Q1 2023 SecureWorks Corp Earnings Call
Decision makers.
That xdr is their number one security priority in the next 12 months and 60% of those had plans to invest and Xdr solutions in the next 12 months.
Why.
Security professionals recognize is that securing endpoints or networks individually in a siloed approach does not work.
Point solutions leave critical gaps in visibility and aggregating multiple logs often fails to yield critical detection or Barry security professionals in a sea of alerts Fred doctors have learned to weave between point solutions staying out of sight.
Xdr is the clear solution to this.
But even with xdr companies are faced with another T choice do they go with a proprietary or open xdr model.
To our customers the choice is clear.
And their view and xdr solution that only operates on a proprietary stack.
It removes optionality with vendor lock in and introduces risk in force Rip and replace approach.
The head of security operations at one of our customers said it best by leveraging secure works open xdr approach, we won't have to lock ourselves into vendors and short secure works as approach to xdr future proofed, our customer security program.
And that's reflected in our <unk> numbers, which continue to demonstrate one of the fastest customer and <unk> growth rates in the market with the addition of 900 customers since Q1 of last year.
And the addition of over $100 million of Cajun <unk>.
That represents nearly a 150% year over year growth.
And we ended the first quarter at $180 million in <unk>.
Our focus this year remains on delivering high value security solutions to the market and making targeted investments in pages to capitalize on the market transition to xdr.
In terms of our strategic transformation, we remain on track as we continue to re solution are counter threat platform customers potatoes, and manage out non strategic services and resale revenue.
In first quarter, we arrived at a key inflection point in this transformation journey.
We ended the quarter with nearly 50% of total subscription <unk> and.
An important milestone for us.
In parallel we continue to drive gross margin expansion or.
Our combined TTP and changes subscription gross margins were 69, 9% this quarter, an increase of over 200 basis points versus first quarter last year.
So why now and why secure works.
From our customer's perspective pages helps future proof them in three ways.
First <unk> was designed from the ground up with a purpose built big data architecture that delivers a new holistic way to see and analyze and act upon security data.
And to do so it leverages all the data.
Data from endpoints not just data from networks, nor from just a single public cloud provider.
<unk> was designed to gather petabytes of data and apply its unique detection capabilities bind and prioritize security alerts.
For example, this quarter, we signed an international law firm, who came to us from a competing xdr provider that was network centric.
The customer initially thought to implement as soon but the lack of automated response capabilities, coupled with high data retention costs enabled us to demonstrate that the Sim implementation would be too complex and costly to maintain.
With pages, they quickly ramped up and efficient and economical security program with round the clock threat tracking and protection.
The company now has time to develop its internal team over time partnering with secure works to build a stronger security stance than ever before.
Second pages future proofed, our customer security through broad and deep threat detection.
<unk> that is powered by an optimum mix of machine learning and applied security expertise.
This quarter, we introduced enhancements to our detection capabilities, adding more threat context, and customization options, which drive the investigation efficiency and speed to response.
I would highlight particularly the expanded capabilities of our unique detection engine, which we call tactic grafts.
We codified threat actor behavior patterns into the pages platform continuously we leverage our findings from about 3000 incident response, and adversarial testing engagements each year together with the proactive research insights of our counter threat unit.
<unk> ability to correlate observations from multiple preliminary resources and security control that scale across Petabytes of data allows tactic grafts to detect a threat actor movements with high precision.
As we open up development on tactic graphs to partners and customers, we expect the detection capabilities of the platform to only accelerate further.
Third changes was designed from the outset as an extensible platform for collaboration and innovation.
It gives our customers direct access to our security experts so that they can actively collaborate on investigations.
It's also an extensible platform the pages community can share integrations playbooks and more.
This is all backed by the security operations expertise that we bring to the table Sims.
Simply put there are not a lot of players with a combination of xdr capability and the security services pedigree in area, where we have dominated that secure works offers.
This powerful combination helps customers scale their security team with a high degree of effectiveness.
One example from this quarter with a newly signed customer preeminent services firm in North America.
It had multiple Sim endpoint technologies that were causing SEC ops inefficiencies and security Mrs.
This let them both exposed to threat actors and exposed to spiking cyber insurance traits and ISO audit challenges.
With secure exchanges they had day, one full security visibility and threat detection across their entire environment.
They benefited from cages playbooks for automatic and proactive threat hunting.
Their team has since been collaborating with secure works experts augmenting our capabilities and restoring some balance to their overworked SEC ops team.
These differentiators are open purpose built xdr platform designed for collaboration and automation of work for security analysts.
Backed by deep security expertise that we infuse into our platform and solutions.
