Q4 2022 SecureWorks Corp Earnings Call
Okay.
Good morning, and welcome to the secure works fourth quarter and full year fiscal 2022 financial results Conference call.
Following prepared remarks, we will conduct a question and answer session. If you have a question simply press Star then one on your telephone keypad at any time during the presentation. At this time all participants are in a listen only mode. We're webcasting. This call live on the secure works Investor Relations Web site after the <unk>.
<unk> of the call recording of the call will be made available on the same site I will now turn the call over to Andrew Storm, Vice President of Investor Relations you may begin.
Thanks to everyone for joining us and Andrew Storm VP of Investor Relations at <unk> and with me are when do you Thomas our CEO and Paul Parrish, our CFO during this call unless otherwise indicated we will referenced.
non-GAAP financial measures you will find the reconciliations between these GAAP and non-GAAP measures in the press release and presentation posted on our website earlier today. Please also note that all growth percentages refer to year over year changes unless otherwise specified.
I'd like to remind you that all statements made during this call that relate to future results and events are forward looking statements based on current expectations.
Actual results and events could differ materially from those projected due to a number of risks and uncertainties, which are discussed in our press release web deck and SEC filings, we assume no obligation to update our forward looking statements now ill turn it over to Wendy.
Thank you Andrew and welcome everyone.
Just two and half years since initial launch can you just reached $165 million in IRR.
$42 million sequentially accelerating our business model transition.
We added a record 400 customers in Q4 to finish the year with 200 total pages customers of which over a third are now software only.
Our focus remains on transforming the company to higher value security solutions, and driving scale and operational efficiencies in the business.
As we actively exited non strategic lower margin services in fiscal 'twenty to total revenues declined by $26 million.
While non-GAAP gross profit increased by $5 million.
We invested in engineering and marketing talent with head count in those areas increasing in the high teens.
A shift away from non strategic services enabled us to reduce total head count by 13% versus year end last year as a result revenue per employee increased 10% and gross profit per employee was up nearly 15%.
Our transformation will accelerate in fiscal 'twenty, three as we increase investments in cages to capitalize on the market transition to xdr.
Managed down our non strategic services.
And the shift to <unk> is happening because it has to the.
The existing sprawl of point solutions operating independently and noise generated through legacy <unk>, it's too much for overworked security analysts to address leaving the adversary freed we've between existing controls and.
And until now no prior security solution has brought everything together properly.
Without that you end up with billions in ransomware payouts.
It's been clear to us that the way to defeat the adversary is a security first approach with a single big data platform Architected for holistic prevention detection and response.
And while others are catching on building a true xdr platform is not easy we spent over five years building this vision into tejas.
Creating effective analytics beyond a single control like the endpoint or firewall requires a data lake with substantial volume diversity and span of data.
Our data Lake and Jeff endpoint Network E Mail cloud and other forms of telemetry from thousands of customers every single day.
That's the foundation, we've built on.
Endpoint only providers, however, don't have the comprehensive visibility into our customers' network cloud or E mail.
Architecture is not designed to ingest and correlate all the disparate data across vendors.
Without comprehensive data the detection capabilities are incomplete.
Necessarily noisy and short you don't have a scalable xdr solution.
Even with the data it takes a fully operational dedicated threat intelligence team working with data scientists to research behavioral threat patterns and develop the detection analytics and rules that make xdr so powerful.
Tejas its further supplemented with the intelligence gleaned from our incident response and security operations teams not just by buying intelligence from third parties.
As an example, we recently filed a patent for our new hands on keyboards detector, which uses machine learning to detect threat actors not using malware, but local tools and malicious ways that would be too noisy for signatures to detect.
We started with a single true positive incident and went back through three three trillion process events in our data lake to find more examples we built a machine learning model trained it with this data and developed a detector with a true positive rate of over 99%.
This patent pending approach brings unrivalled capabilities in detection in the market.
And as soon as we released the detector, we felt multiple intrusions, where the existing security point solutions, we're not raising alerts this is extended detection.
