating into the rest of people's technology and security stacks.

Look, if you look today, we're able to essentially integrate the 4 biggest parts of security operations in, which is a big deal. People are asking us also to actually take on even more of that work. And we're doing that increasingly through partnerships. So we announced not just a partnership with Microsoft, we announced a partnership with another company that extended some of our capabilities.

And you'll see several more of these key partnerships coming up a little bit later this year as a key part of our strategy. That allows us to stay tight on our R&D-focused budget, which is -- and sometimes in the past, we would have just actually spun up teams to do that. So it allows us to stay focused, but it also allows us to apply best-of-breed technology, deeply integrated within our security stack to get more of that share of wallet for the consolidation budget, and that's a big focus that we have as we move through the year.

That said is that we are not assuming in our initial guidance that Rafe gave, any material improvement there. I would say we are managing to that with the strategy of both expanding our addressable market in exposure and D&R and managed services that go along with it. And we're quite aggressively investing in embedded partnerships that deliver the consolidation experience and budget that folks are looking for.

Got it. That's very helpful. And then maybe going back to MDR, like when does that get big enough to drive growth acceleration? And maybe how do we think about that dynamic there?

So I think it's pretty close. It's actually -- it is actually big enough. We need to be ungated in our ability to actually go sell it and drive it. I do think we crossed that threshold this year. To be clear, we run one of the most profitable, highest quality MDR businesses. But that does mean that we are pretty clear about what we do and don't do. And we are actually increasingly unlocking that business. That does require technology that does require AI and requires us to shift where the services go.

But I think that we're on track this year to be able to unlock that, and then that really compensates for the growth. I think this is part of why Rafe was commenting earlier is that, look, we don't want to be over precise in predicting timing of all right, we're unlocking it this year, then how fast can -- as we unlock that, can we actually take that to market, tell the story in a noisy market. That's where we are actually just being very direct and open with you. But we do see us unlocking that this year, which we think the profile improves over the course of the year.

The next question comes from the line of Adam Tindle with Raymond James.

Okay. I just wanted to kind of circle back to Rob's line of questioning and just double-click on what's driving the ARR decline in Q1 based on guidance. It's just a little bit more meaningful in the past, down $10 million or so on net new ARR. And I wouldn't think Q1 is necessarily a big renewal quarter, so I was confused at the churn comments. Just maybe double-click on why that is happening in Q1.

And then if you could tie in the color on investments and strategy to potentially reverse this decline in net new ARR. For example, if it's a churn issue that you're seeing, are you creating -- or investing in a retention team? Just a little bit more, Corey, some qualitative comments on the strategy as well.

Yes. No, so one, Rob, wants one that framed it as a churn thing. But to be clear, I do think that the -- if you look at the biggest driver, D&R is growing, but it's not enough to compensate for the negative -- for the rest, for the other parts of the business that are growing. But I will answer your churn questions, too, about what we see around churn is we see -- if you think about D&R and you think about exposure, exposure was stable last year, so it was in line with expectations. We think it can be better.

We have a number of major releases coming out that make it easier to do the VM, the vulnerability management to exposure upgrade. And so we think we have upside there. But again, it was slower last year. And so we're not baking that into the core assumptions and outlook. And it's not -- that's not a Q1 thing either. And so that is something that we're actually looking at in the middle of the year, but we actually have good visibility there.

And the D&R one, we're actually doing great in D&R. I would just say that for customers to say, we love what you're doing, we need you to do more, and we want more services, or we want more customizations. We're not set up right now to fully unlock that right now. And so that does cause more complex customers to come out in the near term. That one, we have a lot more confidence and clarity and visibility in because we've been specifically retooling around that.

And that we actually think improves both on the addressable market TAM side, but our ability to say yes to customers as we go forward. So again, the biggest driver is D&R growth isn't enough to compensate for the other. But I also want to make sure I explicitly address your questions on churn dynamics. Does that get to your core questions?

Yes, that's helpful. Maybe just a follow-up for Rafe. I was curious in looking at the guidance here. You do have that improving EBIT margin. I know you talked about, but in dollars, it's also improving $20 million or so in Q1 and EBIT dollars has to go to 30-ish to hit the annual guide on EBIT.

And I'm noticing that revenue growth is not accelerating. So it's not necessarily an operating leverage dynamic going on here. Maybe just what's driving the improvement in EBIT? I know you talked about investments. I wonder if maybe there's also some cost-cutting restructuring or something that drives that trend of EBIT dollar improvement on revenue declines.

Yes. Thank you. As we move across the year, part of where we're at is we have been investing throughout 2025. Of course, that run rate comes into the early parts of the year. But those investments start to bear fruit, right? Some of the things that I called out in my prepared remarks, our investments that help us build efficiency, whether it's investments into the product, investments into the India team, it gives us greater capacity as we move through the year, and that bears some fruit for us that will help us build those margins as the year goes on.

Your next question comes from the line of Shrenik Kothari with R.W. Baird.

This is Zach Schneider on for Shrenik. So I just wanted to follow up to some previous questions. If you could just help us understand, where are we really in the monetization curve for Exposure Command and Incident Command and maybe which upsell, levers offer the highest probability of lifting net retention meaningfully maybe without relying on broad pricing increases over the next 12 months?

Yes, I'll hit both of them in. So one, Incident Command is relatively easy. We haven't -- we launched initially Incident Command last year. I will say the primary focus initially was on the AI managed services around it and to support some of the customer demand again because we have not addressed the full addressable market there. So I would just say, listen, we're in the first inning of Incident Command. And frankly, it's not even a big priority right now for our sales team.

It will be a later priority as we actually go through the year. But we actually think there's plenty of upside there, especially with what's happening in the SIEM market. So it's something we're prepping for and looking at. There's a couple of things that we want to do to make it branded, easy and simple for folks to do. And so we expect to actually do that. But I think we're in a good position, but that's not a core focus. I would just say first inning, but it's something that we're looking at.

And I think that upgrade does not require a lot of complexity in terms of pricing there. On Exposure Command, I would just say, listen, that was a big disappointment last year because we did not really sort of like get that going to Q4. That said, in Q4, we actually saw a unit uptick of starting to get the upgrade motions. And if that continues and even in Q1, we're starting to see a little bit of a continuation of that, then we feel quite good about what that means for both growth of expansion and what that means for retention over the course of the year as that goes along.