These are the things that secure works customers value most.
A final thought I'd like to touch on today is the opportunity that <unk> supported our customers through flexibility.
Particularly for customers, who are looking to maximize the return on their security investments for the long run.
Changes future proof them not just against the evolving threat landscape.
That empowers them to maintain continuous security across future changes in their technology estate.
While optimizing their security spend.
I'll share an example.
We have an existing retail industry customer that re solution to the <unk> platform in Q1.
They had close to 51 off security point solutions that were overwhelming their security team with portals and complexities, forcing them into a continuous state of reaction.
With secure exchanges they were able to displace duplicative spend leveraging existing pages capabilities to remove several point solutions and do so with a higher standard of security.
Again full coverage of their environment, while relying on pages xdr to eliminate alert noise.
And importantly, their total spend on security has declined while they're spending with secure works has increased fourfold.
This industry has seen a lot of investment and security companies and growing customer spend on security, but what we haven't seen is a reduction in damages from breaches.
Changes with built to fix this.
The holistic and open nature of Tejas Xdr puts us in a more strategic conversation with our customers about protecting their mission critical workloads and driving better business outcomes, we're able to take their current security investments and make much more of them.
And Tejas xdr can analyze more data with better accuracy and greater speed and our competitors ultimately, providing more security and more value to our customers.
<unk> unique open and purpose built platform can help turn the tide in the battle against the adversary.
I want to thank our customers and our partners for joining forces with us and thank our teammates for their hard work and commitment to realizing secure works mission to secure human progress.
And with that I'll turn the call over to Paul Parrish our CFO .
Thanks Wendy.
Pages continues to gain traction in the market.
<unk> increased $108 million year over year in.
Q1 at $180 million.
149% growth rate over prior year to one.
We've added 900 customers since Q1 of last year up 180% over the prior year to end the quarter at 4800 total customers.
And pages subscription revenue was $37 2 million for the quarter up 167% year over year.
Average revenue per customer was approximately $129000 remaining a premium to our non <unk> customers, which averaged 88000 per customer.
As we continue to re solution customers and grow new business on the platform.
We ended the first quarter with nearly 50% of total IRR on pages.
As Wendy mentioned this was an important milestone for secure works as it means we've arrived at a key inflection point in our multi year business strategy.
We continue to see pages expanding to about three quarters of total <unk> by the time, we exit FY 'twenty three as we continue transitioning from non strategic services to our business model.
On an overall basis total revenue was $121 million in Q1, which was consistent with our expectations.
We continue to scale, our cost structure and benefit from our tie just led solution mix shift.
Overall Q1 gross margins expanded 120 basis points from the prior year first quarter with subscription gross margins at 69, 9% up 210 basis points year over year.
We continue to raise our voice and profile in the market with targeted the vessels, resulting in sales and marketing cost increasing to 31, 1% of total revenue up from 25, 6% in Q1 of FY 'twenty, two and 29, 9% in Q4.
We are continuing to work closely with our customers to innovate and deliver new features that align with our strategic priorities and our development roadmap further differentiating pages in a fast growing market.
Accordingly, R&D has increased to 25, 3% of revenue up from 19, 4% of revenue in the first quarter of last year and 22, 6% of revenue in Q4.
G&A expenses were down slightly in dollars compared to Q1 of the prior year on lower professional service and consulting related costs.
Adjusted EBITDA loss was $7 8 million.
Compared to an $8 $1 million gain in prior year Q1.
The overall swing of $16 million was driven by a combination of reduced revenue and gross profit as we actively exited non strategic lower margin services and continued investments focused on our long term growth strategy.
Cash flow used by operations in one two fiscal FY 'twenty, three was $25 million as compared to a $30 million use of cash in prior year Q1.
Note that Q1 is typically impacted by our annual performance payout.
While the adjusted EBITDA differential swarmed approximately $16 million year over year, we improved use of cash year over year lower dsos.
Capex was $2 million for the quarter relatively flat with prior year.
We finished the quarter with a strong balance sheet $186 million of cash no debt and an untapped credit facility.
Turning to our guidance for FY 'twenty three.
We reiterate our guidance and continue to expect the following for full year fiscal 'twenty three.
Tejas IRR to end FY 'twenty, three over $265 million, demonstrating our confidence in in market growth opportunities and in our ability to win deals and execute organic growth to contribute approximately $50 million of incremental IRR.
Sales should accelerate through the year as we get the full benefit of our investments carrying through to FY 'twenty four and beyond.
We're accelerating investments in brand awareness and global distribution with returns expected to be more meaningful in the back half of the year and into FY 'twenty four.
