Rapid7 Inc

NASDAQ:RPD

Earnings Call Transcript 2018-Q4

[Operator]

Good day, ladies and gentlemen and welcome to the Fourth Quarter and Full Year 2018 Earnings Conference Call. [Operator Instructions] As a reminder, this conference is being recorded. I would now like to turn the conference over to Neeraj Mahajan, VP of Investor Relations. You may begin.

[Neeraj Mahajan, VP, IR]

Thank you, operator and good afternoon everyone. We appreciate you joining us today to discuss Rapid7's fourth quarter financial and operating results in addition to our financial outlook for the first quarter and full fiscal year 2019. With me on the call today are Corey Thomas, our President and CEO; and Jeff Kalowski, our CFO. We have distributed our earnings press release over the wire and it is now posted on our website at investors.rapid7.com along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast and following the call an audio replay will be available at investors.rapid7.com until February 14, 2019.

As a reminder, our discussion today contains forward-looking statements about events and circumstances that have not yet occurred, including without limitations, statements regarding our objectives for future operations and future financial and business performance. These forward-looking statements are based on our current expectations and beliefs, and on information currently available to us. Actual outcomes and results may differ materially from the expectations contained in these statements due to a number of risks and uncertainties, including those contained in the most recent quarterly report on Form 10-Q and subsequent reports will be filed with the Securities and Exchange Commission. The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call except to the extent required by applicable law.

Our commentary today will primarily be non-GAAP terms and unless otherwise stated, we will be presenting results in accordance with ASC 606. Reconciliations between our GAAP and non-GAAP results and guidance can be found in today's earnings press release. At times in our prepared comments or in responses to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or quarterly results. Please be advised that this additional detail maybe onetime in nature, and we may or may not provide an update in the future of these metrics.

With that, I'd like to turn the call over to Corey.

[Corey Thomas, President & CEO]

Thank you, Neeraj and good afternoon, everyone. Thank you all for joining us today on our fourth quarter and full year 2018 earnings call. Rapid7 had a great fourth quarter capping off a very strong 2018. We are particularly pleased with the acceleration in the adoption of our cloud-based offerings. For the sixth quarter in a row our ARR growth accelerated reaching 53%, driven by continued strong new customer growth, lower churn, and the success of our platform strategy. We again exceeded our growth targets and look forward to another year of ARR growth of over 30% with improving operating leverage.

In few years ago, Rapid7 undertook the challenge of transforming the company. At that point Rapid7 was primarily, and on-premise perpetual revenue company with one main product, vulnerability management. Our vision was to build the leading comp-based SecOps platform to address a world where IT and security teams are stretched and complexity is increasing. And to do so in a way to make our solutions easy to deploy and easy to adopt, in order to drive upsell and cross-sell. To do this three years ago we introduced the Insight platform with InsightVM and InsightIDR. Since then we have launched InsightAppSec and InsightConnect creating a true multi-product platform. Along with this we transitioned our sales force, and more importantly, the entire organization to think and operate in terms of ARR.

Today we are a leading SecOps company with four major cloud-based pillars for growth. We ended 2018 with more than 7,800 customers, an 11% increase but more importantly, our product customers grew at a much higher rate. Over half of our customers are now taking advantage of the Insight platform, up from 37% last year. Recurring revenue as a percentage of total revenue has grown over the last two years from 67% to 83%. Under ASC 605 ARR per customer has grown from less than $20,000 to over $32,000 in the last two years, and nearly 20% of our new ARR in Q4 came from products other than VM. Rapid7 has been successfully transformed and we did all this while consistently improving our operating margins for five years running, highlighting the leverage inherent in our operating model. This would not have been possible without the tireless effort of our highly committed and driven teams who delivered in this complex transition.

Now before we talk about 2019 goals, let's do a quick recap of our 2018 goals. At the Analyst Day of 2017 and during our Q4 2017 earnings call, we outlined a set of ambitious goals for the company in 2018 and I'm very proud that our team exceeded these goals. Our first goal in 2018 was to grow ARR by 30% plus, and we delivered an exceptional growth number of 53%. Our second goal was to continue to expand our customer base. Last year our customer base again grew by double digits proving that we still have a large opportunity to expand our footprint, and the products to win in the marketplace. Our third goal was to improve our operating profitability which we did while also making investments to drive growth. Our non-GAAP operating margin improved by almost 500 basis points under ASC 605. While we feel very good about what we have achieved thus far, we are not resting on our laurels [ph], and frankly, we're just getting started. With the business model and the cloud-based transition largely behind us, we are completely focused on our platform strategy to add long-term value to our customers and drive higher lifetime value for Rapid7. We have big aspirations.