The second key part of Xdr is the response.
Our purpose build xdr platform pulled together all relevant information and provides an embedded security orchestration layer with automated response capabilities.
These capabilities were designed to take us from day, one it's not a third party software bolt on or an after the fact acquisition.
And we constantly enhance our embedded workflow and response playbooks driving increasing levels of automation for customers with practices informed by our managed security services and incident response teams.
And our customers know we are in the fight with them everyday available when needed most with one of the top incident response practices in the world that handles over 400 engagements annually our customers know they have access to the right people whenever they need it.
The final component of a true xdr platform is active prevention.
What mobility management has long been akin to exercising to prevent health problems the.
The solution to most vulnerabilities of patching, yet organization still don't do it and the reason is simple like exercising patching can be time consuming and hard.
We've taken the pain away and brought a step change in automation, enabling a more hands off approach.
With comprehensive vulnerability detection and response.
It delivers a complete security program at a lower total cost of ownership.
Bringing this together a true xdr platform provides the prevention detection and response that extends well beyond the endpoint.
<unk> Big data intelligent security analytics live threat context, and the best of human Engineering and SEC ops.
Without unifying prevention detection response for the entire ecosystem onto a purpose built data and automation architecture youre not doing xdr no matter how much of the marketing says otherwise.
When we began building pages over five years ago, the xdr market didn't exist and until more recently wasn't viewed by industry analysts as a category.
Now we're consistently recognized for our clear leadership and the unique solutions we've built.
With a leading product in a growth market excellent NPS scores and our roster of customers advocating on our behalf. This is our time to capitalize on the market shift to xdr.
We are investing further in marketing and product in the year ahead to capture that opportunity and maintain our leadership position.
It's a testament to our team and the value of pages that we've historically spent significantly less on sales and marketing and public peers, yet delivered one of the highest growth rates and xdr customers and <unk> last year.
Looking ahead, we see multiple drivers of long term organic growth, including a continued shift toward xdr and away from Standalone point product based approaches to security.
The upsell of additional solutions.
Increased demand from targeted marketing investments the.
The shift of sales talent from repositioning existing customers as that work winds down this year to hunting for new logos and accelerating sales through our partner program.
We are at the tipping point year of our transition.
We've been building to this moment we've.
We began the repositioning program just over a year ago, and we expect to exit fiscal 'twenty three with a substantial majority of our air are on pages.
Underneath the noise of our transition we are building a higher quality business with a strong position in one of the highest growing segments of the cyber security industry.
And I want to thank all of our customers and partners for their support and.
And our teammates for their hard work and commitment to get us, where we are and to fuel the year ahead.
With that I'll turn the call over to Paul Parrish our CFO .
Thanks Wendy.
<unk> changes IRR increased $42 million sequentially, our largest quarter ever and 34% sequential growth rate.
Resulted in IRR of $165 million.
$10 million higher than guidance, 200% growth from last year.
And we had a record 400 pages customer adds in Q4, two and our year at 200 total pages customers.
Following our end of sales announcement customer re solution accelerators.
As a result, tightest IRR ended the year around a 60 40 mix of re solution versus organic.
Tejas subscription revenue was $85 6 million for the year up 165% year over year.
Reflecting continued strong growth.
It was below our expectations for two reasons.
First the majority of Resourcing deals closed towards the end of the quarter pushing revenue out slightly.
Second we continue to see a timing impact from customer delays in turning down their CCP security services.
As noted last quarter, we recognized revenue proportionately as customers Margaret, but we will continue to allocate a portion of other revenue to other MSS subscription revenues as long as customers have CDP services in place.
Average revenue per customer was approximately $135000 continuing to be at a premium to our non <unk> customers, which averaged $93000.
Increased <unk> solutions or some smaller customers led to a modest decline in average revenue per customer as we ended the year.
As we shed non strategic businesses full year total revenue declined $26 million, yeah gross profits were higher by $5 million.
