Q1 2022 SecureWorks Corp Earnings Call
[music].
Good morning, and welcome to the secure works first quarter fiscal 'twenty 'twenty 2 financial results conference call.
Following prepared remarks, we will conduct a question and answer session.
If you have a question simply press Star then 1 on your telephone keypad at any time during the presentation.
At this time all participants are in a listen only mode. We are webcasting. This call live on the secure works Investor Relations website.
After the completion of the call a recording of the call will be made available on the same site.
Now I will turn the call over to Paul Parrish, Chief Financial Officer, you may begin.
Thanks, everyone for joining us with me today is Mike <unk>, our CEO and Wendy Thomas our president of customer success.
During this call we will reference non-GAAP financial measures, including non-GAAP revenue gross margin operating expenses operating income net income earnings per share.
EBITDA adjusted EBITDA and cash flow from operations.
A reconciliation of these measures to their most directly comparable GAAP measures can be found in our web deck and press release, which are available on our IR website.
Please also note that all growth percentages refer to year over year change unless otherwise specified.
Finally, I'd like to remind you that all statements made during this call that relate to future results and events are forward looking statements based on current expectations.
Actual results and events could differ materially from those projected due to a number of risks and uncertainties, which are discussed in our press release web deck and SEC filings.
We assume no obligation to update our forward looking statements.
Now I'll turn it over to Mike.
Paul and thank you everyone for joining us on this call I appreciate your interest and secure works.
4 I discuss the quarter I am announcing my upcoming retirement as CEO and a member of the <unk> Board of directors effective September 3.2021.
It's been an incredible pleasure and honor to have served as CEO of secured for almost 20 years.
I, Thank our board of directors and all of my <unk> teammates over the years for this incredible opportunity.
When I joined secure work from 2002, we were a small team with a vision to protect organizations from the growing threat of cybercrime.
Now nearly 20 years later <unk> is a global leader in cyber security with the best threat intelligence and products to secure our customers and partners.
We have grown from less than $1 million in revenue to over a half a day.
We had a great first quarter, which you will hear more about in a few minutes and we continue to execute on our strategy.
Our future is even brighter as our momentum in pages customer acquisition revenue and <unk> continues to accelerate.
I put a lot of thought and preparation into this decision.
Working closely with the board in recent years to prepare for this transition as we implement our succession plan.
As a result, I am pleased to share that with my full support and recommendation to secure its board of directors has appointed Wendy Thomas to succeed me as the Companys next president and CEO effective September 3.2021.
Wendy has been with Secureworks for 9 years and has been instrumental in driving the company's strategy, including our focus on software development and the launch of pages. Please.
Please join me in congratulating Wendy.
Thank you, Mike it's a privilege to serve as our next president and CEO.
Brad a pivotal point in our business and I am confident that the momentum of our transformation will drive value for all of our stakeholders.
We'll be working closely with Mike in the coming months to ensure a seamless transition.
And I'd also like to thank Michael for his leadership and Mentorship over the years, Mike has built the company into what it is today and I know I speak for so many and wishing him the very best.
Now I'd like to turn it back over to Mike to go through the business results.
Wendy.
Wendy will also join me and Paul to answer questions. During the Q&A at the end of this call.
As I look across the threat landscape organizations are facing an increasingly complex and hostile threat environment.
Conventional point products operating in silos are not keeping up with the adversarial tradecraft, resulting in an increasing number of breaches org.
Organizations need comprehensive visibility into our it infrastructure and efficient protection in response to attacks but.
But the market is overloaded with more and more point products that increased complexity and we continue to have a shortage of security talent.
In light of these challenges our security products and expertise have never been in greater demand.
Pages are cloud native security analytics platform defense against these evolving attacks.
Enriched by our firsthand threat intelligence.
This provides threat detection and response across endpoint network and cloud and offers a single solution for Sim Xdr and sort of use cases, we have made pages and open platform with hundreds of third party endpoint network cloud and threat intelligence integrations.
By correlating events from these tools, we provide the comprehensive visibility customers' needs while maximizing their existing investments.
