Q1 2024 SecureWorks Corp. Earnings Call

Speaker 1: ARR up from less than half of total ARR this time last year.

Speaker 1: To put that into context, this quarter we were recognized by multiple leading industry analyst reports as one of the top three largest providers of managed detection and response in the market.

Speaker 1: That's important because customers have a choice in a noisy market and they're choosing SecureWorks.

Speaker 1: In my conversations with potential customers in this climate of increased focus on fiscal responsibility

Speaker 1: They are focused on the win-win that Tages can deliver.

Speaker 1: A solution that helps them consolidate and reduce the number of security vendors that they have to manage.

Speaker 1: that scales their spend on both security technology and talent, while simultaneously delivering an improved security risk posture and outcome.

We are well positioned to address this market need based on our unique approach to the design of our Tejas XDR platform. And customers are reaping the benefits of our XDR enabled MDR.

We solved the signal-to-noise problem that drives alert fatigue from multiple point products.

We provide the comprehensive protection to stop adversaries who lurk between point products.

And our open without compromise approach gives customers choice.

future flexibility, and an easy deployment path to achieve comprehensive detection and response.

In this vein, we are addressing an acute need to replace legacy SIMs, which are difficult to deploy and configure, and their complexity makes them costly to maintain.

For example, in first quarter, we won a global provider of smart building solutions that came to Securix originally for penetration testing services.

We quickly discovered a ransomware attack despite their significant investments in a new technology, an endpoint on vulnerability management technologies.

Like so many organizations, they did not have the resources to constantly manage the SIM and so left many of their office locations unmonitored. They quickly recognized the return on investment of managed detection and response with Tages, reduced their vendor's sprawling spends while fully securing their entire environment.

Customers choose Tejas for its measurable and superior return on investment that lets them streamline security vendors and spend, increase the value of uptime of their business operations and revenue streams, and the ability to optimize investments in internal security teams.

all while achieving superior security outcomes and quantifiable risk reduction.

We also expanded our platform capabilities and portfolio of offerings this quarter. We recently announced two new offerings to unify the way companies prevent, detect, and respond to threats across both OT and IT environments.

eliminating the visibility challenges often associated with the separation of those systems, and addressing the risks of greater attack surface exposure in legacy OT systems.

Industrials in multiple sectors have been increasingly under attack by threat actors, and with our significant presence and expertise in this vertical today, we see untapped potential to solve a pressing security need by unifying detection and response across OT and IT via the Tejas platform.

And staying true to our overall approach to XDR, the pricing is simple and predictable endpoint-based upcharge with no data overage, storage, or other surprise fees.

In support of customer choice and aligned with our pillar to be open without compromise, we recently added out-of-the-box support for a growing integration request from our customers and partners.

Sentinel-1, singularity complete.

Cages now ingest Sentinel-1 telemetry into an overall view of cloud, identity, network, and other application data in the Cages XDR UI. In Rich's and correlates that data with threat context, unapplies our unique detectors and response actions in the platform to drive superior security outcomes.

With our unique approach in Tejas, customers can leverage a single EDR agent for holistic XDR and MDR coverage.

further removing the friction and complexity of multi-vendor environments.

With this addition, we now integrate seamlessly with nearly 70% of the endpoint market. Another example of how we optimize customers existing and future cybersecurity investments while also providing the breadth of security coverage they need.

Hey, just is, increasingly, the single pane of glass for our customers entire security stack. Welcome back.

We recently won a partner source deal with a manufacturing company that had a small IT team, no stock, and very limited visibility into their environment. A competitor in their space had recently been the victim of a cyber attack and data breach.

creating urgency in their leadership team around ensuring they could prevent a similar breach.

The customer had recently implemented Sentinel-1 with our partner and our demo and proof of concepts demonstrating the ease of deployment and holistic visibility of XDR while leveraging their existing single agent. Those are what sealed the deal.

Another topic that is top of mind for customers and investors is how we leverage and govern AI and Arcadia's platform and offerings.