We continue to manage our cost structure and solution mix, leading to improving gross margins of 62, 6% up 300 basis points from FY 'twenty one.
Sales and marketing costs were flat compared to FY 'twenty, one on an absolute dollar basis, although we shifted the mix of investment toward the channel. We continue investing to drive innovation on pages and maintain our lead as the threat intelligence and research reflected in a 15% increase in R&D last year.
<unk> expenses were down modestly from last year.
Adjusted EBITDA was $19 million.
Down from $33 million last year, reflecting better gross margins offset by investments in R&D.
Cash flow provided by operations in FY 'twenty, two was $17 million with capex of $8 million.
We finished the year with a record $221 million of cash no debt and an untapped credit facility.
Turning to our guidance for FY 'twenty three.
Keep in mind, we have a 53 week year and FY 'twenty three compared to 52 weeks in FY 'twenty two.
We expect <unk> to end FY 'twenty three over $265 million.
Compared to $165 million. This year, we expect organic growth to contribute approximately $50 million of the incremental IRR and sales should accelerate through the year as we get the full benefit of our investments carrying through to FY 'twenty four for changes in FY 'twenty three we're accelerating investments in brand.
Awareness and global distribution with returns expected to be more meaningful in the back half of the year and into FY 'twenty four.
We expect other MSS IRR to end FY 'twenty, three below $80 million compared to $224 million this year.
For our endo sell announcements, we have stopped selling these services with a few exceptions.
As a result, we expect $90 million to $100 million of IRR in FY 'twenty three to be either transitioned to partners move in house with customers our churn.
For the $80 million of IRR remaining at year end, we expect a significant portion to be eligible for re solution with most done in FY 'twenty four enabled us to aggressively manage out the excess cost.
We expect full year total revenue to be 475 million to $490 million with first quarter revenue of $120 million to $122 million.
For modeling you can assume approximately $9 million of revenue for the 50 <unk> week.
Full year adjusted EBITDA is expected to be between negative $58 million to $68 million as we invest for growth.
Got it reflects the following expectations.
Increased investments in sales and marketing by approximately $30 million.
Our investment in R&D is expected to increase approximately $20 million this year to maintain our market lead.
G&A is expected to grow slightly to $2 million.
We estimate there is approximately $30 million of duplicate fixed and transition related costs that we are incurring with $15 million of cost of revenues and $15 million and opex.
As we turned down or other MSS services, we will manage to related cost out positively impacting FY 'twenty four and FY 'twenty five.
Tejas subscription gross margins are expected to increase in FY 'twenty, three and beyond though total margins will be impacted by the duplicative.
<unk> and transition cost, resulting in overall FY 'twenty three gross margins being approximately flat.
Operating expenses in FY 'twenty four should increase on an absolute basis, but we will expect them to grow at a lower rate than FY 'twenty three delivering operating leverage that brings us toward our long term model.
Finally, EPS loss is expected to be in the 61% to 70 range. In summary, we are making consistent progress against our transformation with continued improvement in our business mix and growth potential.
The end of our business model transition is now in sight and we believe that it's increasingly clear we have the right product at the right time to lay the foundations for growth and profitability for the company.
Wendy will now join US again, as we begin our Q&A operator can.
Can you please introduce the first question.
I will now open the call for questions. If you have a question press Star then one on your telephone keypad as a courtesy to others. Please ask no more than two questions. We will take our first question from Mike <unk> with Needham <unk> Company. Your line is open.
Hey, guys. Thanks, Thanks for taking the question here.
Wanted to circle up I think in the prepared comments you had mentioned that.
Tejas revenue may have been slightly below what you guys were anticipating and the two reasons being the resolution deals maybe closing more of those at the end of the quarter as well as the timing impact from customers turning down their <unk> services.
Could you delve further into both of those dynamics.
Wanted to unpack that a bit.
Yes, yes, so as we built our expectations.