Let me give you an example.
Recently, an employee 1 of our customers clicked on Lincoln and E mail, which downloaded and executed a malicious script almost immediately the customers third party endpoint product and pages SDR bulk triggered an alert.
However, the endpoint product triggered hundreds of times for similar alerts across 30 different systems within the customers environment.
Using the same data pages focussed on the behavioral aspect of the event.
Embedded with our deep intelligence of how attackers operate pages is able to separate the true malicious activity from the noise.
Only alerting the company 1 time with the real threat.
In addition, the attacker has successfully loaded a remote access tool onto the system moves.
Moving beyond the visibility of the endpoint product.
Can you just identify this attack pattern and cutoff the intrusion with no harm to the customer.
This is why <unk> is so powerful it fills the gaps and visibility between point products that adversaries exploit providing a holistic defense.
Moving to results.
Our first quarter marked a strong beginning of the fiscal year with clear progress.
Pages, IRR has grown to $72.4 million and 17% of total IRR.
Importantly pages IRR growth on an absolute basis continues to accelerate with $17.5 million added to <unk>. This quarter up 35% from $12.9 million in the fourth quarter of fiscal 'twenty 1.
Pages revenue reached $14 million and the average revenue per <unk> customer was approximately $143000.
We ended the quarter with 500 customers on the pages platform up 25% sequentially as we added 100 customers in the first quarter.
Finally, even as we're scaling pages, we achieved total gross margins of 62% the highest in our history.
When I speak with customers and prospects they consistently ask for 3 things.
1 the best security expertise and intelligence backed by machine learning and data science delivered in real time.
Without security experts needing to tune their numerous products for each new threat tactic.
2 full visibility of their environment to clearly see how attacks spread throughout their network. So when they respond the entire attack is shutdown.
And 3 they do not want to rip and replace their existing security infrastructure.
Pages xdr solve these problems.
For example, we recently signed a contract with a large north American conglomerate.
They wanted a software solution that could detect and respond to threats across their environment and health <unk> save time by focusing on severe or critical alerts.
Before they became a customer the pages xdr demo gave them full visibility across their environment demonstrating its detection power.
Now they receive high fidelity alerts that are automatically enriched with threat intelligence from our <unk> research team.
They have real time access to secure works chat with an expert to help with their investigations.
And reporting capabilities that provide the full story of their security program to share with their senior management and board of directors.
Share feedback has been very positive so I feel confident in their security and they're pleased with their choice of pages over other competitors.
Now, let's talk about the progress on our portfolio.
We're proud to announce that pages managed xdr or MTR solution was named a leader in the force for 2021 MTR wave.
While this recognition is gratifying the team is focused on driving further enhancements.
We recently released our pages xdr adversary software coverage tool.
This new tools shows granular detail on real threats as mapped by the Mitre attack framework and how pages detect these attacker tactics techniques and procedures.
With pages as xdr coverage now provided across 92% of the latest framework.
And with research from ESG, showing at 76% of xdr customers would reduce or phase out their sim.
Based on Xdr is improved detection and response capabilities.
We are well positioned to benefit from this market shift.
Finally, we're making continued progress on our go to market effort.
As a reminder, we are investing significantly in our channel strategy to build momentum in the secured partner community, including an MSP track.
This push into the channel provides 2 key benefits first.
A robust partner program will help us accelerate cages sales.
Msft's get to add our leading software capabilities to their portfolio.
Managed service providers can extend into security services by leveraging the pages platform and applications.
In addition, our MSP partner certification program addresses 1 of the fundamental challenges in our industry.
Lack of security talent.
We know this market better than almost anyone and have the unique ability to train MSP and empower them with the same software we use.
Our first Msft's have been trained and certified and are now selling pages.
We are also excited to share that Dell announced a new managed detection and response service powered by pages Xdr.
This partnership unlocks the Dell relationship in a way that wasn't possible before expanding our reach to tens of thousands of organizations that trust Dell for their it.
Security and services needs.
Make no mistake there is a lot of enthusiasm in the channel to get access to our software investigation workflows and threat intelligence.