Now let us turn to our three main goals for 2019. Our first goal is to continue to focus on strong ARR growth, and we are again forecasting ARR growth of 30% plus in 2019 on top of the 53% in 2018. The end markets in which we operate are strong, and we now have four engines to drive the growth of our insight platform; they are all in different stages of maturity but each represents a significant opportunity, and together provide us with the foundation for meaningful levels of long-term growth.

InsightVM remains our largest product, and we expect the VM market to grow at a healthy rate in 2019. We continue to invest in this flagship product strengthening this offering, including remediation and automation capabilities which highlight our innovation and clearly differentiates us from the competition. We see continued adoption within our customer base and at the ability to add new customers. IDR, our second largest product solution continues to gain market share and we saw triple digit ARR growth in 2018 making this our fastest growing product. We expect strong growth for IDR in 2019. InsightAppSec, our third pillar continues to see strong adoption, and we expect this trend to continue in 2019. Customers are challenged by the need to secure fast growing modern applications driving demand. We provide one of the most comprehensive AppSec solutions to deliver continuous testing, monitoring and protection for these applications.

In addition, in Q4 2018 we completed the acquisition of tCell bringing next-generation detection and response and integrated provincial capabilities to our application security portfolio. Last but not least, InsightConnect; one of the first cloud native security orchestration, automation and response solutions in the market is the glue that connects all our other products with the ability to automate SecOps task and free-up scarce security resources. While the overall market is still in the early innings, we are really excited about this product and it's potential.

Our second goal is to continue to make it easier for our customers to adopt our platform and optimize our customer economics. While we are making great strides, we believe that we are just scratching the surface of the potential ARR per customer. As they adapt more products, we are seeing higher retention rates for our platform customers. A great example to highlight on a multi-product next-gen pipeline strategies resonating with customers is our win with a large publicly traded financial institution. This was an InsightVM customer looking to add more assets under coverage but also within the market to replace it's legacy SAM [ph] solution. Like many organizations, they monitor a large network of assets that have very limited resources. With unified agents already installed on most of their assets through our InsightVM products, InsightIDR was easy to deploy, use and maintain. But the ability to automate a significant number of security task with our InsightConnect product was a huge differentiator versus the competition and clinched the deal for us.

To reach more of this potential we are making multi-year investments to drive higher customer loyalty and customer satisfaction. We'll be optimizing our product portfolio and packaging to drive multi-product sales to enable our customers to adapt and consume more of our offerings which we expect will lead to higher retention rates and higher ARR per customer. Our goal is to move friction for customers by making product expansion simple and hassle-free. A customer who may currently use only InsightVM should be able to adapt all of our other products at the click of a button. We feel very confident in our ability to drive customer success and lifetime value because we have seen it in action across a growing portion of our customer base.

Our third goal is to continue to drive leverage in our business. In 2018 we saw operating leverage as the underlying economics of our business and sales model improves [ph]; and this gives us confidence in our ability to drive growth and scale for the long-term. With the investments we intend to make it 2019, we expect to obtain long-term leverage in our cost structure as we gain efficiencies throughout the business. We believe we're on our path to exit 2019 profitably on a non-GAAP basis, and we will strive to improve upon this every year.

In conclusion, we have established ourselves as a high growth cloud software company on a path to sustainable profitability. We enter 2019 as a stronger company than at any time in our history. We are operating in strong end markets and have a platform with many levers for growth driven by solutions designed to solve key SecOps challenges. I would like to thank all of our employees, customers and partners for their ongoing commitment to Rapid7.

With that, let me turn the call over to our CFO, Jeff Kalowski. Jeff?

[Jeff Kalowski, CFO]

Thanks, Corey and good afternoon, everyone. We're very pleased with our strong performance in the fourth quarter with results that exceeded guidance on all metrics. As Corey mentioned, we believe Rapid7 has established itself as a high growth cloud software company on a path to sustainable profitability.

Before I begin discussing our strong results for the fourth quarter and full year 2018, I want to remind everyone for the last time that as of January 1, 2018, we adopted ASC 606 on a modified retrospective basis; and therefore, we've been reporting each quarter's results in 2018 under both, ASC 606 and ASC 605. We've included all of these details in our earnings press release today. When discussing our year-over-year growth rates and other key trends in our business, we will be comparing our results on an ASC 605 basis as we don't have prior year operating results under ASC 606, and the comparison would not be meaningful. Moving forward, all results will be under ASC 606.