But this is a classic one where we missed the timing last year. And so that's why we're not baking that into the -- it's not in the core Q1 assumption. It's not there. But I do think that, that is one that I feel like we're in the -- I would just say, fourth or fifth inning, I had to keep using baseball analogies. But we're further along. We see it. We know it. We've gotten good feedback there. We just want to see the uptick. I do think more of this is operational, and so I feel more confident that we'll continue to see it, and we've already seen some of the initial progress there.

Your next question comes from the line of Kingsley Crane with Canaccord Genuity.

Entering last year, I think we felt like we had a stronger pipeline at the beginning of the year than fiscal '24. Of course, this has been somewhat of a challenging year. In retrospect, I mean, was the quality of the pipeline lower than original valuations? Just how do you feel about that evaluation methodology and just the quality of the pipeline heading into '26?

Yes. I mean, look, I think, clearly, if you look last year, our assumptions on deal cycles, especially in the pipeline, were off significantly, which is why we've actually revised how we look at things, how we think about things as we actually come into this year. I meant to use the word conservative, but I would just say we have a much more thoughtful approach around the learnings from last year and how they apply coming into this year.

The way that I would frame last year's pipeline is that on the D&R side, we actually built a backlog of larger deals faster than we could actually consume them and deliver them and execute them in the market. And I think that's fine, but it represents customer demand. And so we have a lot of urgency on responding to that sort of like customer demand that we actually see there. And I do think that this year will match up the demand and supply of capabilities to actually do the more customized accounts.

I think it's the right thing to be gated on that. But to be clear is I do think that will be more matched and in line this year. Look, we also just need lots more transactions than singles and doubles with the other corollary. So one of the big things that Allan is focused on is not just doing the big deals, but also getting -- again, I hate to keep using baseball analogy, singles and doubles. But that matters hugely. Now again, this is one of the things that kind of worked well coming out of last year.

We did start to see that mentalities of the singles and doubles starting to hit. We need to see that systematized across a few quarters. But if you look at the recipe for growth acceleration, which is what we all want, is it is the singles and doubles. Think about that as the mid-market AI MDR, it's Incident Command, it's the Exposure Command, which includes the upgrades of those, which we have plenty of capacity and room for.

It is continuing to deliver the pipeline, but then actually being able to convert and service I would just say the larger deals, when I say larger deals, those are the customers that are with somewhere between 5,000 and 20,000 employees, which is sort of in our core sweet spot and unlocking that. And I think that, that is a big focus area. Those are the things that actually unlock growth as we come in.

When we look at how we're actually looking at the pipeline and the planning assumptions this year is, one, look, we're factoring in that we need a multiple of the coverage ratios that we actually did last year. So we actually are taking the learnings from last year and applying them into this year as we actually think about the pipeline overall.

And certainly, as we actually think about sort of how does that relate to guidance. But again, there's a couple of tailwinds that I would just say in our team's ability to go get the singles and doubles, which should improve things over the course of the year. But we want to see that evidence done, and then we'll actually communicate that, and we'll give you updated guidance.

That is really helpful, Corey, and I do appreciate the baseball analogies. Maybe one for Rafe. How are you thinking about the net debt balance moving forward? And then just a general philosophy around cash balance uses of cash as you wrap your hands around the business?

Yes. Thank you. Well, first, we've been very, very focused, as I touched on in my prepared remarks, about making sure we're in a strong position for that maturity that comes in March of 2027. On our balance sheet, a lot of our investments are still classified as long term, but all of those treasuries, government securities mature before the bond does.

So what we anticipate as next quarter, the bond maturity moves from noncurrent to current, so too will the investments and really just lay out for everybody. First and foremost, we're in a very strong position to be able to take care of that debt maturity with the cash and the investments we have on hand. I think beyond that, we're looking to make certain we have the liquidity to obviously fund the business, make sure we've got good headroom there.

But also, we need to be liquid enough to take advantage of any opportunities that come up through the course of the year. So very much evaluating that now and continuing to have discussions around that. But first and foremost, we want to share with everybody our strong position to take care of the debt maturity, take that off the table for everyone, and then we'll go forward from there.

Your next question comes from the line of Mike Cikos with Needham. And it looks like we're not getting a response from Mike. So we'll go next to Rudy Kessinger.

Kind of back to Adam's question and some other questions on just the ramp in op income. I guess on gross margin, it was down sequentially in Q4. Should that tick lower for the full year here? And again, just if I'm modeling it right, you assume a gradual ramp in that op income, I've got to take OpEx down by like $10 million a quarter by Q4. So do we have that right? And you're saying it's driven by efficiencies, but are you guys planning to cut hedge or anything? Or how do you get to that level of improvement on the operating income side?

So I think, first and foremost, remember that we did touch on Q1 is inherently has some extra expenses that just hit Q1, right? Not only do you have the usual stuff like all the tax rates resetting and that always hit Q1, but also sales kickoff falls in Q1. And we -- as Corey called out, we got the whole team together. We really had a great chance to get together with the new leadership and really set that strategy for the year. So that is one unique aspect that obviously shows up in our Q1 guidance.

Across the board, these investments that we're making, the gradual shift in MD&R does come with little bit lower margins. We still think they're very good margins. We've talked about in the past, maintaining those margins in the low 70s. We feel good about that. But as that mix shift continues, it does pressure cost of goods sold a little bit. But again, these investments around AI, investments in across the business and all the different changes we've called out, I think that will bring efficiency as we move through the year.

Yes. I mean, keep in mind, I think -- I do want to reflect on one thing, I think it's a core part of it is that, one, Rafe is completely right about the managed -- the MDR that customers are looking for. Just to be clear, it's a big demand driver. Also, you can see why because of the gross margin profile, why we have to do it in a technology-oriented way. And so that's the first thing.

The second thing I'd remind you is that this was planned for last year. What we committed to you all last year was that we were going to make an investment, but we were planning out the investment such that the benefits of it would sort of like peak at the end of the year but then come down. I would say we're completely aligned with the plan.

So yes, I think that you're right on the profile of how it flows, but this profile and this investment structure was planned out last year, and we are on the plan. And so it's not a major derivation of the plan. Now again, Q1 is probably not the right baseline to think about the Q1 expenses. But the efficiency gains that we have were planned out as we actually went through the increased investment last year.

