SolarWinds Corp

NYSE:SWI

Earnings Call Transcript 2020-Q4

[Operator]

Ladies and gentlemen, thank you for standing by, and welcome to the SolarWinds Fourth Quarter 2020 Earnings Call. [Operator Instructions]

I would now like to hand the call over to your host, Howard Ma, Senior Director of Investor Relations. Please go ahead.

[Howard Ma, executive]

Thank you, operator. Good morning, everyone, and welcome to SolarWinds' Fourth Quarter 2020 Earnings Call. With me today are Sudhakar Ramakrishna, our President and CEO; and Bart Kalsu, our EVP and Chief Financial Officer. Following prepared remarks, we'll have a brief question-and-answer session. This call is being simultaneously webcast on our Investor Relations website at investors.solarwinds.com. On our Investor Relations website, you can also find our earnings press release and a summary slide deck, which is intended to supplement our prepared remarks during today's call.

Please remember that certain statements made during this call are forward-looking statements, including those concerning our financial outlook, the impact of the cyberattack on our business, our market opportunities, the impact of the global economic environment on our business and the updates on the potential spin-off of our MSP business. These statements are based on currently available information and assumptions, and we undertake no duty to update this information, except as required by law.

These statements are also subject to a number of risks and uncertainties, including the numerous risks related to the impact of the cyberattack on our business and the potential spin-off of our MSP business. Additional information considering -- concerning these statements and the risks and uncertainties associated with them is highlighted in today's earnings release and in our filings with the SEC. Copies are available from the SEC or on our Investor Relations website.

Furthermore, we will discuss various non-GAAP financial measures on today's call, unless otherwise specified. When we refer to financial measures, we will be referring to the non-GAAP financial measures. A reconciliation of the differences between GAAP and non-GAAP financial measures discussed on today's call are available in our earnings press release and summary slide deck on the Investor Relations page of our website.

With that, I'll now turn the call over to Sudhakar.

[Sudhakar Ramakrishna, executive]

Thank you, Howard. Good morning, and thank you for joining us today. I hope you're doing well and staying safe. As you know, I joined the company earlier this year on January 4 and this is my first earnings call with the company. I want to start by first thanking our employees, customers, partners and our shareholders for their ongoing commitment to and for their support of SolarWinds.

I have long been a student of SolarWinds' high velocity go-to-market model. Our broad portfolio of solutions, low customer concentration, strong revenue recurring base, strong balance sheet and the opportunity to apply my background to address an expanding market opportunity to support the needs of ITOps, DevOps and SecOps professionals made it easy for me to say, yes, when I got the opportunity to lead the company as President and CEO.

In the 7 weeks that I have been with the company, I've had the opportunity to spend a lot of my time with customers and partners. The vast majority of the customers that I have spoken to understand that the cyber incident that affected us and others could have happened to any vendor, and especially a broadly deployed vendor like SolarWinds. Equally, they're eager to see us address the issue and share our learnings, which we are doing. The other opportunity that keeps coming up in these discussions is our ability to provide guidance and input to protect the entire environment of our customers as opposed to just focusing on our products, making us a more strategic partner.

The majority of our customers that downloaded a version of the affected code have upgraded to our latest version and continue to renew their contracts with us. While the first priority continues to be ensure the safety and security of our customers, our conversations with customers and partners have also given us the opportunity to discuss the strength of our entire portfolio and of our future plans.

I have also spent a significant amount of time on the cyberattack on SolarWinds, both in managing the investigation as well as working closely with our employees, customers and partners. I'll elaborate on our investigation, learnings and future plans, but first, I'll touch on a few financial and operational highlights in Q4 and 2020.

Our teams did a solid job of executing throughout the year in the face of a global pandemic. We hit a significant milestone that many companies aspire to, achieving non-GAAP revenues of over $1 billion in 2020. We grew non-GAAP revenues by 9% year-over-year for the full year 2020 and 6% year-over-year in Q4. We delivered an adjusted EBITDA margin of 48% for each of the full year and in Q4.