We set a high bar for our operational and financial goals for 2018 and we exceeded them. With four key products on our Insight platform, we now have multiple levers for growth. We successfully transitioned to a recurring revenue model with over 83% of our total revenue that was recurring in Q4 2018, up from under 70% in Q4 2017 under ASC 605. Also 94% of our product revenue was recurring in Q4 2018, up from 81% in Q4 2017, again under ASC 605. At the beginning of 2018 we regarded for ARR growth of at least 30%, and we delivered 53% growth. We ended the year with revenue of $244 million under ASC 606, a significant feat despite a decline in services revenue. We also delivered on the high-end of our operating income guidance reporting a non-GAAP operating loss of $20 million while investing the upside in the business to further drive long-term growth in scale. All in all, a very strong year.

Let's turn to our fourth quarter 2018 results; first on an ASC 605 basis. Total revenue for the fourth quarter was $70.6 million, an increase of 22% year-over-year and recurring revenue grew by 47%. Looking at the business geographically in Q4, North America comprised 85% of revenue, growing 21% year-over-year. Rest of World revenue increased 30% year-over-year and contributed 15% of total revenue in the fourth quarter. Our focus on recurring revenue drove a 50% increase in our product revenue offset by a decline in maintenance and support and services revenue. As perpetual customers migrate to the inside platform, maintenance revenue is reclassified to product revenue [ph].

Non-GAAP operating loss in the fourth quarter was $7.2 million on an ASC 605 basis, an improvement compared to a loss of $7.6 million in the prior year period. Our non-GAAP operating margin improved from a loss of 13% in Q4 last year to a loss of 10% for Q4 2018. Adjusted EBITDA was a loss of $5.2 million for the fourth quarter compared to a loss of $6.3 million in the prior year period.

Now, I will discuss fourth quarter results on an ASC 606 basis. Total revenue was $68.8 million above the high-end of our guidance. Our product revenue was once again driven by strong and broad-based ARR bookings growth across VM, IDR and Application Security. With a favorable shift towards ARR bookings, as expected, we experienced a slowdown in our professional services bookings. Visibility into our revenue forecast remains very high, recurring revenue was 83% of total revenue and 93% of product revenue, 82% of total revenue came from deferred revenue in the balance sheet at the beginning of the quarter. The value of our annualized recurring revenue increased to $251.8 million at the end of the fourth quarter, a 53% increase year-over-year and an acceleration from 46% growth in Q3 on top of 36% growth for the full year 2017.

Calculated billings for the fourth quarter was $94.3 million driven by strong new ARR bookings, as well as strong renewals performance. Average contract length was 16 months for total billings, down significantly from 25 months in the prior year period, and a slight decline from an average contract length of the 17 months we reported in Q3. We once again saw our customers shift towards one-year contracts with our move towards a subscription-based business model. As a reminder, we don't believe billings are a meaningful comparison to prior periods during this transition as they don't capture the benefit of a higher subscription mix and growth of our annual recurring revenue. Based on a trend over the last few quarters we anticipate that contract lengths will remain in this range going forward.

Our customer count increased by 11% year-over-year but we ended Q4 with more than 7,800 customers globally. Our customer growth reaccelerated despite a decline in the number of non-recurring services-only customers as we saw an increase in the growth of our product customers driven by the high growth of Insight platform customers. As a result, the customer base continues to improve and in Q4 our ARR per average customer increased to over $32,000 which is up 38% year-over-year. Overall, we continue to see strong bookings from new customers, upsells and cross-sells. Our expiring renewal rate remained at a high of 90% in the fourth quarter and our renewal rate was 120%, this reflected the strong growth in ARR.

Turning to margins; total non-GAAP gross margin in Q4 2018 improved sequentially, up slightly to 74%. We're benefiting from a shift towards higher margin product revenue, as well as a stabilization in our product margins as we achieved more scale on our cloud platform. Product non-GAAP gross margin was 80%, up from 79% in Q3 2018. Professional services non-GAAP gross margins decreased to 30% from 32% in Q3 2018 due to lower revenue as a result of lower services bookings with the focus on ARR and more strategic professional services.

During the fourth quarter sales and marketing expense decreased to 45% of revenue. We've realized almost 600 basis points of leverage in sales and marketing since Q1 2018 while continuing to show meaningful growth in ARR. R&D expenses were 22% of revenue, in line with Q3. G&A expenses were 11% of revenue, higher than in Q3 reflecting higher professional fees. Our non-GAAP operating loss was $2.7 million, well ahead of our guidance of a loss of $5.5 million to $4.5 million, and our operating margin improved to negative 4% compared to a negative 4.5% in Q3 2018. Adjusted EBITDA for the fourth quarter was a loss of $0.7 million. Non-GAAP net loss per share was $0.05 in Q4 2018, also well ahead of our guidance.