The next question comes from the line of Trevor Rambo with BTIG.

This is Trevor on for Gray Powell. Just one quick one for me. You touched on it a bit earlier, but can you just talk more to the mix of enterprise versus mid-market deals you saw in the quarter and how that compared to Q3? And then where are you seeing the most traction between these deals heading into 2026 and then the mix there? Any color there would be helpful as well.

In pipeline, I don't have the specific numbers off hand right now. But in pipeline over the course of the year, we saw, I would just say, a pretty significant shift towards larger ASP deals in pipeline, which is, frankly, again, a little bit ahead of our capacity to deliver on all of those. And so that ended up being a pressure, which is why I say, listen, we have to have the singles and doubles of mix in there. I do think it will be more balanced this year. Now I can't comment about where the current pipeline sits.

I just look about have the enterprise. And it's not really enterprise versus mid-market. It's more the deal size and complexity and customization that really that drives it more than anything else. I am expecting, based on conversations with Allan and the go-to-customer team and the go-to-market team, that we'll see a more balanced mix this year coming in. We'll still get a reasonable share of the larger deals, but we are planning for it to be a more balanced mix. We think that was one of the things that we just did not quite nail the execution on last year.

And so we do want to be more balanced even as we actually continue to now convert some of those larger deals. Just to be clear, that is the goal, that is the focus on both our customer orgs for our existing customers that are asking for more and for new business. Lots of customers are looking to upgrade their capabilities and get partners on how they actually scale their security operations. But we can say yes to more of those, but we do want more of the singles and doubles, so to speak. And so I do think the mix is going to shift to be more balanced this year.

There are no more questions at this time. I would now like to turn the call over to Corey Thomas for closing remarks.

All right. Well, thank you so much for joining us on the call today. And I really do appreciate the folks that are actually on the journey with us. Rafe and I look forward to updating you all on the next call. Thanks.

Good day, everyone. My name is Leila, and I will be your conference operator today. At this time, I would like to welcome you to the Q3 2025 Rapid7 Earnings Call. [Operator Instructions].

At this time, I would like to turn the call over to Ryan Gardella, Investor Relations.

Thank you, operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's third quarter 2025 financial and operating results in addition to our financial outlook for the fourth quarter and fiscal year 2020 pass -- with me on the call today are Corey Thomas, our CEO; and Tim Adams, our CFO. We have distributed our earnings press release over the wire, and it is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file.

This call is being broadcast live via webcast. And following the call, an audio replay will be available at investors.rapid7.com. During this call, we may make statements related to our business that are considered forward-looking under federal securities laws. These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to the company's financial guidance for the fourth quarter and full year 2025 and the assumptions underlying such goals and guidance.

These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the future results expressed or implied in these statements due to the number of risks and uncertainties, including those contained in our most recent quarterly report on Form 10-Q filed on August 8, 2020, and and in subsequent reports that we file with the SEC.

The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements. and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by applicable law.

Our commentary today will primarily be in non-GAAP terms and reconciliations between our historical GAAP and non-GAAP results can be found in today's earnings press release and on our website at investors.rapid.com. At times, in our prepared comments or in responses to your questions, we may offer incremental metrics to provide greater insights into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be onetime in nature and we may or may not update these metrics in the future.

With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey?

Thank you, Ryan. And welcome to everyone joining us on the call today. Rapid7 ended the third quarter with $838 million in ARR, growing 2% year-over-year as we innovate on our AI-powered stock vision but continue to see timing variability within our large steel pipeline. Revenue for the quarter was $218 million and operating income was $37 million, both ahead of our outlook.

We once again delivered strong free cash flow of $30 million generated in the quarter. The key message I want to leave you with today is Rapid7 has made and continues to make significant organizational changes to accelerate our go-to-market motion, capture the large opportunity in front of us in AI SoC and position the company for accelerating top line growth.

We have a leading franchise with a competitively strong set of capabilities that we continue to invest behind. We have alignment to move as quickly as possible across all dimensions of our organization to improve and capitalize on the opportunities in front of us. This includes several recent senior leadership changes, including our new Chief Commercial Officer, Alan Peters, who joined us in early September and today's announcement of Rafe Brown as our next Chief Financial Officer beginning in December.

It also includes operational changes Alan is beginning to implement in the fourth quarter to better align resources and incentives for growth in 2026 and beyond, particularly in our MDR business. which is more than half of our ARR and continues to grow double digits, but which is part of our business where we believe we can focus more resources to accelerate growth with attractive margins. I will discuss this in more detail in a bit.

We are confident that we are making the right changes to reaccelerate Rapid7, but we also acknowledge that we have fallen short of the ARR guidance that we have provided to you in recent history and thus far this year. As we take action across the organization, we view it as imperative that we rebuild confidence in our guidance with the investment community.

As such, with a new CCO and CFO and recognizing the operational changes we are enacting may create higher near-term forecasting variance, we are today reducing our 2025 ARR target to reflect a higher confidence outlook. The new target is based on what we have experienced year-to-date and now embeds a discount of the new business win benefit expected from Q4 seasonal budget opportunities for the potential impact of the changes that I discussed.

Based on our competitive product position and growth across our markets, all of us at Rapid7 believe we're capable of executing better. Let me tell you why and where we are investing in our organization to drive us forward. It is clear that customers are significantly involved in how they operate their SecOps programs. Seeking to integrate AI as they look to consolidate core elements of exposure and direct response in the SOC. We built Rapid7 Companion platform, an AI-powered security operations platform that unifies exposure management and threat detection response to enable quicker execution and accelerate remediation outcomes through deeper and more integrated situational awareness of risk and threats across customers' attack surface.

We're optimistic about our road map and strategy. Yet, we maintain a realistic view that these larger platform consolidation opportunities naturally lend themselves to longer, more competitive deal cycles. We have seen this affect quarterly deal timing and overall growth performance throughout the year. But the scale and quality of recent wins demonstrate strong market validation of our platform approach. And as we are seeing adoption from mainstream customers committing to an integrated solution.