Our non-GAAP subscription revenue grew by 22% for the full year 2020, and our net retention rate was approximately 105% on a trailing 12-month basis. We sustained strong maintenance renewal rates north of 90% in 2020, and the fourth quarter renewal rates held up well despite the cyberattack on SolarWinds, which we announced on December 14.

We completed the SentryOne acquisition in the fourth quarter. Between our database performance analyzer, database performance monitor via the acquisition of VividCortex and SentryOne, we now have a comprehensive analysis and monitoring portfolio, supporting a broad range of database platforms across on-premises, native cloud and hybrid IT environment. Revenue for our database management products continued to grow in the fourth quarter, consistent with recent trends.

We expect SentryOne to help sustain that growth. The database solutions complement our already strong network, systems and application monitoring solutions as well as our efforts to become a leader in hybrid IT monitoring. Our core IT management subscription growth continues to be fueled by ServiceDesk, which is our ITSM product and our cloud infrastructure and application management solutions. Additionally, our MSP business again delivered double-digit 15% growth in both the fourth quarter and the full year, surpassing $300 million in revenue in 2020.

We ended the year with more than 25,000 MSP partners that service over 500,000 small, medium enterprise customers, reflecting our status as a leading provider of remote monitoring and management, security, data protection and business management solutions for MSPs around the world.

In December, we announced the confidential submission of a Form 10 registration statement with the SEC for the potential spin-off of our MSP business. While the process is difficult to predict, we continue to target completing the transaction in the second quarter. As part of the preparation for the spin-off, the MSP business, formerly known as SolarWinds MSP also announced a new brand in December.

Moving forward, the business will be known by a familiar name, Enable, extending the roots of the company. To reflect the performance, protection and partnership, our MSP partners need to power their clients and businesses forward.

Now let me turn to the cyberattack. Since we learned of it in December, our top priority has been to ensure that our customers are safe and protected. And the entire company has been working tirelessly to provide remediation, support our customers, cooperate with government authorities and share our learnings publicly. I want to take a moment to personally thank our customers, employees and partners around the world for their trust, patience, dedication, understanding and support during this time. As I came on board and learned more, it became clear that any company would be hard-pressed on its own to withstand this type of dedicated and sophisticated attack by a determined nation state.

It also became clear that the scope of the attack was much broader than SolarWinds as news and public disclosures emerged about breaches and compromises of other companies unrelated to us. We believe our Orion platform was targeted in this campaign to create a backdoor into IT environment of select customers. The threat actor did this by adding malicious code, known as SUNBURST, to versions that we released between March and June of 2020. SUNBURST has since been removed and is not an ongoing threat in current versions of Orion.

Additionally, after extensive investigation, we have not found SUNBURST in any of our more than 70 non-Orion products. One update that I believe is critical to share is that we previously disclosed that the number of customers that may have installed an affected version of the Orion software platform was fewer than 18,000. Based on our discussions with customers and our investigations into the nature of SUNBURST malicious code and the advanced trade craft of the threat actor, we believe the number of organizations actually exploited through SUNBURST is substantially fewer than the number of customers that may have installed an affected version of the Orion platform. This is consistent with statements by National Security Advisor for Cyber and Emerging Technology, Anne Neuberger, that as of February 17, 9 federal agencies and about 100 private sector companies were compromised.

While our attitude will always be that of one impacted customer is one too many, we currently believe the total number of customers potentially impacted is significantly lower than what was originally feared. We are applying our learnings from this event and sharing our work more broadly. Internally, we are referring to our work as secure by design. And it's premised on zero trust principles and developing a best-in-class secure software development model to ensure our customers can have the utmost confidence in our solutions. We see these investments as consistent with our goal of being a best-in-class provider of powerful, affordable and secure solutions.