From the beginning, AI has been part of Arcadia's platform vision and architecture, leveraged to drive more effective and faster detection and response outcomes for customers.

Among many approaches, we leverage deep learning and machine learning and our thousands of detectors to find the true positives that other products miss.

An AI-enabled threat scores supports the prioritization of the hundreds of billions of alerts and indicators we receive from our customers daily.

While approaches an AI algorithms can change rapidly, the key to staying ahead is having vast amounts of labeled training data.

And we believe that we have one of the most valuable security training datasets globally.

For example, we've performed more than 10,000 investigations annually for more than a decade.

Leveraging that data set, we recently implemented natural language processing, generative AI, and other techniques to automate approximately 45% of our Tejas Security Investigation reports.

While more opportunity lies ahead, this has further improved our market leading response time for customers and the efficiency of our security operation. While AI is not a panacea and is not applicable to all security use cases, we are well positioned to capitalize on its momentum and opportunity.

We have a deep bench of data scientists, software engineers and threat researchers working on a true XDR platform designed to take advantage of advancements in AI and data analytics to rapidly innovate, to improve outcomes for our customers while protecting their most valuable assets.

As importantly, we have educated our team and put in place sustained governance around the responsible use of AI.

and will continue to safely incorporate it into our business and service of customers, teammates, and investors.

I'll now turn to our go-to-market.

We are in the early innings of our GoToMarket transformation, aligned to our CagesCentric Business Model. But I'm pleased with our progress.

We designed CAGES to be transparent and collaborative, providing flexibility and optionality around who manages detection and response activities.

This enables MDR to be delivered by SecureWorks, a partner, or a customer's own SOC team, all leveraging PAGES XDR.

In addition to solution providers as a go-to-market path, this has enabled us to tap into the MSSP market opportunity, enabling partners to deliver high margin and effective MDR leveraging pages. In Q1, one of our MSSP partners worked with us on an MDR deal with a data analytics software provider.

extreme line approach they needed while also addressing their growing compliance needs.

with the scaled MDR services from our partner.

Recall that last December , SecureWorks launched our partner-first go-to-market approach in North America, elevating our collaboration with critical managed service and solution providers, as well as technology alliance partners.

Our open without compromise strategy creates greater business opportunities for partners of all types.

As an indicator of traction in first quarter, more than 60% of Global Page's new logo business was closed with a partner, up from 40% this time a year ago.

and partners with active pipelines have increased 40%, leading to a doubling of our partner pipeline in first quarter, a trend we expect to ramp over the course of this year.

And we will continue to extend this partner first strategy globally over the course of this year.

We've brought in a season chief revenue officer to accelerate our go-to-market transformation.

Island Peters comes with a powerful combination of CRO leadership across FAS, security product and services companies with a partner-led sales approach. Peaf pyramid promise of course a stability port in your life for the future of life.

He brings demonstrated success in driving incremental ARR growth by accelerating your customer acquisition, platform adoption and channel growth.

and in expanding gross margins through better solutions mix and discount control. All driving improvements in key sales efficiency measures.

Before I transition into our path to profitable growth, I'll just add color on our perspective on the macro environment in terms of its impact on sales.

We did see longer sales cycles in first quarter than a year ago, largely as a result of increased layers of deal review at customers.

But those sales cycle times have been largely in line with more recent quarterly trends.

Based on what we see currently, we expect this to continue in the near term.

We are driving our business to profitable growth as we complete our business transformation.

K-Juts continues to perform growing faster than the industry and scaling gross margin. K-Juts continues to perform growing faster than the industry and scaling gross margin.

And as a business, we have and will continue to take decisive actions to align our cost structure with the SaaS nature and the revenue opportunity of our TASIA-centric business model.

While Chris will provide more details, I'll highlight three primary areas of action that give us confidence in our ability to drive growing profitability into next year.

First, we will continue to take advantage of automation and scale throughout the business. Second, our go-to-market transformation. In addition to benefiting the top line, we'll drive increased sales efficiency.