A great example of this was a competitive [indiscernible] win during the third quarter with a large Tier 1 public university. We were brought in to replace their disparate multi-vendor tech stack across exposure management, SIM and managed detection response. The customer security team faced friction trying to leverage a fragmented tool set and legacy technologies. While their initial exploration was around MDR our holistic security operations offering, including full visibility and access to our market-leading SIM, coupled with unlimited IR and integrated vulnerability management and deliver it via a global 24/7 SOC was a value proposition that no competitor can match.

These types of deals highlight our leadership position, strong platform value and right to win in our detection response business, which continues to serve as a core growth driver of our business. This is a great validation of why Rapid7 is well positioned to help customers integrate leading AI capabilities and experiences into their SOC while unifying their overall security operations tech stack through our integrated command platform experience.

With years of experience operating in a scaled global 247 million SOC, we have a significant advantage in proprietary data, expertise, and as a result, agenetic AI capabilities. And we're taking deliberate steps to sharpen our go-to-market focus and execution as we look ahead to 2026 spearheaded by Alan as I referenced. Although Alan has only been in the seat for a few weeks, he is already sharpening the discipline and operational focus around the execution as we aim to accelerate our position and market capture in our AI-led DNR space looking ahead.

As we'll discuss, we believe we have the products and capabilities to be one of the leading providers in this space. accelerating our focus to enhance our operational alignment with faster revenue opportunities remains our top priority, and we're confident in our path forward. We're doing this through both focused product innovation as well as some deeper partnerships that enable us to more seamlessly extend the value of our customers' existing ecosystems. A great example of this was our recent announcement of our expanding partnership with Microsoft to advance modern detection response by helping organizations simplify and strengthen their detection and response capabilities across their Microsoft environments.

Rapid7's new MDR for Microsoft solution integrates a dedicated service with Microsoft Defender that provides comprehensive coverage across endpoints, cloud, identity and e-mail. This new collaboration brings together Rapid7 SOC expertise with the Microsoft security ecosystem to simplify operations, strengthen protection and unlock new value for joint customers.

By combining the power of Microsoft's advanced telemetry and analytics with Rapid7 human-led threat expertise and AI-driven operations organizations can gain faster, more precise detection and more contextually rich response playbooks to stop threats before they impact.

Overall, our strategy is well aligned to what we're seeing in the market. Customers are increasingly prioritizing unified data collection and AI and the SOC to achieve better security outcomes that they can achieve with their existing fragmented tool sets. Security teams need platforms that deliver comprehensive attack service visibility and threat context to enable efficient decision-making and faster, more automated response to threats that are happening in their environment. demand for integrated exposure and detection programs is growing, amplify by regulatory pressures for compliance and reporting.

These trends align directly with the broad slot capabilities embedded in our Command platform, focus on expergate AI, both for exposure, remediation and threat response, alongside automation and a strong return on investment. Our head start from operating our own SOC for years positions us uniquely in this market.

A great example of this ongoing convergence within customer environment was a 6-figure deal in the quarter with an existing exposure management customer. This customer was looking to address detection gaps that they were experiencing within their existing program. The combination of our broader telemetry coverage, demonstrated superior detection and a cost-effective platform value proposition, all of which was fully integrated with their existing exposure management platform, drove this retail customer to displace their existing MDR vendor with rapid severance managed through a complete offering.

Our long-term strategy remains centered on scaling our AI-driven security operations command platform with increasing focus on accelerating our growth transition towards our scaled, market-leading MDR position as we look ahead to 2026. The Command platform integrates native telemetry, Open Data integration, curated intelligence and automation into a unified system for risk remediation and threat response that rest on 3 core differentiators.

First, our open platform with over 500 integrations address fragmented attack surface use. These integrations unify diverse data into a deconflict contextualize perspective, providing holistic environmental understanding. p

Second, our expert trained and Agentic AI workflows draw from years of sock expertise, live playbooks and real-world feedback. These proprietary engines enhance outcomes in real time and are embedded in our MDR offering.

Third, we drive automated measure progress, not just alerts but actions. From AI informed response to prioritizing misconfigurations and coordinated incidents, we reduce mean time to detect, respond and remediate. Our innovation across these areas fuels our unique position as a leading provider across both the exposure management and detection response market.

Demonstrated by the breadth of analyst recognition we received within just the last quarter, including our seventh consecutive recognition in Gartner's Magic Quadrant for SIM, our position as a leader in frost radar for managed detection response, our recognition in forces unified vulnerability management wave and our leadership position in IDC's market scape for exposure management.

Overall, our AI-powered security operations platform that unifies exposure management and detection and response and a single customer experience is resonating with customers and industry analysts alike. And is a strong foundation to support improved execution as we look ahead to 2026.

As we drive towards this unified AI power SOC vision, the integrated platform experience between our managed DNR and exposure management capability remains a key differentiator, delivering deeper visibility and contextual awareness around threats. We believe we're just scratching the surface here, and we continue to innovate demonstrated most recently by our announcements of AI-generated risk intelligence delivered through Rapid7 remediation Hub.

This new AI-driven risk and vulnerability intelligence will empower security teams to prioritize and remediate security threats faster an outcome that is core to our vision around unified exposure management in SOC. A key pillar of our growth this year has been around our exposure expansion engine, which is anchored on our transition in our traditional VM customer base through this integrated outcome-focused exposure management model through exposure command.

We continue to see steady increase in upgrades and expansions of our core base of exposure coming in Q3. And looking ahead, Alan is keenly focused on improving our execution around this expansion engine. This is an area where we have fallen short of our goals this year. However, we view this as an execution shortcoming, and we remain confident that delivering a single contextualized risk view across cloud and on-prem environments with AI-powered insights and particularly in the context of managed detection response program will enable better risk prioritization and remediation and ultimately deliver improved security outcomes and customer environments.

Shifting now to an important and exciting leadership update, which we announced today. I'm pleased to welcome our new Chief Financial Officer, Rafe Brown. Rafe is an outstanding leader with extensive executive leadership experience across multiple public companies, most recently at Modcast, where he's initially served as Chief Financial Officer; and then later is President and COO. His track record of driving operational excellence, scaling growth in SaaS businesses and building high-performing teams makes him an exceptional addition to our leadership team.

I'm thrilled to welcome Rafe to Rapid7 and look forward to his arrival later this year. and to continue to work with him to drive our business forward.