We have published details regarding our efforts, but in summary, they are focused on 3 primary areas: first, further securing our internal environment; second, enhancing our product development environment; and third, ensuring the security and integrity of the products we deliver. We've added a level of security and review through tools, processes, automation and where necessary, manual checks around our product development processes that we believe goes well beyond industry norms to ensure the integrity and security of all of our products.

We firmly believe that the Orion software platform and related products as well as all of our other products can be used by our customers without risk of the SUNBURST malicious code. We also formed a new technology and cybersecurity committee of our Board. Two current sitting members of our Board, who are CIOs with significant cybersecurity experience, and I formed a 3 member committee. This committee has the responsibility to assist our Board in overseeing our response to the cyber incident and provide advice to management and oversight of our improvement initiatives. Given our unique experience, we are committed not only to leading the way with respect to secure software development, but also to sharing our learnings with the industry.

Now let me turn the call over to Bart to provide you details of our financial performance. Bart?

[J. Kalsu, executive]

Thanks, Sudhakar, and thanks again to everyone joining us on today's call. Our fourth quarter financial results reflect solid execution while demonstrating the resiliency of our model in the face of the cyberattack. We finished near the high end of the range of our outlook for the fourth quarter for non-GAAP total revenue, ending the quarter with $265.5 million in revenue, representing year-over-year growth of approximately 6%. Non-GAAP maintenance revenue was $124.3 million in the fourth quarter, up 8% versus the prior year, driven by consistent maintenance renewal bookings and reflecting sequential acceleration in maintenance revenue growth since the second quarter which was impacted the most by the pandemic. This growth was driven by solid customer retention as evidenced by maintenance renewal rates of over 90% in the fourth quarter.

For the fourth quarter, non-GAAP license revenue was $34.5 million, which represents a decline of approximately 23% as compared to the fourth quarter of 2019. The decline in license revenue resulted from the continuing impact of the global COVID pandemic, the impact of the cyberattack and our continued evolution to subscription sales for our on-premises products. We continue to see quarter-over-quarter sequential growth in sales of subscriptions for our on-premises products in the fourth quarter. On-premises subscription sales resulted in an approximately 3 percentage point headwind to our license revenue for the quarter.

Total non-GAAP license and maintenance revenue was $158.8 million in the fourth quarter, down 1% versus the prior year. Looking ahead, we expect near-term headwinds on our business due to the cyberattack and the pandemic. That said, we continue to see demand from both new and existing customers for our products and continue to renew existing customers, although at lower rates. Total ARR reached approximately $960 million as of December 31, 2020, reflecting year-over-year growth of 14%, which includes approximately 2 percentage points of contribution from our SentryOne acquisition in the fourth quarter. Subscription ARR grew 17%, reaching $435 million at the end of the quarter. Subscription ARR growth was not materially impacted by our SentryOne acquisition.

Moving to our subscription revenue. Fourth quarter non-GAAP subscription revenue was $106.6 million, up 20% year-over-year, which was driven by 16% year-over-year growth in our MSP business as well as solid performance in our core IT management subscription business. Our land, expand and retain model has successfully driven sustained growth in our customer relationships. Our subscription net retention rate for the year was 105%. Over the last year, we believe the pandemic has validated the importance of digital transformation to the small, medium-sized enterprises that depend on our MSP partners for IT management and security and has given us confidence in the strength of our business model. While we've seen some reduction in spending amongst some SMEs, we've also seen promising trends and uptake of our solutions as well as consistency among our larger MSP partners, resulting in stable net retention rates in 2020.

Total non-GAAP revenue for the year ended December 31, 2020, was $1.02 billion, which represents a major milestone as we broke the $1 billion mark in annual revenues threshold while delivering 9% growth over 2019 total revenue of $938.5 million. For the year ended December 31, 2020, non-GAAP subscription revenue was $399 million, which represents growth of 22% year-over-year. The growth was led in dollars by our MSP business and from a full year of revenue from our ITSM and VividCortex products that were acquired in April and December 2019, respectively.