Our forecast of some improvement in the speed at which those customers would come off their own services and so that additional improvement didn't occur as well as we had a larger amount occurred later in the quarter, which is impacting the timing of the revenue recognized is tejas, we still have the revenue in our business.
Yes, I guess the color to that.
They are the company.
To pages, it's just a matter of the revenue being recognized by the company in other MSS versus pages.
So if you think about this this is more about a transition challenge not.
A lot of value creation.
Right right, So I guess.
The question on the other services turning down right. So.
Can you remind us again like what would cause the customer to hold onto those other services longer than expected.
And.
I guess the follow up would be when you. When you provide you. This guidance as we look to think about fiscal 'twenty three.
Is there some element of assumption as far as.
Customers may be turning those holes.
The slower than expected.
Sure So I can speak to the.
Some of the examples of the customer so in most cases. These are some of the larger customers who are transitioning and so the pace at which they are essentially turning off their counter threat platform monitoring as it was slower than expected.
And Theres a couple of things behind that one they're often just sort of checking twice to make sure there's absolutely no gaps and transition on their end.
The second piece that we've seen it's really some of them are struggling with staffing, particularly it staffing which is often required in supporting the security team in making this type of transition, particularly for larger customers.
And so that that's definitely been something that we saw in fourth quarter with overall sort of staffing challenges in the economy.
And then for some in a few cases.
No we've been working with them to transition certain services to partners or in house and so there has been some.
Examples where where that transition again, just dotting the i's and crossing the t's that transition has just taken a little bit longer.
Got it got it and one more if I could.
I know that you guys did provide a good amount of color when we're thinking about opex in the upcoming year.
The investments that you guys are calling out whether it's accelerating those investments in brand awareness I think the other comment might've been around sales and marketing initiatives.
Partners.
<unk>.
Can you get more granular on either one of those items.
I wanted to see how those dollars are expected to be deployed and is it.
Is the thought that it will be relatively evenly spread through the year or should we expect it to be more heavily front your focus back half focused.
Anything there again with the incremental thank you.
Sure well I'll speak to the business side, and then I'll have Paul speak to the to the spread piece. So for for US. This is really about doing the right thing at the right time. So we are in an ideal position to start to categorize on.
Finally, the market recognition of the sort of secular shift to xdr, beginning and with us having clear product market fit.
Customer advocates the third party recognition, both xdr space and our leadership in it now is really the time to lean in and what we've seen is as we are.
Get into conversations and do a proof of value we win the clear majority of those deals.
So frankly, given our lower sales and marketing investments to date.
This is a proof point of the value of the product when it's when it's been the customers' hands and the prospects hands and so this marketing spend is about investing to get ourselves into every single deal conversation that we possibly can because when that door is open we're going to win so for US. This is also hand in hand with doing this with our party.
<unk> right the xdr market education supporting them in their go to market.
And so as you think about the spend pieces. This is primarily around demand generation in what I'll call brand response, as opposed to sort of broad brand awareness and the partner support pieces of that are absolutely integrated into that and then to a lesser extent, what I would call that continued xdr.
Education of why it's the right security solution and to some extent some of the third party recognition and customer advocacy support work.
So really very targeted the majority of the spend very targeted to two.
The areas, where we've seen increasing win.
Rather than what I would call sort of broad generic brand awareness and then I'll turn it to you call and we step into the spend in Q1 and so we believe in this and we believe it's the right thing to do at this time, so we step into that and there's a slight increase in Q2, but.
Considered equally split during the rest of the quarters beyond that.
Thank you I'll cede the floor guys. Thank you very much.
Thank you. Our next question comes from Sterling Auty with Jpmorgan. Your line is open.
Yeah. Thanks, Hi, guys, so im wondering and good morning.
60, 40 split that you talked about now what should we think about that split being as you exit this new fiscal year.
As we exit fiscal 'twenty three.
So definitely safe to use that that 60 40 split for the organic growth in.
In fiscal 'twenty, two alright, so still a pretty healthy balance between the two but as we accelerated the transformation with the end of life and frankly just.