In closing, as we look ahead, we're confident that we have the right strategy, and we are moving as fast as possible, including our recent leadership additions to position Rapid7 to improve our near-term growth execution. We believe there are significant inherent value in our platform that is not fully reflected by the market at this time, and we're taking direct action to address this disconnect.

Managed Detection & Response continues to fuel a strong growth opportunity for us. and our differentiated command platform rooted in automation, integration and expedite AI is more relevant than ever. We're focused on continuing to innovate execute efficiently and position ourselves to deliver outcomes for our customers, our shareholders and our team.

Thank you for joining us today. I appreciate your support. And I will now turn the call over to Tim to walk us through our financial results in more detail.

Thank you, Corey, and good afternoon to everyone. We appreciate you taking the time to join us on today's call. Before I turn to the results, a quick reminder that except for revenue, all financial results we will discuss today are non-GAAP financial measures, unless otherwise stated. Additionally, reconciliations between our GAAP and non-GAAP results can be found in our earnings press release. Rapid7 ended the third quarter of 2025 with $838 million in ARR, representing a 2% increase year-over-year.

Revenue and profitability were above our guided ranges and as in prior quarters, we continue to see promising signs for future growth in detection and response and progress in exposure command adoption. While in general, we've seen the customer spending environment challenged by additional scrutiny, particularly in large deals, we have been focused on enhancing our product capabilities to address a challenged threat environment driven by escalating AI-enhanced threats and cloud migration demand.

Turning to our financial results for the third quarter. Year-over-year ARR growth in the third quarter was driven predominantly by 2% in ARR per customer. And we ended the third quarter with over 11,600 customers globally and average ARR per customer of over 72,000. Third quarter revenue of $218 million grew 2% year-over-year and exceeded our guided range. Product subscription revenue also grew 2% year-over-year to $210 million.

Professional services continued to decline year-over-year consistent with our expectations and decision to deemphasize certain lower-margin services. International revenue represented 25% of total revenue and grew 8% over the prior year.

On profitability measures, our product gross margin was 75% and total gross margin was 73%. Sales and marketing expenses were 33% of revenue, slightly above the prior year at 31%. R&D and G&A expenses were 17% and 6% of revenue, respectively, compared to 16% and 6% in the prior year. Operating income for the third quarter was $37 million and above our guidance range, driven by natural leverage in the business as well as timing of spend as we continue to focus on making targeted growth investments and scaling our India capability center during the second half.

Adjusted EBITDA was $44 million in the quarter, and non-GAAP net income per share was $0.57. Shifting to our balance sheet and cash flow statement. We ended the third quarter with cash, cash equivalents and investments of $635 million compared to $600 million at the end of the second quarter. We generated free cash flow of $30 million in the third quarter, bringing our year-to-date free cash flow to $98 million, and we remain well on track to achieve our full year free cash flow targets. This brings us to our outlook for the remainder of the year.

As Corey referenced, we believe we are well positioned to help customers and prospects integrate our leading AI capabilities and experiences into their SOC as we look ahead. At the same time, we are managing active change during the fourth quarter, both from a leadership perspective as well as we accelerate our focus and operational alignment toward our fastest growth opportunities as we look ahead to 2026.

We have factored these dynamics into our fourth quarter ARR outlook, which now calls for ARR to end Q4 approximately flat quarter-over-quarter.

Turning to our other guidance metrics. We are tightening our full year revenue guidance range to $856 million to $858 million, representing year-over-year revenue growth of 1% to 2%. Full year recurring product revenue growth will continue to outpace total revenue growth, partially offset by year-over-year declines in professional services.

Moving to profitability. We are raising our full year operating income guidance to the upper half of our prior range and now expect to deliver $130 million to $135 million in operating income for the year, representing an operating margin of 15% to 16%. We continue to generate strong free cash flow and are reiterating our full year free cash flow target range of $125 million to $135 million.

Finally, we now expect non-GAAP net income per share for the full year of $2.02 to $2.09 based on approximately 75.9 million diluted weighted average shares outstanding.

Turning to fourth quarter guidance. We expect revenue in the range of $214 million to $216 million. We expect non-GAAP operating income of between $25 million and $30 million and non-GAAP net income per share of $0.37 to $0.44 based on approximately 76.6 million diluted weighted average shares outstanding.

In closing, I'd like to thank everyone for their support during my time as Rapid7 CFO, including our Board, our investors and analysts, and most importantly, our team here at Rapid7.

I would also like to welcome Rafe Brown to the team and wish him the best. Thanks for everything, and I look forward to continuing our relationships in the future.

With that, I want to thank you for joining us on the call today, and I will now turn the call back to the operator to open the line for questions.

[Operator Instructions]. Our first question will come from Rob Owens with Piper Sandler.

A couple for you, Corey, is the business seems to shift towards MDR. Can you talk about the economic model? And despite the success you're seeing here, it doesn't seem to be dragging on margins either from a gross margin or operating margin standpoint. So I would just love to understand that.

And then let us ask the second one upfront. Can you maybe parse for us the success that you're seeing internationally versus what you're seeing domestically? And just looking at the dispersion between those 2 growth rates.

Thank you so much, Rob. We can hear you just fine. So I think part of what you're getting is MDR, we run at a higher both gross margin and overall profitability than your average in companies. And most of that is based on the fact that we've had to take our time and frankly, get some of the growth historically to really -- and market adjustability to make sure that we were building both first the automation and now the AI capacity to actually map that in, which allows us to actually run it.

We believe that we can actually run modern managed services at higher quality, better efficacy and higher gross margins than you could in the last 10 years. And we think AI is a big part of the story when the AI SOCs a big part of that story. And so it's something we've been -- and as you recall, that's 1 of the big investments that we actually made this year, and we're well on the journey there, and we're delivering the economic output, which sets us up well to actually expand our addressability of how much we can actually grow that business because now we can actually over half our business -- approaching half of our business.

We can actually grow that profitably at scale with more and more addressability. So we do think we have an incredibly strong economic model that sets up a great platform as we actually go forward. But we did actually gate it along the way to make sure that we were building up the automation and the core baseline technology to support a high-quality, higher-margin business that was profitable over time, and that takes time and deliberation. Your second question was...

Yes, Corey, I think his second question was the success we're seeing internationally. It's 25% of revenue growing faster the business overall. So it's got a nice growth rate.