Third, we are accelerating the reduction of the remaining duplicative and transition costs as we wind down our other MSS business.

Of note, second quarter of this fiscal year will represent the inflection point for total revenue for secure works.

with a return to sequential total revenue growth in the second half of this year. We aren't getting to the financial airport.

Very shortly, El Panna Wagner will join us as our new CFO .

Alpana brings to SecureWorks extensive experience developing business strategies to drive outside growth and strengthening organizations financial profiles by increasing scale and expanding EBITDA margins through operational efficiencies.

We have a clear path and a commitment to managing our business to profitable growth.

I want to thank our customers and partners for joining forces with us. And my thanks to our teammates for their hard work and commitment to the Secure Works mission of securing human progress.

I particularly want to thank Chris Grant for his partnership and support acting as our interim CFO for the past month.

And with that, I'll turn the call over to Chris to walk through our financial results and guidance.

Thanks, Wendy. Good morning, everyone. Today, I will cover our first quarter results and outlook for the second quarter in fiscal year 2024. Total revenue was $94.4 million in the first quarter, which compares to our guidance of $96.98 million.

The lower total revenue was driven by accelerated wind down of our other MSF business and customers delaying professional services projects.

As a reminder, our professional services business includes both retainer-based and transactional services.

In Q1, the delays we saw were in the transactional revenue, which can fluctuate from quarter to quarter due to the dependency on customer resource availability.

Adjusted even a loss was 20.1 million compared to a 7.8 million loss in prior year first quarter.

The overall change was driven by the other MSS and professional services revenue just discussed. Offset by Tages Growth Profit Expansion and Outback Saving as we continue to align our cost structure with our Tages Centric Business.

Overall, Tages Business performed in the first quarter as expected. Tages' description revenue was $62.6 million, up 68% year-over-year, in line with expectations. Tages ARR increased nearly 90 million year-over-year to $269 million, now representing more than 85% of our total ARR.

With our resolutioning efforts to stanchially completed at the end of fiscal 23, the majority of our changes ARR growth this quarter was driven by new logos upsell and cross-stale.

Everd Revenue Perch Tages Customer was approximately 132,000, and we've added 600 Tages Customers since the first quarter of last year, representing year-over-year growth at 43%.

I would like to highlight that Tages Average Revenue Per Custom are remained a premium to the industry average.

We took the unique approach of bundling a number of core capabilities, such as one-year data retention, orchestration, and hunting playbooks.

endpoint agent in unlimited response in our core offering, our higher average revenue per customer than our competitors benefits from the strategy and our target buyer segments.

To provide more insights into the underlying financials of our Cages business, we've enhanced our disclosures this quarter, providing a breakout of Cages cost of revenue and gross margin.

Tejas gross margin continues to scale, reaching 70% this quarter, 110 basis points higher than the first quarter a year ago.

As we move towards the other MSS end of life in Japan in Q1 of next year, ARR and revenue in that business will continue to wind down.

We anticipate eliminating the remainder of our other MSS cost structure at the same time that we sunset other MSS in Japan in Q2 of next year.

As Wendy shared, we have also been actively managing down our op-x as we align our expense base to our Tages Centered Business.

Turning now to our cash and balance sheet.

We finished the quarter with a strong balance sheet with $95 million of cash, no debt, and an undrawn credit facility.

We use 42 million of cash from operations compared with 25 million views in the prior year first quarter, which primarily reflected lower adjusted EBITDA.

As a reminder, our first quarter is seasonally the highest use of cash due to annual incentives payouts. Turning to our guidance for the second quarter in fiscal year 24. We are reiterating our guidance for TACES ARR to end FY 24 at 300 million or higher. We expect other MSS ARR to represent approximately 5% of total ARR

we progress throughout the year.

The benefit of that within total gross margin will be offset by duplicative, Dex, and transition cost as we sunset support for our other MSF services in Japan.