In 2018 we strengthened the balance sheet with a follow-on offering and then a convertible notes offering. These proceeds will enable us to continue to make strategic investments to extend our growth opportunity such as the tCell acquisition for which we paid $14.5 million in Q4 2018. We ended Q4 with cash, cash equivalents and investments of $303.7 million; this compares to $311.1 million as of Q3 2018. Our Q4 cash flow from operations was $11.9 million which reflected strong cash collections.

Now, I will summarize full year 2018 results under ASC 606. Total revenue was $244.1 million, non-GAAP operating loss was $20.4 million, and non-GAAP EPS was a loss of $0.41; all beating the high-end of our most recent guidance. Adjusted EBITDA was a loss of $13.4 million. Cash provided by operating activities was $6.1 million for the full year 2018 compared to $13.3 million in 2017. Cash flow from operations for the year was impacted by a rapid shift to subscription revenue and shorter contract lengths, and a decrease in professional services bookings. However, the speed at which we transition to a subscription model is a strong positive for the long-term growth and profitability of our business.

Now moving on to the guidance; as you might recall during our Analyst Day at the end of 2017, we set ARR growth expectations to be 30% CAGR through 2020. We're happy to say we achieved ARR growth of 53% in 2018, and again expect to be growing ARR by over 30% in 2019. For Q1 2019 we anticipate total revenue to be in the range of $68.9 million to $70.5 million. We anticipate non-GAAP operating loss to be in the range of $5.5 million to $4.5 million. We anticipate non-GAAP net loss per share for Q1 to be in the range of $0.10 to $0.08 which is based on an anticipated $47.9 million weighted average shares outstanding. For the full year of 2019 we anticipate total revenue to be in the range of $304 million to $312 million, which is 26% growth at the midpoint. We expect non-GAAP operating income to be breakeven in 2019 which is a meaningful improvement from the $20 million lost in 2018.

As Corey mentioned, we'll continue to make additional investments and we expect to invest any upside back into the business. We believe these investments will support a much larger business delivering improved scale and sustainable levels of profitability in 2020 and beyond. We anticipate non-GAAP net income per share to be $0.05 which is based on an anticipated $51.9 million diluted weighted average shares outstanding. The weighted average shares outstanding for the first quarter of 2019 represent basic shares outstanding given our projected non-GAAP net loss. The weighted average shares outstanding for the full year 2019 represent the diluted shares outstanding given our projected non-GAAP net income. Non-GAAP net income for full year 2019 largely represents interest income on projected cash and investments. On a GAAP basis we expect a full year net loss for 2019.

We expect cash flow from operations to again be positive in 2019. As a reminder, we're moving our global headquarters and consolidating facilities this year, and hence our free cash flow will be negative as a result of significant capital improvements in 2019 but these expenditures will decline substantially in 2020.

In conclusion, this was another strong quarter and year for Rapid7 driven by significant ARR growth, shift towards the cloud and subscription revenue, and realized leverage in the business.

With that, we appreciate your time and support, and we'll open the call for any questions. Operator?

[Operator]

[Operator Instructions] Our first question comes from Rob Owens of KeyBanc Capital Markets.

[Unidentified Analyst]

This is Liz [ph] on for Rob, thanks for taking the question. You know, really nice to hear the strength in IDR this quarter. Would love to expand on what percentage of new ARR deals include multiple products versus -- starting with VM and expanding there? Thanks.

[Corey Thomas, President & CEO]

I wanted to thank you for joining us, and Jeff and I can tag team it. We didn't give a detailed breakdown in the call. I think one of the key underlying questions that I think you're getting to is that are we growing the business outside of VM and the answer is absolutely yes, we are. One of this I think I just shared on the call, is that if you look at new ARR, almost 40% of our new ARR in Q4 came outside of vulnerability management, in a quarter by the way where we had very healthy growth with Insight of vulnerability management itself. And so from our perspective, the -- if you think about our IDR business has been the largest driver of that business, all the different product areas are performing well, we have a very, very healthy business both within VM and outside of VM.

[Jeff Kalowski, CFO]

Yes, I'll just point out that our platform customers grew again this quarter, and the products for customers are higher than our average, which is 1.5. Also, we have three drivers of growth; we have new customers, cross-sell and upsell, and all three segments group nicely this quarter, and also evidenced by our 120% overall rate renewal rate.

[Unidentified Analyst]

And then, I just quickly would love an update on how the tCell acquisition is being incorporated? And maybe how that factor is into expectations for 2020? Thanks.