The ability to have had more customer conversations thats, how we ended the year.
And Paul's remarks in terms of FY 'twenty three we've guided the organic growth piece should continue to expand.
That $50 million or more organic guide implies basically a 30% growth rate on the current total base for organic and we're <unk>.
Confident in that guidance.
And all of that is still buoyed by tailwind from partner program traction obviously, the marketing things, we just spoke about and this continuing shift of the the puck moving to xdr.
In the broader market.
And then the one follow up would be alright, with that under $80 million.
MSS IRR that that's less exiting fiscal 'twenty three what's going to be the thought process in terms of what type of carats versus what kind of sticks that you can use to kind of motivate that tail to finally convert over.
So for for a piece of that.
It's based in Asia, where we are deploying some market specific platform capabilities. So so a big chunk of that is really our our timing choice not to engage a section of customers. If you will but for the remainder it's really.
Having all of those conversations now.
It's really about planning with them in terms of their own.
<unk> business priorities to make that transition as opposed to.
Needing to provide particular carrots, where we are now in the conversations it's more about <unk>.
Timing of transition than then.
Whether to transition or that.
Need for a special incentive.
Understood. Thank you.
Thank you.
Our next question comes from Hamzah <unk> photo Waller with Morgan Stanley . Your line is open.
Hey, guys. Good morning, Thank you for taking my question.
One question.
Question for you on the Xdr strategy.
So one of the things you mentioned was the.
The data ingestion and the data Lake component it seems to me with <unk> one of the one of the.
Issues is not only how do you ingest the data from multiple vectors within your organization from a network endpoint cloud et cetera, but also how do you standardize that.
<unk> you.
Analyze it properly and action upon it from a security standpoint, so I'm just curious how youre going about doing that because it seems like in security were just really far away from having open telemetry model. So.
When you think about the analysis portion is that where your.
Analysts and your threat Intel experts come in and provide that human level assistance or is there. Some other secret thoughts that you guys.
Had that we're not aware of.
It's a great question and thanks for it because you're you're right part of the importance here is one having that broad data set in the data lake for us that means cutting across the entire ecosystem. I mean, if you look at our telemetry that we're processing.
The market really talks a lot about endpoint, but that's probably only about 40% of the of the events that we're processing day to day, because there is a way that the anniversary weaves through the environment that that is important to have a holistic perspective.
So it is absolutely the case that we leverage our experience our teams into response adversarial testing our security operations teams to basically understand penetration techniques and then how to reverse engineer them for defense and basically make those.
Learnings machine readable, if you will across this big data platform, but the foundational piece that you mentioned at the start.
It's not just ingesting that data and generating a bunch of alerts. It is very easy to detect anomalies, but it is hard to not bury those anomalies in a massive haystack of noise and the way that we do that because of our experience working across.
Every every point product in the industry as a service provider historically.
Our understanding of that telemetry and normalization of that telemetry to then apply these techniques to the detection cross that telemetry is the secret sauce that lets us have not just detection, but high fidelity detection that.
Have high probabilities of potential damage that lets us really get to remediation quickly leveraging the automation on top of that of course to speed time to to to remediation.
Is the answer that a true xdr platform should be providing using relevant big data.
That is.
Leveraged in a way with detection understanding that is based on our knowledge of the threat actors techniques.
Got it I'll keep it to one thank you.
Sure.
Thank you. Our next question comes from Keith <unk> with Barclays. Your line is open.
Good morning, Great, Hey, guys, Hey, good morning, Wendy. Thanks, Thanks for taking my questions here, maybe just to start with you Wendy and apologies. If this was asked I joined I joined a little late but.
With all the focus on Xdr can you just talk a little bit about how much you are displacing traditional sim.
Instances radar installations, let's say versus perhaps co existing with a traditional sim.
Side your customer base.
So it's a good question and it is an evolving answer to that over time right as both the understanding of xdr grows and frankly customers come up for.