Other MSS IRR to end FY 'twenty three below $80 million.
Of the approximately $80 million of IRR remaining at year end, we expect a significant portion to be eligible for re solutions with most done in FY 'twenty for enabling us to eliminate duplicative costs of the <unk> platform.
Revenue to be $475 million to $490 million.
Full year adjusted EBITDA to be in the negative <unk> $58 million to $68 million range, which includes our investments in sales and marketing and R&D.
Finally, full year EPS loss to be in the 61% to 70 range regarding Q2, we expect revenue of 115 million to $117 million with an EPS loss in the 15 to 17 range.
FY 'twenty three continues to be an inflection point in the Companys transition as we shed non strategic services and complete the <unk> of our base to pages with a significant majority of customers completing that transition by FY 'twenty three year and the Resourcing of our base is positioning <unk> for future organic growth.
In summary, we're making consistent progress against our transformation with continued improvement in our business mix and growth potential.
The end of our business model transition is now in sight and we believe it is increasingly clear we have the right product at the right time to lay the foundations for growth and profitability for the company.
Wendy will now join US again as we begin Q&A operator can you. Please introduce the first question.
Okay.
At this time I would like to remind everyone in order to ask a question you can press star one on your telephone keypad, we'll pause for just a moment to compile the Q&A roster.
The first question is from the line of Socket Korea with Barclays. You May ask your question.
Okay, Great Hey, good morning, folks and thanks for taking my questions here.
Good morning.
Good morning, Wendy maybe just to start with you a lot of great customer examples in your prepared remarks I was wondering if you could just double click a little bit on on the idea of similar placement and more specifically to what extent do you find pages is replacing Sim ins.
Installations at your customers versus co existing with Sim at your customers does that makes sense.
It does and I'm going to talk about that in probably two different ways in terms of <unk> and then what I would call more observer.
Absorbability platforms. So when we think about traditional Sam's even nextgen Sam's theres not a coexistence model. It doesn't make sense right can you just can do all that they do and more so it's Scott. The Detections that you don't have to maintain reporting that's either standardized or customizable. So you can have that angle of the law.
Retention included we include 12 months.
The standard with options to extend and what we have that they don't obviously as the automated response capabilities and much lower cost to maintain it's cloud native in and we're doing the heavy lifting on maintaining and building out the detection and response automation.
So from that perspective, it economically and from a security efficacy standpoint doesn't makes sense to coexist.
We do see some coexistence again is where the the core.
System. If you will is really around observe ability or use cases and in those cases xdr fulfills the security aspect of that and from from RC that in many cases that can be a pretty powerful.
Partnership opportunity to work with those platforms, who potentially ingest.
A good bit of data.
In order to fulfill their use cases, and we can leverage that data mutually to two at a much more effective security.
Program on top of that.
Does that answer your question.
Yes that does.
Super helpful.
Paul maybe for my follow up for you you touched on this a little bit in your prepared remarks, but can you just can you just.
The conversion opportunity a little bit our resubmission opportunity, maybe I should call it.
For the four four counter threat customers over to pages and sort of how youre thinking about the timing of that conversion and what youre doing to encourage that conversion if you will.
So as Wendy mentioned in her opening comments, we see the xdr market is hot.
Growing and so that is encouraging our customers to take a look at our solutions as we talked to them about the resources. So as we set our guidance. This year, we have a perspective on how we will exit this year with the balance on our remaining characterize platform, which we gave guidance of $80 million or less and so we still see all this thinking together.
How we set guidance. So we're still feeling very good we believe our customers are looking at I'll call. It favorably and matter of fact, when they do re solution, we're still seeing that positive uplift when they exchange out of the older product to a new product and still hovering somewhere around that 20 years.
<unk> uplift.
Exchange that product so we still feel very good about that progress.
Got it very helpful. Thanks, guys.
Thank you. The next question is from the line of Mike <unk> with Needham You May proceed.
Hi team. Thanks for getting me on the call this morning and good morning.
I'm wondering as you guys about.
Thanks.
I wanted to ask you guys about.
The AUR or spend behavior that you're seeing with existing <unk> customers.
It's probably still a little too early to call a trend just based on the.
It makes sense to use the product or maybe the cohort of customers that we had a year ago, but im curious can you provide any detail or color.
Now.
Customers.
<unk> spend has changed over the course of the year, if they are coming up.
12 months.
What's the behavior like within that cohort.
Sure. So let me sort of level set on the average revenue per customer on on pages relative to CDP and talk about new and re solution first and then we can talk about.