[Corey Thomas, President & CEO]

One, we have a great traction overall in application security with our daft [ph] solution. As you pointed out, we acquired tCell at the end of last year to really position us as one of the leading cloud AppSec companies where we're actually looking at both, application and security testing, monitoring and in-app protection. tCell is in it's incubation and inclusion platform stage right now, we have not built a significant contribution to our overall model for this year. As per our habit, as we actually build out new product offerings, we really focus on the new [ph] and the customer used case building a strong value proposition and demand. So you'll see that come in at subsequent years but it's not back in heavily into our expectations for this year.

[Operator]

Our next question comes from Saket Kalia of Barclays.

[Saket Kalia, Barclays Capital]

Thanks for taking my questions here, and nice finish to the year. Corey, maybe starting with you; it's a question I asked last quarter but it's interesting to look at it again. Obviously, a lot a lot to talk about but one item that was nice to see was another quarter of 90% expiring renewal rate, and so -- so two consecutive quarters with a 9-handle not [ph] renewal rate. Can you just talk about whether you think that's sustainable? And what are the drivers of that slightly improved renewal rate in your view?

[Corey Thomas, President & CEO]

Yes, I think there is a couple of drivers. So the first thing is that we fully expect, and when you look at the underlying product line and product offerings, each and every last one of them will continue to improve their renewal rate for the foreseeable future in my mind, and we've seen consistent performance there. Now to get your question about what the drivers are, there is a couple of drivers. The first and I think the most important is what's the renewal rate of each of the individual product lines. The second one is what's the mix shift; as you can imagine, more established products have a much higher renewal rate than a product that would have just come out last year, so what's the mixed shift based on maturity product offerings.

And the last one is; what's the tail from our historical perpetual customers that had 3-year deals into the mix there. When you look at the most important thing which is the underlying renewal rate, we're highly confident that ASCO [ph] continue to improve. When you get to the other two which are about really mix related, those are the things that we sort of like pay attention to after the fact but they are not really fundamental drivers. We want all of our businesses to grow quite well, and so, if one is growing at 30% and another is at 50%, we're still happy because we're actually growing and taking share in the market; but that can have slight impact on our overall renewal rate.

So we really focus on the fundamental main [ph], and so to answer your question; the fundamental renewal rate of our products, as they come up for renewal; we see continued opportunity to improve that. The overall renewal rate is clearly going to have a lot to do with mix shift.

[Saket Kalia, Barclays Capital]

Got it, that's really helpful. Maybe for my full-up for you Jeff; clearly, we've outperformed our expectations that we laid out here in 2018. And based on the guide that you're putting out for 2019, it seems like we're going a little faster as well. And so I want to bring it back to the original framework that we put out for the long-term model out to '20, open ended question, how do we think about that framework now that we've put a bow on 2018 and have put a better than expected guide out for '19.

[Corey Thomas, President & CEO]

Yes. So Saket, yes, we are exceeding our 2020 goals. At Analyst Day, I think we laid out a $350 million ARR growth which was a 30% CAGR and revenue at $350million. So it's clear that those numbers have to go up and will be exceeded. Rather than give a specific number. Our feeling is what we want to do is get through 2019, get more visibility and update those numbers in the second half for the year rather than giving anything specific right now. But you are correct, that those numbers have to go up.

[Saket Kalia, Barclays Capital]

Got it, very helpful. Congrats again guys.

[Operator]

Our next question comes from Gur Talpaz of Stifel.

[Gur Talpaz, Stifel]

First question here, a really, really great AOR number, 53% growth this quarter. My question is, if you look into next few years you're striking a confident tone here calling for 30% plus growth again in 2019. So what gives you the confidence you know as of today to kind of sort of say that -- especially after kind of delivering a very, very strong end to the 2018 number?

[Corey Thomas, President & CEO]

I think the first and most important thing is, we actually have strong and healthy end-markets. It's much easier if you have really, really strong and healthy end markets actually for your team's performance to actually make a difference, and we're in very, very strong end markets; and I would say that includes every aspect of what we're doing. The second thing is that we actually have established clear customer demand, so in those strong end markets we actually have clear customer demand and we're state increasing customer preference. And so that gives us the ability to look out and say how do we think about our pipeline; how do we think about the opportunities that we're seeing, and how do we think about the future. And I think [indiscernible] and this goes to the previous question, is that, we built a strong business last year and we've see great health in our overall customer environment, and that allows us to actually have a great foundation to grow our overall customer economics as we go forward.

[Gur Talpaz, Stifel]

Corey, another one for you. You talked a bit about InsightConnect on the call itself but something you said kind of picked my interest; how do you view InsightConnect as a pull-through if you will for additional solution adoption; meaning for VM customers that may adopt InsightConnect; is it easier for them now to go and adopt IDR and AppSec, and how do you think about that as a mechanism for upsell to products outside of both Connect and VM?