The work that we put in today is the foundation for our growth in the future.
Looking ahead, we continue to remain laser focused on 3 goals.
First innovating and expanding the pages platform.
Ensuring the protection and success of our customers and finally accelerating our go to market.
In closing I am pleased with the progress we are making to strengthen the security community.
Our work enables contributions and sharing from across the security landscape to collectively beat the adversary at scale.
I will now turn it back to Paul.
As noted in Q1 or <unk> $72.4 million at quarter end revenue grew to $14 million and we finished with 500 customers were most excited to see our IRR and customer minimum is accelerating sequentially reinforcing our conviction that we can significantly scale the platform.
Q1 revenue was down 1%, primarily driven by a reduction in non strategic areas of the business as we pivot towards <unk> growth opportunities.
Total subscription customers were 3600 down from 3800 at year end.
Contagious customers increased from 400 to 500, while managed security subscription customers decreased by 300.
While our total subscription customer channel is declining we see a shift to better long term economics, whereas changes customers have an average IRR of $143000.
Liam IRR per customer lost in Q1 was $22000.
Gross profit margins were 61, 9% up 170 basis points sequentially, and 380 basis points year over year.
Sequentially, we benefited from strong demand and incident response, resulting in high utilization of our teams favorably impacting overall gross margins, while we were continuing to scale changes.
Year over year, we've seen significant improvement in our subscription based solutions margin and expect a longer term benefit.
From improving mix as our mix of software sales increases.
Operating expenses were up 1%.
R&D expenses increased 19, 4% of revenue up from 16, 1% in Q1 fiscal year, 'twenty, 1 and we capitalized $1.6 million in incremental R&D spend as we accelerated investments in our security analytics platform.
Sales and marketing expenses were 25, 6% of revenue down 40 basis points.
And general and administrative expenses totaled 13% of revenue down from 14, 5% last year with the difference primarily attributable to professional fees and consulting costs last year.
Adjusted EBITDA margin was 5.8%.
Turning to cash performance and the strength of our balance sheet cash flow used in operations was $36 million with the Q1 used driven by our annual performance payouts, along with an increased working capital.
Capex was $2.3 million from the first quarter, including $1.8 million of capitalized R&D investments in stages, and overall increase of $1.3 million year over year.
We ended the quarter with $181 million.
Of cash and an untapped credit facility.
Now for our outlook starting with changes for full fiscal 'twenty..2 we continue to expect Jacobs IRR of at least $150 million, which translates to revenue of $90 million to $100 million.
We expect continued strong growth in new customer acquisitions, accelerating as we ramp and leverage our channel sales and marketing investments.
Further we anticipate an accelerating portion of our existing customers will transition in fiscal 2010 as they look to benefit from the additional capabilities offered by the platform.
We remain committed to providing incremental disclosures as the year progresses and look forward to updating you on that in the future.
Providing guidance from the press release, so I won't go through all the details, but a few points to call out.
We are raising our full year guidance and now expect revenue of $540 to $550 million adjusted EBITDA of negative $5 million to positive $5 million and a non-GAAP loss per share of 13 to force.
We are increasing cash flow from operations guidance to breakeven to positive $2 million Capex.
Capex has increased to $7 million to $10 million range as we capitalize additional pages software development overall is an exciting year for the company in a pivotal transition period. There is a lot of work to do and our focus is on executing against this transition to capture the significant value we see.
Mike and Wendy to join me now for Q&A operator can you. Please introduce the first question.
Thank you.
I'll now open the call for questions.
It did have a question. Please press Star then 1 on your telephone keypad as a courtesy to others. Please ask no more than 2 questions.
We will take our first question from Sarkis <unk> with Barclays. Your line is now open.
Okay, Great Hey, good morning, guys. Thanks for taking my questions here and congrats to both Mike and Wendy on your next chapters.
Thank you good morning, Thank you.
Good morning.
When do you maybe just to start with you and Mike feel free to chime in here.
But maybe maybe you could talk a little bit about what youre seeing as as core MSS customers.