Yes. I'll remind you, we've been putting more wood internationally from an investment perspective because we were historically a little bit lighter on the international percentage of business. We've been investing more. That said, is that one of the things that Alan has really focused on is aligning the sales processes across the business. So that we can actually be more consistent both across segments and regions around the country and really look at the investment profile.

And so we do think that we have plenty of opportunity in North America. And we actually think the sales has opportunities to expand and accelerate there. And we still see a lot of growth that we have available for us as we actually go forward international. And thank you for the question, Rob.

Your next question will come from Fatima Boolani with Citi.

Corey, the question is for you. Just with respect to MDR now, almost the majority of the business. But when I map that back to the at ARR per customer growth you've experienced sequentially. It is up 2% year-on-year. How can we not conclude that there are elements of pricing pressure and/or pricing competition inside the MDR business as well?

And maybe what are you seeing that we aren't necessarily seeing or is not necessarily visible to the naked eye for us? to give you that confidence because that space generally is fairly competitive. And the AI SOC vision, there are a lot of vendors competing before the hearts and minds of the SOC. So I would just love your perspective on some of the pricing dynamics and what insulates you and why it may not be visible to us? And I have a follow-up, please.

Yes, absolutely. So one, it's a very fair question. So MDR, just to be clear, we're still following that business double digits. And we actually see plenty of capacity to continue to do that and grow that. So we do see that we are quite effective there. Now we have been gated historically about how much we want because we had the gross margin concerns.

And as we actually automate more and more of that business we feel more and more comfortable unlocking that business, which is why you also see us talking about a little bit more because we on the competitive positioning, our competitive position is fairly straightforward, is we are great for organizations that are actually looking to actually get leverage from outsourcing to an AI-driven SOC that combines to both the best of technology and people. And so if you look at what we're doing today and what we've set up is we have an incredibly driving practice around MDR that delivers high-quality efficacy at scale, and results in relatively high retention rates.

You add on to that. We've extended that and we're extending that to manage rate, managed risk. We have coming up, and our value proposition is that for customers that want to scale and outsource the stock at quality, and they still want to actually have targeted sort of like access to people and talent, where you're getting both the best of AI, but you also have access to people. We can do that economically better than anyone else. And we have hope to scale and the experience to actually demonstrate that. So that's our core value proposition, and it's one that we're leaning into and it's one that we're actually optimizing around is what it shows continued good growth opportunity. You said you had a second question?

Fatima, go ahead if you had another question.

I appreciate that. As we think about calendar '26 with the backdrop of what has been a year of work in progress in calendar '25, you're layering on further operational changes and some new sales processes. So when we think about calendar '26 at a very high level, how should we internalize the growth versus profitability algorithm and specifically around efficient investment and I know one of the mandates this past year also was leveraging the channel more. So how should we get a very high level, think about that algorithm seeing that you outperformed on operating margin and cost control this year?

Yes. I actually think we have a -- we've built a fairly efficient business. I think we can actually build off of that and continue that trend. Part of the reason that we're making the investments right now is because it's the right opportunity when do it. Like if you look at what we're doing both in the MDR space, if you look at the position that we actually had in our recently announced partnership with Microsoft, where we have a big opportunity to actually help Microsoft customers really manage their security ecosystem in a more scalable way and meet the outsourcing needs that they actually pay at.

This is the window that we could have actually either wait until next year and have the noise going in or we can actually execute that right now. to tee up for momentum next year. And we decided to actually that we had enough clear opportunity in front of us to actually pull the trigger now and actually move forward with some of the obvious changes that are really about how do we actually scale and rationalize our efforts as we move forward.

Yes, Corey, I would just add. We said earlier in the year that this is an investment year for us as we're building out the innovation center over in India, and that continues to ramp up and you see it in the second half of the year with some of the expense load that we anticipate in Q4 as we continue to ramp that business, but giving us leverage in the business over time.

Yes. And the overall goal was always to actually make sure that we can actually scale profitability as we go forward in the next couple of years. Thank you very much for the questions.

Your next question will come from Matt Hedberg with RBC.

Okay. So I guess maybe one for both of you guys. You guys have noted some timing variability with large deals, and it seems like Alan is going to be working on some processes to improve that. I guess as you think about Q4, can you talk about the large deal pipeline? And Tim, how have you sort of contemplated that in your Q4 outlook?

You want to talk Adam?

Yes. So Matt, it's a fair question. And I think Corey had it in his prepared comments that we really wanted to give you a high confidence outlook for Q4 as we come into the quarter. So we take a very hard look at the pipeline, and we're looking at that all the time, as you might imagine, because that is your leading indicator.

And you're looking at conversion rates, you're looking at cycle times of deals when they're in the pipeline. And Corey mentioned this earlier that when you're looking at these platform conversions with customers, the great news is these are larger deals that we have the opportunity to win. They do take more time for these deals to work themselves into a closed state.

And I would just say, if you're looking at how we actually factored it in, is that we didn't actually try to get overcomplicated. Look, I think that one, we saw plenty of opportunities we actually go forward next year. So the question is always, do you hold any sales or organization or any changes in Q4 in -- for January. And we said, listen, we actually think it's straightforward enough. That we want to make sure that we're addressing the process, enabling other stuff now.

The second thing that I would just emphasize when you think about it, is we acknowledge that there's a range of outcomes. I think this part you get to -- it's probably the point that you you're making. There's an absolute range of outcomes, but also, we have not been extraordinarily precise on exactly where we land in those range of outcomes.

And so as Alan has come on board and has Rafe come on board, we just decided to baseline and keep it relatively simple. -- and say we have confidence that we can actually be here. We absolutely know that there's a range of outcomes around it. But we did not want to attempt to be overly precise as Alan was actually working through the model.

Your next question will come from Mike Cikos with Needham.

Corey, just picking up on that last remark as it pertains to the Chief Commercial Officer, Allan Peters, -- could you just provide additional detail on what exactly he is doing with respect to that resource alignment behind the MDR opportunity and execution and transitioning the VM to exposure comment. I would just love to get some more color there.

Yes. So one of them is we have a wide range of practice across. So 1 is just there's a focus as you would expect on just standardizing the operating procedures. We have a lot of talent -- but we do have -- we have variability across both the reps and teams. And so we just went online that to set up everyone for success. And so a lot of it is just the foundation of how we set our people for success.