[Corey Thomas, President & CEO]

If you think about what our general message is around SecApps, it has summer pillars but one of them is bringing together different constituencies in IT the environment; so the IT people, the security people, the opps [ph] people -- what you're finding in most modern IT shops, it is moving from these big multi-year projects to this ongoing evolution and improvement. And we think that value of what InsightConnect brings to the table is it delivers immediate productivity value but it then allows people to organically expand and solve additional problems. So if you think about the combination of InsightConnect and what we're investing in our core systems and the platform to make it easier to cross-sell and upsell; we expect problem solving to be more organic and economical for our customer, and that's the way that opps customers behave, that's we how security customers behave, that's a lot of the way that customers increasingly want to be like -- I want to solve my problem at my pace and when I want to solve it, and InsightConnect are some of enhancements that we're making allow that to be the case.

And so, yes, we do expect that as we go forward, not just this year but more importantly, over the next several years, we'll see increasing ability for our customers to adopt multiple of our solutions, and for our solutions to work tighter together, and frankly, for us actually integrate with other solutions in their environment. And again, our whole purpose is how do we draw productivity for our customers and make it easier for them to do their jobs.

[Operator]

And our next question comes from Matt Hedberg of RBC Capital Markets.

[Matt Hedberg, RBC Capital Markets]

Corey, you talked about strong expectations for VM, more growth in 2019, that's great. I'm wondering, could you help us understand -- and I'm sure it's hard to generalize but just roughly speaking, what percentage of your customers networks aren't being scanned right now? Is there sort of a ballpark figure kind of that you guys kind of see in an average customer?

[Corey Thomas, President & CEO]

Yes. So it's tricky because we're doing a very good job of actually adding new customers which if you think about -- new customers actually come in at a lower number of assets under management, and so the rate to add those fluctuates. What I would say is that we've seen a steady increase. Right now our rough estimate is, it is a rough estimate to have it on average at roughly 30% of assets under management. So we're currently being managed in our customer environment but that's a mix of some very mature customers. And frankly, we've done a tremendous -- our team has done a tremendous job of continuing to add new customers.

[Matt Hedberg, RBC Capital Markets]

That's great, that's fantastic to hear, it seems there is a lot of upside to that. And then I guess as a follow-up, we continue to hear really good things in the channel about AppSec; I mean, obviously IDR has been doing great but I think AppSec continues to resonate with some of the partners that we talked to. Can you talk a little bit more about what's driving that strengths? Are there higher tax rates in certain customers or maybe just a little bit more detail on kind of what you guys are seeing from AppSec?

[Corey Thomas, President & CEO]

I mean, one of the things that we just love about AppSec; and there is many things that we love about is -- but the most important thing is that underlying fundamentals are great, people are just adding applications at an extraordinary pace and an extraordinary rate. The second thing is, it is -- has lagged historically the awareness curve that you actually have to secure those applications, but the awareness curve is catching up fast. So you have lots of applications being added, people increasingly aware that they need to secure those applications and we're steadily building out our applications security portfolio; that's a great combination and mix. And we actually started from a space where we have one of the best ranked dash [ph] platforms, and that's the application-security-testing platform in the world. So we started from a place of strength and we continue to add great capabilities overtime, and I think that's where you see lots of the demand and the momentum come from.

The last thing I'd say is that, we actually think we're very well positioned to actually become a strong leader in the overall cloud applications security space which is where people are deploying out in the future and that's a big part of the reason why we bought G-sale [ph] and make lots of investments in that general area.

[Operator]

And our next question comes from Michael [ph] from Raymond James.

[Unidentified Analyst]

First of all, can you drilldown a little bit more on InsightIDR in terms of who you're competing with, who you see and where you're winning? And I would assume that you're growing faster, in percentage with ARR and the rest of the business, I just wanted to check.

[Corey Thomas, President & CEO]

Yes, so generally I'll tag team it, so I'll talk about the qualitative and Jeff can talk about some of the growth dynamics over there. Qualitatively, we did a big innovation with InsightIDR, and our overall goal was to disrupt the SIM [ph] market by making it much more easy, much more approachable, and to really drop productivity efficacy of the ability to detect and respond to attacks. The obvious first place if you look back a couple of years with that value proposition resonated was of course in the mid-sized enterprise and we've actually continued to have great traction there. What we've seen is that like it has happened with VM and it's happened in our broader market is that, that suddenly consistently expanded and now we're actually managing quite a number of actually very large and complex customers. And so we expect future growth to happen both, in the mid-size enterprise space and a large enterprise space and we're seeing significant evidence of that, especially if you look at the last quarter and the last year that we've actually had which has been a steady increase in that area.