Have the option to convert to MTR.
Or let's just say convert potatoes, what sort of churn rate are you seeing as those customers make that decision and Conversely, what sort of run rate opportunity are you seeing that.
Some of them do make that conversion so that makes sense.
It does yes. Thank you for that so the great news is that all.
Our MSS space makes sense.
Great.
Target for conversion to pages and as we've talked about before we started a more formal program around that.
In the fourth quarter of last year, and we're actually seeing acceleration of that conversion rate to tejas, just as we see an acceleration of new customer adds to tejas and what's been.
What's been great is that we see them on average actually increased spend with us in that process and that primarily comes from.
Increasing the coverage to their full environment right across endpoint cloud network.
Business systems, and so they both gain in terms of efficacy.
Efficiency because of the extension into investigations that are more automated and response capabilities. So does that an added benefit in ROI for them and an increased capture and spend for us.
You see that NR.
Increasing total average revenue per customer and that's driven by those those higher average revenue per heritage of customers.
That's great very helpful. Maybe.
Maybe for my follow up for you Paul I think you touched on this a little bit in your prepared remarks, but I was wondering if you could just talk a little bit about the differences in gross margin profile.
Across sort of let's just call. It the 3 main parts of the business right MSS SaaS and Src EBIT, even anecdotally just to sort of get a sense for kind of how that that shift could kind of play out over time.
Yes, we talked about this some in the Investor day.
And we got that last December.
Haven't disclose at that level of detail in our numbers and as we continue to explore disclosures going forward.
Clearly thats something that we will look at a value way over time as the size and scale occurs with our pages deployment.
So.
Look at I think.
<unk> discussed in the past our Src margins are ones that were happy with.
But of course over time, we see the tightest margins as we sell more and more software only those margins will grow.
<unk> from that so the size and scale is very important to continue that growth of the gross margin curve as Pedro is deployed.
Got it very helpful guys. Thanks again.
Yes.
Thank you. Our next question comes from the line of Mike <unk> with Needham <unk> Company. Your line is now open.
Hey, guys. Thanks for taking the questions. This morning, and congrats on the strong quarter was curious if we could dig into the gross margins pull it.
You had a comment that there was a partial benefit from higher utilization of your teams regarding the strong demand for instant response and I'm curious can you help us think about what that benefit was to the quarter.
As we're trying to look out for the remainder of the year.
Gross margin should normalize downward if that answer that we're supposed to main line. So.
Well, we did benefit from that and we're very proud of our teams how they responded to everything that's going on.
The world as we all know from reading the newspaper.
The margins benefited we didnt disclose how much that benefited from but keep in mind as we go through this year. This is a transition year for us as we're ramping up the efforts around pages.
Gaining scale and size with customers on that and there'll be pressures on margin as you go through the movement between our customer base.
Could.
The improvement from IRR, that's something that comes as the demand develops and we all know that strong in the economy right now, but that's not something we control, it's what's happening in the environment.
Understood Okay.
I guess the other question that I had for you I know that you guys have been investing in the MSP track as well as.
Sales and marketing in general.
I'm curious with this decline that we saw.
In Q1 at least on a year on year and sequential basis.
How should we think about sales and marketing as we move throughout the remainder of the year.
Yeah, So we're going to be continuing to invest in sales and marketing as we ramping a channel of distribution up there'll be cost from the front end.
We will see that effect.
FY 'twenty 2 as part of the transition year.
Great. Thank you guys.
Thank you.
Thank you. Our next question comes from the line of Hamzah firewall with Morgan Stanley. Your line is now open.
Hey, guys. Good morning. Thank you for taking my question and congrats to Mike on the retirement and congrats to Wendy on the on the new CEO appointment.
Thank you. Thank you.
Maybe for my first question for Wendy and Mike.
Just around sort of the momentum youre seeing around.
The partnership ecosystem so.
You announced some new distribution partnerships 4 pages I think I read 1 in Asia Pac.
Can you talk a little bit more about how you're trying to bring on sort of net new distribution partners.