We have previously stated that there are approximately 25 million of duplicative fixed and transition related costs that we are incurring with 15 million in cost of revenues and 10 million in operating expenses. As we turn down other MFF services, we will manage the related cost out.

One of several positive impacts to our operating structure in fiscal 24 or in fiscal 25.

As one you shared, we are actively managing our cost structure. We expect reductions in our operating cost to begin in the second half of the year as we align our resource allocation based on the faster runoff of the other MSS business.

We have experienced nifty improvements in our cost structure from our ongoing use of automation. We continue to drive automation and scale into our growing SaaS business.

As our teams deploy AI across operations, we see improvements in all areas of our business both in ways that directly benefit customers and in the scale of our operating model.

Our investment in sales and marketing over the past year have enabled the refositioning of our brand, completing the refillutioning outside of Japan and supporting our transition to partner first model.

It is early days and our partners first go to market. But with the resolution behind us in North America, we began recomposing our sales force by expanding our hunter capacity and reducing investments in account executives focused on resolution. This will be apparent in lower sales and marketing dollars spent this year as we are no longer compensating account executives to move existing customers.

for more other MSF platform to tages.

R&D will also trend lower as we continue to reduce our engineering support cost related to our other MSS business.

Full-year adjust to eBudder range, just expected to be between negative 29 and 39 million.

Finally, full year non-GAP EPS loss is expected to be between 34 and 43 cents. We expect Q2 non-GAP EPS loss to be between 15 to 17 cents.

In summary, changes continue to show strong momentum in the first quarter in line with our expectations.

As the sunset of our other MSS accelerates, and we benefit from scale and our Tages Center business, Q2 with the TROP and the transformation of our business.

We expect our actions in fiscal 24 to lead our business to profitable growth next year. Thank you for joining us on the call today. Wendy will rejoin us as we begin Q&A. Operator, can you please introduce the first question.

Certainly. Ladies and gentlemen, at this time, I would like to remind everyone in order to ask a question, please press star followed by one on your telephone key pad. Let's star followed by one on your telephone key pad.

maybe for you, morning, when he may be for you, appreciated the talk about ROI on Tages in your opening remarks. I was really just go one level deeper into that. And I guess the question is based on your conversations with customers, where do you think, or how do you think Tages is driving?

you know, the most ROI for those customers.

Sure, a great question. Thanks, Nks. Thank you so much. We really see three primary areas, and I will try to do them in sort of order of magnitude order. The first one is clearly the productivity of their IT and security teams.

when we think about the burden moving off of their team in terms of managing a building integration, building detectors, the automation in the investigation and the response workflow. If there is, if they have an MDR with us for a partner that that aspect of unlimited incident and protestors, don't just express expert in lotion patient pump variant, it is Myers-S????.

security program as opposed to kind of the day-to-day management, just talking to us. See, so in earlier this week who was looking to move on that journey, now that she had moved to Tages.

The second one is they can clearly see a path to displace, spend, and frankly the friction of managing a lot of different vendors. As you know, we continue to expand the XCR platform and a lot of individual point products for now, frankly, features or capabilities of Tages.

to include one year of storage, you don't need separate log retention. Those are great examples of the path they can go on on that front. And then the third one, which is a little bit harder to measure depending on the organization, but there's just less business downtime and user friction. Sometimes that does show up in terms of cyber insurance, actual lower rate, but a lot of times it's just their sense of...

their ability to provide assurances to their board that they now have absolutely full holistic coverage and frankly often better coverage than they had before for the same spend. So those are really the three areas I'd point to.

Got it. Got it. That's helpful. Maybe for my follow-up for you, Christian, you touched on some of these in your prepared remarks, but I just wanted to make sure I was clear. So for the 14%, roughly 14% of ARR, we're going to be looking at the

Can you just talk about sort of when that's expected to mostly go to zero, and then relatedly, the magnitude of the duplicative costs and sort of the path for those winding down presumably to zero as well?