[Jeff Kalowski, CFO]

So Michael, we have reported IDR growth as being triple-digit in the past, and it continued to grow triple digits on ARR year-over-year.

[Unidentified Analyst]

And then, if I can just get a follow-up on that on the investment side. You're going to be breakeven, you say for next year. Can you talk about where -- prioritize where the incremental investments are that keep you at that level high right now?

[Corey Thomas, President & CEO]

So I mean, to take a step back, the primary data we're actually focused on is we've come to the hard parts of the cloud SaaS migration. We think we have the opportunity to be a high-growth and profitable cloud SaaS security company. And so where we really focus our investments on are continuing to actually focus on the customer experience, which will actually make our customer economics better and better, which will drive profitability over time. So simply there are three areas that we're focused on. The first one is systems investments that allow us to more seamlessly have customers' cross-sell and up-sell. We want them to get our technology when they want it and when they need it. And the real benefit of this is that it provides more flexibility for the customer, giving them a better experience, and it will lower our overall costs of sale into the future, that's a great overall investment that actually drives growth and profitability in the future.

Similarly, we actually are investing in the overall customer engagement and customer management. The way to think about that is that makes it easier for customers to achieve outcomes and be successful. And by focusing on systems and processes around that, it allows us to address a much larger customer base and have better outcomes in that customer base at a lower cost that we've experienced in the past. And then the last thing we're focusing on is the pricing and packaging ecosystem at the systems level. We're continuing to grow geographically around the world, we're continuing to grow through the channel, both specific channel partners and the range and types of channel partners and we're just selling lots of products to customers. What we want to enable is every customers can get the product that they want, at the time they wanted, at a price point that's compelling for them to expand and grow in the business.

We look at those overall investments is really maximizing our customer economics and our ARR per customer and our customer lifetime value that allow us to maintain the momentum that we have of actually growing quite well by continuing to improve profitability.

[Operator]

Thank you. Our next question comes from Jonathan Ho of William Blair.

[Jonathan Ho, William Blair]

Hi, good afternoon. I just wanted to start with sort of the non-VM products and whether or not you're just trying to see them as serve as entry points to win new customers, or is this primarily still sort of add-on to existing VM customers as part of that cross-sell and up-sell motion?

[Corey Thomas, President & CEO]

It's a great question; what I'll say is IDR has always been an entry point. Early on, even IDR was sort of like half entry point to the new customers and half of them installed base. I would say, right now, all of our products actually effectively serve with entry points into new customers, at a slightly different rates, but all of our products whether there's is AppSec, security orchestration automation, which we recently introduced SGA or IDR, they all service, many have so actually acquiring new customers. And the nice thing is that we're starting to see momentum where we're going with the IDR customer and add VM or we'll go in with an AppSec customer and add VM or IDR. And so it's a very, very effective overall customer adoption strategy for us, which is why we have lots of visibility and confidence in our model to actually continue to expand ARR per customer.

[Jonathan Ho, William Blair]

And just given some of the uncertainty out there in the global macro, whether it's from the fed or from various regions like Brexit, I mean, are you as concerned at all about any of that noise maybe filtering down to either security spend or your areas of the market?

[Corey Thomas, President & CEO]

I mean, you all will be much more experts on the globe. I can tell you what we see and we pay attention to it tightly because we know how economics work and that's being careful to down at the time. What we see right now is a recognition that there is broad demand for security, and for the SecOps offerings that we actually have. So all customers, we're going to have budget today or whether they're trying to get budget, recognize that there's a strong need out there. And the second thing that we see is that right now, people are actually funding or finding ways to actually fund that need. So it's a fairly healthy environment now. What I would say is that we are lucky to be in a space where people see this as a need.

So even for organizations that may be budget constrained, they're saying, how do I get to this over time, which is exactly -- I've been doing this for a while, that's exactly the kind of space you want to be in is what people are finding ways to actually fund your solutions over time because they had value.

[Operator]

Our next question comes from Alex Henderson of Needham & Company.

[Dan Park, Needham & Company]

This is actually Dan Park on for Alex. Thanks for taking my question. So I know it's still early innings, but could you maybe provide an update on the automation and orchestration features, implementing within inside VM and IDR, and if this is starting to drive some additional customer interest?

[Corey Thomas, President & CEO]

Yes. So the -- for those of you who may recall, our InsightConnect, which is the evolution of demand, really had two primary strategic benefits for us. One is actually establishing a new market that was a value add. The second benefit was a differentiated, significantly our existing solutions, specifically inside VM and InsightIDR. And third, it actually made our products a lot more sticky for customers. I mean, those are three really big things. So I'll talk about each of those in turn. And so one, we have launched Insight -- we have launched InsightConnect, and we're seeing good momentum pipeline, via adoptions early, but we're seeing healthy ASPs and good adoption, and we're very optimistic about the future even though it's still in a very, very early innings. The second, it has been a clear differentiator for both InsightVM and InsightIDR because these are two areas where people are just under-resourced and under-constrained.