Tangible book Dr platform, and then I have a quick follow up for Paul.
Sure I can I can talk a little bit about that so I'm glad you had the recent announcement and as you know we have been.
Focused on building out our channel program and there is sort of a.
A 2 part.
Focus to that the first was really starting with <unk>.
Expanding our distribution and retail relationships and the second which was launched more recently.
In May is the managed security service provider partner program.
And.
No small part of that MSP program is continuing to work with <unk>.
Distributors and resellers on that.
First part of the.
The strategy with respect to channel to really create this force multiplier for us to address frankly, a growing growing market opportunity and extend the reach of the platform.
Really pleased with the momentum of the number and the quality of partners and distribution partners that we've signed up to date I think youll see us continue to to grow and announced partnerships and see traction from that overtime over the course of the rest of the year.
Got it helpful and then just the quality for Paul.
Paul you mentioned some of the transition impact.
<unk>.
But at what point do you think we can get to a point, where we reached.
Reached an inflection point and overall IRR, where it starts to grow again is that going to be beyond FY 'twenty 2 could we see that potentially later this year any color you can give us there.
Yes, so we haven't given guidance beyond this year.
And we're going to give any guidance on the AUR related to Tejas, which we're excited about the growth percentages as we grow up to greater than $150 million in IRR. So.
Yes, we did.
Some of this when we had the Investor day and you can go back and look at the growth that we talked about during investor day, but look out beyond the FY 'twenty 2.
For that occurrence.
'twenty 3 wouldn't be outside the norm.
Some expectation.
Thank you.
Thank you.
Our next question comes from the line of Brian Essex with Goldman Sachs. Your line is now open.
Hey, good morning, Thank you for taking the question.
1 day and Mike Congrats from me as well when you are looking forward to working with you and best of luck on your on your next steps.
Brian Thank you.
Maybe maybe if I could.
Digging a little bit to the customer growth. If we look at if we look at the pages customer growth just wanted to get a better understanding of.
Where those customers are sourced from how many are conversions from the existing installed base.
And what is the primary motion.
Customer acquisition on the <unk> platform at this point.
Okay.
Yes.
So the growth coming roughly half from existing customers have from new logos and the excitement around pages is causing many people to look at our product with excitement.
Purchasing it and so we're excited about that I think over time the growth in new logos will continue to go up the curve and the existing customers will come down as a percentage, but roughly 50.50 right now.
And now I'll just add in as we mentioned we are seeing accelerating momentum in both new customer additions and the number of customers that are re solutions onto the platform sales see that combined kind of fuel to the to the growth and in terms of total logo count the pressure you see is real.
Around.
The the.
Churn of much smaller customers. So the median customer that that we last had a average revenue of about 25000. So it's just a reflection frankly of the shift in our business model kind of further upmarket.
<unk>.
Powered by that.
But the momentum that we see on both sides of the house on pages.
Right right.
That makes a lot of sense. So thank you for that and I guess, what is that process like if you.
Within the installed base as you've identified or I imagine you identify customers that are that are kind of ripe for conversion how far are we through that process and does that become a competitive process or this is this the catalyst for.
<unk>.
Customers to evaluate other options outside of <unk>.
Outside of secure works.
Or.
Do you have a natural.
Benefit as an incumbent in that relationship and Youre familiar with the platform and you've already started that education process. So that you kind of grease the rails so to speak.
On board existing customers from conversion on the pages just wanted to get a better understanding.
How that process manifests itself in net customer growth.
Yeah, It's a great great question and as I mentioned as we've.
As we've gone on this journey with our customers starting late last year, we've certainly improved a few things that.
You touched on.
First and foremost we've always approached this as making sure that for our customers that feels like an upgrade experience. We do have the advantage of knowing them.
Very very well right, we know everything about their their environment and their security use cases, and so we make that process as <unk>.
Painless and seamless as possible the second thing to your point about potentially exposing this to become a competitive bidding situation. What we've done is approach customers, who are the right fit now and that makes sense for them regardless of when their contract end date is and in fact, it's been better to have that conversation well in advance of their renewal.