Sort of expansion of those customers with with multiple modules. So the average revenue per customer on pages. This quarter was 130000 pretty close to what it was in fourth quarter and we see that average is is pretty consistent now across both new newly signed customers on re solution customers.
We did have a tick down in.
And in average revenue per customer in <unk> with just the <unk> customers as we moved deeper into the base of smaller customers. Historically, what we see though is that our target remains especially as we continue to move up into the enterprise space a $200 on average revenue per customer.
<unk>.
Our model based on our current target market.
Part of the way that we get there is the is the opportunity to upsell our customers on additional modules. So you already see us with a higher average revenue per customer than many of our competitors in the space, which is both a function of.
The market that we plan as well as what's included versus additional modules.
We include much more in the core xdr product than competitors, who try to monetize those separately.
And for US. We are we are now seeing a substantive number of customers have at least one additional module from cages, which is helping us to.
Continue to expand our spend and frankly, we think that will help with renewal rates as well as they become stickier customers.
Thanks for that I appreciate the color there just one follow up and really on the come.
Comment there.
It was is that youre seeing a substantive number of customers have at least one additional module right.
Maybe square that away.
More apples to apples comparison.
If I think about it even quarter to quarter or year to year.
Is that one additional module.
How does that compare to where we were even a year ago.
Are we seeing higher attach rates are we're more cross sell in the current environment.
Sure.
Given the maturing platform that you guys have out there now.
Yes, it's a good question. So it's definitely a material lift in that so nearly 70% of our customers now have at least one additional module and that could be up.
Additional product or services module like elite threat hunting.
I would have to get the exact number from a year ago, but it definitely has expanded quite a bit in the last year. Both as we've expanded the base and just over time profitable back into the original customers and had additional modules to offer.
Very helpful. Thank you very much guys I'll turn it over to my other colleagues.
Thank you.
The next question is from the line of Hamzah firewall with Morgan Stanley You May ask your question.
Hey, good morning, everyone. Thanks for taking my questions.
Good morning.
Maybe first question for you is just if you could.
Talk a little bit about what youre seeing in the security spending environment, obviously, it sounds like it's been pretty strong year to date, but I'm wondering if you're seeing any.
Changes at all.
And a less certain macro environment and then.
Just a follow up to that is when you constructed your.
Guidance.
Did you factor in any.
Changes around sales cycles or pipeline and conversion at all.
Sure.
And I can just talk about what we're seeing in sales cycles.
And then possibly get a little bit to the guidance. So in terms of the economy.
Here at <unk>.
2008 timeframe when when there was a bit of a blip in the market. We were obviously a lot smaller than watching our cash and.
What we saw then.
And your guess is as good as mine around the economy.
Is probably what we're seeing right now which is that the <unk>.
Security spend is pretty mission critical that's really one of the stickiest areas of spend in an enterprise budgets are they may look to have some trimming, but not necessarily full full type cutbacks.
What we saw before and potentially could see now is a sales cycle lengthening as opposed to.
Precipitous drop in spend that would be my my best.
Guests on that front, however, we haven't seen that yet we've had.
A sales cycle of about a quarter four for cages that is longer.
Legacy platform for for quite some time.
Far no no big change there, but if I had to make a guess that would be the area I would look to.
And then as we set guidance, we looked at our trends and switches that consideration as we set guidance.
As well as the continued growth in pesos at the growth with our product in relation to the market growing so all that was considered as we put our guidance out.
This specifically, Paul if I could follow up.
No.
<unk>.
Did you assume perhaps a bit lower pipeline conversion or longer sales cycles and your guidance explicitly.
We looked at what was occurring as we exited Q4 and to the extent there was a range that we could put our primary around we've included that in our guidance. So we'll definitely we captured a portion is it what could occur during Q2 Q3. So forth out you have to be determined but we have an element there in our guidance.
Got it makes sense.
Just one last question on.
On pages.
Just curious how you get around avoiding some of the data and just caught that we've seen from traditional <unk>.
Vendors have that make them obviously.
Sometimes cost prohibitive.
From a customer standpoint, how do you get around that with pages that you can not only deliver effective security, but also deliver it.
At a more efficient price point.
Sure and I'll talk about that from two angles. The most important angle as from the customer see and we very consciously made the decision to price pages based on endpoint count and that way for customers. It is very predictable there are no additional data charges.
They decided to purchase longer storage than 12 months, but there is no variable data charges that catch customers by surprise and their ability to two outlook. Their endpoints is there ability to outlook their spend with us.
So that's a that's a real differentiator not just against <unk>, but against some other xdr providers, who do create that exposure for customers two to charges and frankly from my seat create a disincentive to do the very thing that makes them more secure wishes to have all the data to be able.