Renewal or replacement of that based on their contract lengths with that knowledge of xdr now getting more clear. So there was in the beginning much more sort of a coexistence, let's see how this goes let's use the data from where we are but very much now the the understanding that you can essentially.
<unk> addressed all of the use cases of Sem plus and do it better.
At a more.
Reasonable cost of ownership.
With and Xdr platform like pages, we increasingly see that as an opportunity to shift share of wallet.
While giving customers better ROI, and frankly, better security outcomes from it because if you think about what you are looking at here, it's about the ability to ingest relevant data, but again to make it information not just data.
To enrich that with user and asset context and for our customers. The fact that we are really helping to build and maintain those detectors or work with them to build those.
Makes that that <unk> platform much more relevant on an ongoing real time basis than a stand that can be very difficult to maintain and frankly can be expensive from a from a data perspective.
Got it got it Paul maybe for my follow up for you and again apologies. If this was mentioned earlier, but.
Either quantitatively or qualitatively.
As you look at sort of your maybe looking backwards.
Look at your traditional MSS space, what percentage of them chose to re solution with tejas versus maybe explore other options and I think I heard you talk about sort of average revenue per customer.
Earlier I wasn't sure if that was on a total basis, but the second part of that question is when and MSS customer does choose to re solution. What's the typical uplift you see.
After that event takes place.
Yes, so I think all of our customers are excited about the.
Tightest products. So when you ask about that all of them are listening all interested all trying to determine for their where they are in their work.
The right time for them and so we see interest across the board. So if you are asking the interest level very high across all customers.
The actual plays into effect customer either risk solutions were not where are they in their work on their technology.
On your average revenue per customer, we're seeing roughly that <unk> customer is coming in at roughly where we're selling new logos.
And we're very happy with the average revenue per customer.
Yeah and for comparison.
130, 535000 on pages compares to low 90, so I think it's 93000 on the.
TTP platform. So we continue to see higher average spend with the again the same same situation theyre up shifting their entire posture for full coverage of their estate.
And are able in some cases to displace other standalone spend which is now a feature of the of the platform. So that that trend continues.
Got it very helpful. Thank you.
Thank you.
Thank you we will now take our final question from me.
Brian Essex with Goldman Sachs. Your line is open.
Hi, This is Charlotte on for Brian a quick question.
See the record number of pages customers archaea.
<unk> 400 can you talk about how many of these <unk>.
Net new logos versus conversion of your existing base. Thank you.
Yes, we talked about on the call that in terms of our growth for the year the base of.
Tejas <unk> is about a 60 40 split we haven't seen a material shift in the <unk>.
Average revenue per customer and so those have generally been following the same the same mix shift.
Got you and another question on pages.
Now that you with your endpoint partnership that you announced last year have you seen a shift in the competitive landscape or what have you seen any changes.
In terms of the.
I'm not sure exactly which.
In terms of the endpoint nextgen.
<unk> is what you're referring to.
Quite a few ancillary partnerships, yes, absolutely we've seen nice traction from that again, the whole strategy behind that is giving customers. The option for one stop shop, we do find that customers in the lower end of the mid market tend to want.
Simplicity simplicity and pricing vendor engagement and capabilities to our customers on the larger end of the market sometimes want to.
<unk> individual security controls and then bring them together with Tejas xdr.
For us that again is just about capturing share of wallet, making things simple and easy for customers to partner with us.
And just makes a ton of sense for for the.
The capabilities of our holistic xdr platform.
Great. Thank you for the insight.
Thank you.
Hi.
There are no other questions in the queue I'd like to turn the call back to Andrew for closing remarks.
Yeah.
Okay.
Great well I wrestled for Q&A in todays call a replay of this webcast will be available on our Investor Relations page of <unk> Dot com, along with our Q4 web deck and additional financial tables. Thank you again for joining us today.
Thank you.
Ladies and gentlemen. This concludes today's call you may now disconnect at this time.
Okay.
Great.
[music].
Thanks.
[music].
Okay.
[music].
Okay.
[music].
[music].
[music].
[music].