We've had many conversations with customers about how can I go beyond 30% of my environment for assets under management with VM, but I don't have the resources or the capability to manage the vulnerabilities and the threats I actually have today. What it turns out, that you can actually automate more of that, the customer is happy and then they actually take on the next stuff in the environment and that can move to 40% or 50%. The value proposition is resonating quite well overall. Likewise, with InsightIDR, the whole focus that we continue to evolve and continue to add capability to is how do I make it fast just to investigate things, and how do I make it faster to respond and immediate things. We're seeing very, very strong demand in the InsightIDR space, and it is a meaningful differentiator, increasingly of why we win.

The nice thing that we expect, and it's still early just because when we released it, is that for each of these capabilities, for the customers that we've seen will deploy these capabilities, it actually is extraordinarily sticky in their environment, far better it used to reflect in the fact that our platform customers have a much higher renewal rate, but we make that our platform increasingly is a much, much more sticky proposition than the offerings that existing with SIM-VM market a couple of years ago.

[Operator]

[Operator Instructions] Our next question comes from Lisa Franchi of Morgan Stanley.

[Melissa Franchi, Morgan Stanley]

Corey, you talked about being underpenetrated into your customer base. I'm wondering to what extent you're starting to see customers extend vulnerability management or InsightVM into maybe more what's called modern ITF, it's like IoT OT? And do you feel like you have the technology today to well address those use cases?

[Corey Thomas, President & CEO]

So one, we actually have wide deviation customers who come in. We do a great job of adding new customers. So customers, who come in, come in with a lower rate. What we also find is that customers expand and can expand to a very high rate. So we're seeing high levels of penetration in customers that have been with us for a while and of course, customers coming lower. We also see great adoption across the landscape. So customers priorities is we actually see them are, their core network data center assets, their end points, their applications, then the rest of their environment and that includes the IoT environment. We're actually excessively focused on actually operating in a way that actually customer see. So what we see adoption today in and where we have great products that deliver on today is that, one, we feel the way the strongest solution for actually covering core infrastructure.

Two, we actually feel that we have the strongest solution, we're actually covering cloud environments, and we see great uptick and greater adoption in overall cloud environments. Three, applications are where the gain is in the future, it's strategic, it's important, is what we were exposed. We have of the traditional VM competitors, the most mature and advanced operating and application security, and we're there. And in the IoT space, we have coverage today, and we're actually in the process of having -- and the process of continuing to expand our efforts to look at IoT and OT.

[Melissa Franchi, Morgan Stanley]

And then just as a follow-up, you've talked about you're focusing on resource constrained enterprises, but it seems like you're also having some traction in large enterprises as well. Can you maybe talk about what sort of adoption you're seeing in larger enterprises? And to what extent are you investing in that opportunity versus this -- that opportunities are coming to you?

[Corey Thomas, President & CEO]

So first and foremost, we're actually seeing a significant traction. We still have roughly 40% of the Fortune 100. We have some great brands that actually have enterprise-wide coverage, that a large enterprise across all sectors, frankly, whether you look at sort of like the finance sector, the technology sector, where we have an amazing footprint, the oil and gas industry. So we actually have the track that and has been growing steadily over time. The marquee in that segment, which is continue to get more and more enterprise adoption and of course, our InsightVM solution, and we're seeing rapid adoption right now with the InsightIDR. And oddly enough, InsightConnect is actually started in different parts of market. And in the last area is our application security offering, which frankly, started off with a heavier enterprise bias than any of our other offering. So we actually have traction and momentum across the enterprise segment.

To your question about the sort of the focus, from a products perspective, we have been and we are always focused on actually ensuring that all of our customers are successful, and we'll continue to make sure that we're meeting the needs and exceeding the needs of the large enterprise as well as the midsize enterprise customers. Now when we introduce new offerings, we always, just like anyone who's actually really good at something like building our product up, is just start with the target customer, we get successful with recurring customer and then you expand. And we're extraordinarily disciplined about that because that what allows you to build a sustainable long-term business. We're at the stage now with InsightIDR where we have a great core customer and now we're rapidly expanding that customer and we're adding capability, and that's working out quite well.

[Operator]

Thank you. And ladies and gentlemen, this does conclude our question-and-answer session. Thank you for participating in today's conference. This concludes today's program. You may all disconnect. Everyone, have a great day.