Yeah, good morning, Sackett. Thank you for your question. Yeah, so as we talked about, when it comes to remaining 14%, right, with the acceleration in Q1 of the non-Japan other MSS, we got more than half this less than Japan in which we're actively managing down with the expected end of life in Q1 of next year. Here.

What when it comes to those costs, right? As I mentioned in my remarks, there's about 25 million that is directly tied to the wind down of the other MSS, which is split 15 million to cost the service and 10 million outbacks that we're actively, we're lining that and managing as the rundown of that 14% occurs.

There's a little bit of timing that will happen as you know some costs will come on block after the revenue.

But the expectation is the, all those duplicative and transition costs will exit the business by mid FY25.

Right, I think that's the thing I'd emphasize, Saket, is the kind of two worlds. Thank you. Our next question comes from Mike Sikos from NEEDHAM. Mike, your line's now open. Please go ahead.

Hey guys, thanks for taking the questions here. I appreciate you providing the guidance and metrics, but I just wanted to piece out a little bit more around the revenues with Q1 coming in.

Obviously below where you guys are expected based on that more active management of

other MSS. Is it fair to think that you guys probably tracking towards the lower end of that revenue guidance range we have today? And maybe in conjunction with that response, can you help us think about what needs to go right or what are the vectors that would help you guys?

come in towards the higher end of that revenue guidance for the reiterated full year guide that we have today.

Good morning, Mike. Thanks for that. There are a couple of factors in first quarter.

There certainly was, and as you recall, the other MSS has come two pieces, a handful of larger contracts that were originally extended beyond the non-Japan end of life state that we are just working through with those customers for smooth transition, and we're able to accelerate some of that, which is good.

Good thing, and we can align our cost structure accordingly. The second piece was really that transactional consulting revenue, which was more those revenues were sold, but the revenue was dependent on customer resources to implement those. So think of that more as a timing issue than a sort of permanent issue.

And then within the existing Tejas guidance range, we can see the offset of the other MSSPs, which, as I said, the sooner we kind of get to one go forward business, the more that that's good for the overall company.

Got it, got it. And I know that you guys have spoken about the go-to-market earlier in your prepared robots as well. And I think Chris had pointed to some of the success you guys continue to see with Tage's AOR coming from, whether it's new customers or upsell or cross-sell.

So a two-porter here, but first maybe for Chris Can you help us think how many of I guess how many customers were added for Tejas in? Q1 versus Q4 of last year and then to Wendy this is more of a product view here, but

Can you help us think about the marriage of the IT and OT with respect to the, I guess, tie up of those environments and where SecureWorks envisions itself playing in that field?

the marriage of the IT and OT with respect to the, I guess, tie up of those environments and where SecureWorks envisions itself playing in that field. Thank you.

Sure, I can hit the product one and then I'll hand it back to Chris to talk about the.

the customer has a kind of a new cross, obviously, majority now that we're past all of the resluishing outside of the handful that's left. Sure, we're really proud to bring Tom Market these offerings that help unify the security of OT systems for customers.

All of you know that we've all seen, personally been impacted by industrial companies being impacted by ransomware attacks and their needs for unified security, particularly for the systems that generate the majority of their revenue. All of you know that we've all seen, personally, been impacted by ransomware attacks and their needs for unified security, particularly for the systems that generate the majority of their revenue.

And our approach to embedding that now into the Tages platform as those systems frankly become much more exposed to the IT side of their house and of course are under attack because they're lucrative to attack. This is a great extension of the platform to provide that holistic.

single pane of glass protection and visibility for customers in a space that we've just seen a lot of growth in and this is an opportunity to tap into a fast growing segment of the market. I'll turn it back to you, Chris, in terms of the new cross customers. Yes, my God.

Our quarterly ARR was led by the majority of the new and the cross cells, which was evenly kind of distributed between the two. ARPC remains on a premium to the market. This is the second quarter in a row where our new customer ARPC is greater than our resolution. Customers.

And then, you know, our counts are rounded, so you lose some of the visibility into the growth happening on the customer base.