Date.
Because we are perfectly fine to exchange.
Contractually committed spend from 1.1 platform or set of solutions to the other and that tends to not open up a competitive situation as our competitors unlikely to do that.
Got it that's super helpful. Thank you very much.
Thank you.
Once again, if you do have a question press star 1 on your telephone keypad Thats Star 1 to ask a question.
We will now take our final question from Sterling Auty with Jpmorgan. Your line is now open.
Hey, guys, hopefully last but not least Mike.
Mike It just seems like yesterday that we're standing at.
At RSA, having our first conversation so congratulations on.
Wonderful 10 year growing and company from as small as you started to where you are now.
No small fee, Wendy congratulations and well deserved on the appointment.
Thanks, very much Sterling was that was that RSA event 20 years ago or 10 years ago.
Yes, exactly I am just going to say, yes and leave it there.
Good answer.
So I just wanted to dive into stages in terms of the customer profile given the average size it would seem that it looks like it's trending towards a larger customer.
Curious if you can give a sense of where youre seeing the sweet spot of the land and then I have 1 follow up.
Sure I'm happy to take that so so you're right and you can obviously see that reflected in that and they're growing revenue per and then as we've talked about before we really target what we would.
Term sort of mid market in terms of security program as opposed to necessarily the size of the customer because.
Clearly in the financial services sector for example, highly highly mature customers who have been.
Dealing with regulatory compliance around security and just frankly being the target.
Of attacks early early on the day of advance much farther than necessarily from other industries and so what we talk about is it's really customers who.
Are willing to invest in security, but they might have a very small security team with kind of a roadmap and a desire to to increase their maturity with a partner like us or folks who put together sort of best in breed solutions and they're looking for a platform to basically help them scale across all of their point products in place.
And drive kind of efficacy and efficiency across their security stack.
Whether they're assembling those solutions or theyre looking for a partner to run security with them that tends to be our sweet spot.
Of of both new customers and customers that are transitioning over and they are willing and able to invest in our security program, that's really driving an amount of spend with us.
Probably the right business model for us.
That makes that makes sense and then on the new logos that you brought in I'm curious who are you seeing as the final short list of vendors that are buying for those opportunities and are you actually in all these cases going through some sort of official RFP or are they.
Just looking to you as a vendor and they're not really going through.
A full blown bake off process, they're just coming to you because your expertise in the industry.
We really see a mix of both.
Well I'll say this we definitely see customers that common straight to us simply because of our reputation in the marketplace.
We also have customers who do.
It's easier term, a bake off but not necessarily kind of a formal RFP process and I think that's related to the to the target segment that we primarily operate in.
They are doing that sort of comparison shopping I would probably call it.
The ability to to frankly deploy our demo in their environment and immediately start to see detection.
I hadn't seen before tends to help us and to do that not just on their endpoint or in a container environment, but to be able to see that holistically across their network.
It tends to help us.
Have a pretty high win rate as soon as day sort of see what theyre dealing with so they may or may have other players and they're doing a similar demo who want to.
But in their own proprietary tech stack.
We tend to win with this open platform approach.
Right and competitively when you see who are you compete what products you're competing against most frequently.
While there are certainly some emerging xdr players who may be in the mix or it may simply be a.
Sort of a bake off of of <unk>.
Security spend our share of wallet as we introduce.
<unk> capability as recently around sort of covering many of the same use cases and can help customers reduce their sort of total cost of ownership sweat with features and our xdr platform that cover use cases for other point products that also tend to help us win and those types of share of wallet.
Sure.
Makes sense. Thank you.
Sure.
Okay, well thank you.
Perhaps the Q&A in today's call.
A replay of this webcast will be available on our Investor Relations page of secure works Dot com.
Long with our Q1 and full year fiscal 'twenty, 2 web deck with additional financial tables. Thanks.
Thanks, again for joining us today and have a good day.
Ladies and gentlemen that concludes today's call you may now disconnect at this time.
[music].
Okay.
[music].
Yes.
Okay.
Yes.
[music].
[music].
[music].
[music].