To run highly correlated detections find that needle in the haystack. So we do not want additional security value of that data either.
The flip side of that question is well how do you manage that in terms of your cost structure and as you can see even with the MBR services included in our subscription margins. We are just at 70% gross margins this quarter because we have a.
Purpose Architected xdr platform that is very conscious about the types of data that we need.
<unk>.
Right real time search capabilities for security efficacy and those that we can have lower cost.
Storage.
Structures or things that you just want a search overtime and the combination of that architecture.
With our kind of constant management of instances and such with AWS is how we're able to grow our margins at scale, while still having a pricing model that is.
Predictable for customers.
Thank you.
Thank you.
The next question is from the line of Brian Essex with Goldman Sachs. You May proceed.
Hi, good morning, and thank you for taking the question.
Yes, maybe Wendy I'd love to get a sense for what youre seeing so far with with kind of adoption of the <unk> platform and I guess the question is more along the lines of where you see yourself fitting in.
Relative to some of the other business models that are out there in terms of we have.
Some managed service providers going through kind of an incident response related channel and kind of leaving their xdr technology behind <unk> vendors that are extending and xdr.
How do you see yourself and obviously totally get the.
The ability to have an agnostic platform that has kind of opened in nature.
Wanted to seek right now you've got a nice tailwind from the re solution, but what are you.
Where do you think this environment ultimately.
Ends up in terms of competitive dynamics versus the way that other vendors are kind of trying to penetrate the space.
Sure Good question.
The simplest way I think about it is really the extra day in the or and Xdr, what makes us different from different.
Approaches to the market and you really called out several of them and the <unk> truly is the extended piece, which is right that it's not just 10 point only and then it's not just a proprietary stack where you have to use their endpoint there so far.
Our walls et cetera, So I think that that's one of the fundamental differences on the other end of the spectrum is the R. And so there are a lot of xdr players out there who do not have what I call. The big are they.
They made comments that come in with a low price point and then what customers find out is that they are truly on their own. So when we think about being able to compete with us.
Very well regarded incident response program underneath of that 40 hours a quarter included an hour.
MTR program.
Which is a real differentiator from competitors, that's a truly big are.
And in the middle there, it's really around the detection and that's where we win against all players who come from all angles because of the way that we don't just ingest data, which many xdr provider say, while we adjust everything its really about the normalization that data and the powerful detection of the crops that data that that we compete against those play.
Here's in those three areas and no one has that combination of truly the extra day and they are.
Got it that's super helpful and I guess, maybe relative to some vendors that may come up as from an ETP angle and the catalyst of displacing a legacy endpoint vendor would be kind of.
The tip of the sphere, so to speak to go to market.
How do you how do you envision.
The way that you might penetrate the market is primarily direct sales or.
Are you getting traction with some of the solution providers that may be.
I guess architected, a more holistic solution around an ETP conversion like how do we think about.
Your ability to get in front of customers to actually illustrate the benefit of your platform.
Sure I'll take that into two pieces, one is kind of the PPE play generally and then two is the partner play, which which really goes beyond just that particular displacement strategy and the reason that we added we have our own proprietary agent. We have next gen capabilities.
<unk>.
Make it frictionless for customers to choose if they want a more economical.
<unk>.
Approach to xdr, including ETP, we absolutely have that for partners.
To be able to offer to customers to run that play and that was a conscious decision on our part do we require it now they have a leading endpoint.
Product, we work with those products in order to prevent risk to customers of course, rip and replace but we get in we become the interface to the customer.
And show them economic models over time that they can shift into.
The second piece is really around partners and as we've stated before it is a key part of our strategy to expand.
With partners, who resell securities products as well as provide.
Ancillary services on top of that.
I much been working to enable those partners with speed to market by sharing.
Our bridge support around developing service models and security operation centers to do that so we do see continued increase in the percent of.
Partner sales as a percent of our revenue I would like to see that go faster I anticipate that's going to start to go faster as we've been building these relationships and getting partners ramped, but pleased on both fronts.
We wanted to give them more than just the ETP player that's in play and others for them to go in and.
Seek opportunities to increase revenue with their base.
Got it that's very helpful color. Thank you.
Yeah.
Thank you.
There are no further questions at this time.
Mr. Paris, I will turn the call back over to you.
Okay that wraps up the Q&A on today's call a replay of this webcast will be available on our Investor Relations page of secure works Dot com, along with our Q1 web deck with additional financial tables. Thanks again for joining us today and good luck. Thank you.
This concludes today's conference call you may now disconnect.
Okay.