Terrific, thank you very much, guys.

Our next question comes from Amza Fodralla from Morgan Stanley . Amza, your line's now open, please go ahead.

Hey, good morning, everyone. Thank you for taking my question. Wendy, the first link for you. I know it's super early days, but I was wondering as you talked to customers,

How are they thinking about using some of these more advanced AI models as far as their security process is concerned? Any applications that you would call out that they're discussing with you about? And then second part was around, you talked about using...

AI internally to make the business more efficient. Maybe if you could elaborate on that, would be super helpful here. Sure, and it is early days and this is a sort of a hot topic in terms of a do-ask customers and they ask us about

how we're using AI and how they're seeing it impacting the evolution of their businesses. And the applications are pretty, pretty married. I mean, they are looking to accelerate.

Anything that is a repeatable type of activity by their team, they are looking to AI to figure out new ways to disintermediate sort of things that are done by humans. Code creation is a great example. Anything around content creation, digital media, there's just a pretty endless list of what they're considering. What we have is...

from the very beginning and the platform was architected to take advantage of the vast training data that we have have in place. And so when you think about we've been using deep learning and machine learning models from the very, very beginning, the powerful thing for us that's kind of this era is this idea.

sort of generative AI to find the unknown, unknown. And I think that's where the real power comes from in terms of security value for customers that were on the curve for, and that ability to clearly detect more, detect faster and thereby prevent breaches is.

is an incredible opportunity for us to create more value for customers and beat the adversary. Thank you.

As a reminder ladies and gentlemen, if you'd like to ask a question, please press star followed by one on your telephone keypad that's star followed by one on your telephone keypad.

Our next question comes from Tal Liani from Bank of America. Tal, your line is not open. Please go ahead.

Hi team, you're in the Battle and Brookside for TALL this morning. Just a few quick ones for me. I guess I want to dive into macro in the opening remarks. I understand that obviously we have some of the revenue being weighed down by MSS, but I also wanted to just touch on what you're seeing from an economic cycle. And then as we look into the back half of the year, assuming stronger revenue growth for the back half. And it's funny, I vaccinations may seem like they're using amongst yourselves here in the EU during theClassroom campaign. They've been in charge of the first round of campaigns, but why are they using the same criteria forfs??

You can't really cross the board. I think our cyber companies over the courses of quarter have tried to put in place just more conservative guidance for back half. So what are you seeing differently in the market that gives you the confidence that the back half of the stronger view? Thanks. Thanks for that. So let me just add a little color on the macro environment for us, as I mentioned, the.

The last three quarters, so third quarter, fourth quarter last year, first quarter of this year, definitely looked a lot different in terms of profile from either the first half of last year, even the year prior. But we didn't see a material shift in customer behavior or potential customer behavior in terms of their scrutiny of deals, which is definitely more elevated and their own.

attention to their budget, their business. I think it's kind of continuation of the same. For us, while we, of course, see continued growth in Tejas, our second half inflection in total revenue is more a function of the roll off and transition of the other MSS business.

Thanks, my friends. It's a follow up to you know, I think it's very treated customers year-to-year. Can you talk a little bit about user being on our interviews with the transition of customer-existing customer base? And maybe out of that 600, what person of customers were net man? Are you broke up just?

Versus resolions.

And the I'd say we're yes, exactly numbers for you.

They're about 60-40. I think that's been about consistent in terms of, obviously, first quarter was a new customer story, and cross sales, of course, as opposed to resolutioning. And the second question, I don't know if you all heard.

Can you maybe try again on the second question? Actually, you answered it, so thank you.

Okay, great. All right. You're welcome. We currently have no further questions, so I would like to turn the call back to Mr. Toomey for final remarks. Please go ahead.

Thank you. That ends the Q&A in today's call. A replay of this webcast will be available on our Investor Relations page at secureworks.com, along with our Q1 supplemental deck with additional financial tables. Thank you all for joining us today. Ladies and gentlemen.