The second thing that's the big thing is I talked about this in years that this is our first big upgrade wave that we had in a long time. and operationalizing that maturing that and making that effective is a big deal. We have that both on the VM to exposure management side. We also have a detection and response. We have probably the biggest setup for upgrade opportunities. and Allan's partnered with the sales teams and the marketing teams about how you actually make sure that we have a well-organized process market.

And then the last aspect of is we do think that we can be unconstrained in our ability to actually deliver the full AI manned SOC platform, where we're delivering sort of like the -- as that you've managed, both detection response, risk and compliance workloads on that over time and how we actually tee that up and leverage it up and focus the sales team around the highest number opportunities is the last piece. So if you just think about the 3, it's sort of like standardization, really building and accelerating the engine around expansion, which we have the biggest upgrade opportunity. We didn't fully tap it this year, I'll just say that.

And then the third one is really focusing on the biggest opportunity around MDR and making sure our sales force is aligned around that. Thanks for the question.

Your next question will come from Brian Essex with JPMorgan.

This is John on behalf of Brian. Yes. So I guess I'm just curious to hear maybe what were the key criteria in selecting rates? And what are the top priorities or changes the team has moved excited for it to drive when he joined in December.

Yes. And we'll talk more about it, you have some big shoes to fill with Tim will talk a little bit about more in the future. I mean, later on the call, 1 of the things that we were actually looking for is someone who could actually meet where we are is as we actually go forward, we are an AI services engine. And so we will look for someone who could actually come in and bring not just the financial acumen, but we want someone that can bring the operational acumen as we actually to partner with our go-to customers, teams to actually really scale our processes around how we actually do land, expand, how do we scale our price and packaging, how do we actually really drive the economic engine predictivity for growth? -- we've been investing and we're still investing efficiently on Hatten. But we're in a good place.

We're in the right markets for growth, which is important. More and more customers are looking to outsource more and more of their security workloads. We've set it up well where as people are thinking about how they scale their security operations, we can do that across the text response. We can actually do that across risk. We do that across compliance, -- and so we're set up well today. We're tuning the product engine, of course, around that.

But now it's really about how do we actually take that the market, how do we have the right pricing and packaging the operations data behind that. And we're looking for someone who was an operationally minded CFO, who could really tie the sales and the business model together with the product strategy to actually drive that sustained growth. And that's what we're looking for, and that's what we got in a great candidate with Rafe.

Your next question will come from Eric Heath with KeyBanc.

Corey, I wanted to ask on the MMDR side of the business. which does seem to be going strong and even validated the latest Gartner Magic last month. My question is to maybe understand the business a little bit more holistically and how valuable the traditional VM piece is to the SIM MDR side of the business?

And maybe the second part to that question is, we did see another vendor announce at the end of life its on-prem business. That was a reasonable portion of its overall business. And maybe how you're thinking about similarly bold options or less strategic parts of the business in order to focus on the growth side of the business that is doing well, whether that's MBR exposure command.

Well, absolutely. And by the way, we've been on that journey are ready to rationalize the business as part of the growth dynamic that you see. And so while it wasn't a big light to own light all thing, we have been actually steadily moving the shift in the business. As we think about it going forward, I would just say it's pretty straightforward. We think about how do customers who actually looking to scale their operations on aligned their security outsourcing needs. So we think about how do you actually build on top of the Managed Detection and Response offering to actually not just liver manufacture and spots, how does that extend to manage risk? -- manage compliance and managed rare teaming.

So what we've been steadily doing over time is moving from the traditional on-premise workloads to what we consider much more strategic value-added workloads that serves a large part of both the mid-market and the -- I would just say the resource-constrained upper enterprise market, that are focused on the service layer, not just the technology layer and not the on-prem layer. So our primary focus is extending the MDR focus, and we've been at that shift for a study while one of the things that we've been talking to you all about.

We do feel like we're in the last sort of like stages of that shift where we're continuing to accelerate. That's why we're retooling some of our sales focus to really align around -- everything is aligned around that AI managed experience. that operates at the service layer because more and more customers we see do want to actually take workload offer their teams and staff, and they're not able to actually add more and more people.

Your next question will come from Joseph Gallo with Jefferies.

I know you have the large deal dynamics. But fundamentally, where does exposure management and MDR rank in terms of CISO budget priorities right now?

MDR is actually one of the top 2 or 3 in every survey that we see. Now there's ranges of MBR. And a smaller and smaller number of customers are looking to actually manage a 24/7 global SOC themselves. And so more and more looking to actually outsource and get leverage, which is why we see plenty of opportunity there.

As I said before, the traditional on-premise VM or the last call is less and less of a priority. But if you look at the modern exposure management, it is a priority. And we've been rebuilding the -- I would just say, updating the capability around exposure management to tie that to MDR, and we see plenty of opportunities there. But that is the transition that we're making. I think the whole industry is making it out from the legacy here.

We've been heavily focused on the MDR aspects and then leveraging and extending the exposure management to the workloads there. But I would just say MDR is 1 of the top 3 budget spend priorities from also.

Your next question will come from Gregg Moskowitz with Mizuho.

Interesting announcement with Microsoft. And I'm wondering, Corey, if you could elaborate a bit on your expectations from this going forward? And is this purely a technology integration? Or could there be a go-to-market aspect at some point as well?

Yes. We're at the early stage of -- I believe it's starting with a technology, a deeper technology integration. But we've also been working heavily with the go to customer, their go-to-market teams. They're -- look, the issue is Microsoft is a great technology stack. We've actually been building out our technology stack aligned with theirs. They have a large installed customer base.

There's not a clear preferred sort of like top-tier partner that's actually delivering high-quality, efficient managed services on top of their stack. They're looking to build their partner portfolio. We're investing heavily behind that. But there's a lot of customers that have the defender ecosystem that we've now tuned and we're announcing more and more technology integrations to own it. That we can actually manage their technology infrastructure integration, leveraging our technology stack, do it at scale and do it at great cost economics for our mutual customers. And so we see it as an incredibly strong growth opportunity as we go forward. We're in the very early stages, but we have been working with both their technology teams on a frequent basis and their go-to-customer teams is picking up.

Your next question will come from Junaid Siddiqui with Truist.

Corey, you have mentioned extended deal cycles for some time now as your platform becomes more strategic. How comfortable are you getting with the visibility around the pipeline and close rates so to give you a better ability to forecast.

Yes, I think this is -- and this is why I said, listen, we do have a range of outcomes quarter as you go forward, one of Alan's top things is really to rationalize the process about how we manage the larger deal cycle. He's used to looking at these, and we have to really standardize the process. Look, we were somewhat -- we moved faster to competing in more of the strategic deals at larger ASPs. We were traditionally a mid-market focus lower.

I would just say like 40,000, 50,000 ASP company. And that's changed relatively quickly over the last 18 months, and we're getting our handle around that. That's impacted both the accuracy of what we communicated from guidance. But we also have to upgrade our processes and our systems for how we actually manage that, and that's a clear mandate and the focus that Alan's working.

Yes. And he has the experience doing that years of it. He's just a season the leader there.

So I actually think that, that will be not a problem as we go into next year. But that's also why we didn't want to actually sort of like have Q4 be a distraction around it because he's only been in a little over a month, and we did not want to have more precision that was warranted.

Your next question will come from Joshua Tilton with Wolfe Research.

Great. Totally understand the decision to put some incremental conservatism in the guidance for ARR for this year. I guess I'm trying to understand outside of that conservatism, what is the underlying momentum of the business. So my question is, assuming you don't see any disruptions, right, from these one-off dynamics -- are you still on track to hit the ARR guidance that we had coming into this quarter? Are you running below that prior ARR guidance that you gave? How do I understand what you're guiding to from an underlying momentum of the business, if that makes sense?

Yes, it does make sense. Look, we're not going to give you 2 guidances, just to be clear. But what I would say is I'll get to your core thing is that -- we still have the same, I would just say, pipeline that we expected to have in -- put in a couple of points. I won't be overly precise there. But we still have the same pipeline. What's really changing is that we're not actually attempted to be overly precise about how much of that pipeline lands in a specific time frame.

So what we wanted to give you was just an AR guy, when Tim said roughly sight, it was just like, hey, we know we can hit that we'll go forward. We'll tell you what it is and where it lands sort of like in Q1. I know that's not great. I just want to be clear about. I know that's not great. But it's also the right thing to do, especially as we have a new CFO and a new CCO to actually let us get a clean baseline and then we'll reestablish the cadence that we actually all want to have next year.

Your next question will come from Zach Schneider with Baird.

This is Zack on for Shrenik. So exposure command really feels like a big flagship bet for you guys. And I'd love to just hear more about what does the data really show today? Maybe our net new customers landing faster or larger with it. And then maybe what's the ASP uplift versus just legacy VM only? And what's the true ramp time line?

Yes, there's 2 dynamics. One, we're actually focusing on, again, tying the closure command into our overall services strategy with MDR, which is sort of like the early stages.

The second is that, yes, we're actually very focused on the upgrade because it aligns it around the overall NDR strategy, the upgrade of VM to exposure command. What we've seen so far is much, much larger deals in terms of ASPs. And lastly, like larger -- it's like over double the ASPs that we're actually expecting and so we've seen much, much larger deals at longer deal cycles than the smaller upgrades and that has not been -- and we were really focused on the upgrades. Again, we have not focused a lot on landing new for exposure command.

So we're focused just on the upgrades as the primary focus for this year, something that we talked about at the start of the year. And so we've not had the volume that we wanted to actually have on the conversions because the pipeline is of larger deals, even though we like the dollars of the pipeline, the size of the pipeline is larger and they're coming in store.

Your next question will come from Kingsley Crane with Canaccord Genuity.

Just wanted to double-click again on the Microsoft integration. -- as that scales, just could you speak more to any near-term investment required to support that at the engineering or sales level? And then do you have a sense of what portion of your customer base are already customers of both Rapid7 and Microsoft?

Yes. It's a little bit under half, but it's still a substantial portion of our customer base that is Microsoft. And frankly, we see a big opportunity to grow it. Like we look at this as primarily a growth opportunity. as we go forward. We've been working on the engineering for a while now. And so it's one of the investments that we talked about and we wanted to invest in earlier this year. We're not done.

By the way, just to be clear, we're not done, but we actually can do it within the resource outlook that we actually have available. So it's not incremental resources. It is the resources that we have on a -- this is part of why we're taking the opportunity to refocus and retune and realign the sales engine, though. Because it's not more salespeople, it is sort of like focusing and training and enabling our sales teams on the partnerships and the opportunities that we have in front of us, of which this is a substantial new one that provides net new opportunities.

Our sales leadership team has been asking for this. It's been one of the priority areas. And so taking the time next year to make sure that we actually start next year with velocity and momentum is a big deal. So it's not more sales resources, but it is time and focus to align that engine. And we decided that we wanted to do that as soon as possible, not wait to Q1 where if you wait to Q1, you don't see the benefit to the back half of next year.

Your next question will come from Rudy Kessinger with D.A. Davidson.

Could you just talk to us about gross churn and how that's trended throughout the year and your expectations for gross retention gross churn going forward.

Yes, it's a great question. Gross churn has actually been exactly where we expected it to be based on our last calls, and so that's not been -- we've had -- frankly, if you look at where the issue in the business is much more in the landing of new customer in the ARR and the deal cycles around debt than the churn. So what I would just say is we're expecting to see the continuing trends that we saw this year, which we're very comfortable with. As we go now MDR are larger and more strategic. They tend to be longer deal cycles and deal terms.

So as a business shift mix towards that. you do see a slightly upward tip on the gross churn dynamics in terms of improving, meaning you see higher retention rates. But that's more based on mix shift than anything else. -- on the type of business that MDR is. But the -- that's not been the big issue this year. Thus far, the primary thing is just that we're under the new customer ad ARR and expansion ARR that we expected. So it's a great question. I do want to clarify that. That's good to clarify.

There are no more questions at this time. I'd now like to turn the call over to Corey Thomas for closing remarks.

So thank you all for joining on the call today. I want to take this time to thank Tim Adams, our CFO, for his outstanding service for his time, for his partnership to both myself, the Board and the leadership team. Tim, I want to thank you. I want to acknowledge it since this will be your last call, but thank you so much for your time today. And I want to thank all of you for taking the time to join us on our earnings call today. Thank you.