Non-GAAP license and maintenance revenue for the full year in 2020 increased 2% year-over-year to $622.7 million. Non-GAAP maintenance revenue grew at a rate of 7%, reaching over $478 million. This growth was driven by solid customer retention as evidenced by a maintenance renewal rate of 91.5% in 2020. License revenue for the full year was negatively impacted by a combination of the slowdown in on-premises purchasing as a result of the COVID pandemic, the cyberattack in the fourth quarter and the impact of offering previous perpetual license products on a subscription basis, which we expect to yield more revenue over the full duration of the typical customer lifetime.

We finished 2020 with 1,057 customers that have spent more than $100,000 with us in the last 12 months, which is an 18% improvement over year-end 2019. We are continuing our efforts to build larger relationships with our enterprise customers. We also had a solid quarter of non-GAAP profitability in the fourth quarter. Fourth quarter adjusted EBITDA was $127.1 million, representing an adjusted EBITDA margin of 48%, exceeding the high end of the outlook for the fourth quarter. And for the year ended December 31, 2020, adjusted EBITDA was $489.7 million, representing an adjusted EBITDA margin of 48% for the full year as well.

Unlevered free cash flow for the full year totaled $431 million, which reflects an adjusted EBITDA conversion rate of 88%. The conversion rate was positively impacted by lower interest payments on our debt and improved net working capital. Net leverage at December 31 was 3.2x our trailing 12-month adjusted EBITDA, despite the use of $142 million of cash on the acquisition of SentryOne in the fourth quarter.

For the full year in 2020, we reduced our net leverage ratio from 3.9x to 3.2x, reflecting the power of our model to complete an acquisition the size of SentryOne and still delever significantly over the course of the year. With $370.5 million in cash at December 31, we are well positioned from a financial standpoint to continue to invest in the future growth of our business. I will now walk you through our first quarter outlook before turning it over to Sudhakar for some final thoughts.

As it relates to the full year, there is uncertainty around the impact of the cyberattack on top of the continuing impact from the global pandemic. We are encouraged by recent engagements with both prospective and existing customers, and we are cautiously optimistic about growth of our business in 2021. While ongoing customer renewals and pipeline growth are indicators of the health of our business, we feel it is still too early to predict the range of outcomes with the level of precision we have provided in the past. As such, we believe it is prudent to only provide first quarter of 2021 outlook for total revenue, adjusted EBITDA and earnings per share at this point.

For the first quarter of 2021, we expect non -- total non-GAAP revenue to be in the range of $247 million to $252 million, representing year-over-year growth of negative 1% to positive 1%. Adjusted EBITDA for the first quarter is expected to be $98 million to $101 million, which implies an approximately 40% EBITDA margin. As a reminder, our adjusted EBITDA margin is typically at its lowest level in the first quarter of every year due to lower license revenue and an increase in expenses, particularly around social security and payroll taxes.

That said, the year-over-year decline in adjusted EBITDA also reflects incremental spending related to the SentryOne acquisition, investments in our MSP business in advance of the spin and the incremental expenses we are making in our security-related initiatives. As it relates to 2020 and 2021 adjusted EBITDA, we expect our investments in security-related initiatives to be approximately $20 million to $25 million. Non-GAAP fully diluted earnings per share is projected to be $0.19 to $0.20 per share, assuming an estimated 318 million fully diluted shares outstanding.

Our outlook for the first quarter assumes a non-GAAP tax rate of 22%, and we expect to pay approximately $17.2 million in cash taxes during the first quarter of 2021. And finally, our first quarter outlook assumes a euro to dollar exchange rate of 1.19 and a pound to U.S. dollar exchange rate of 1.34. While we are not providing full year outlook, I will say that we expect license revenue growth to improve as we move through the year in all regions and particularly in our EMEA and APJ regions.

Based on what we've seen so far in the first quarter, maintenance renewal rates are expected to be in the low to mid-80s in 2021. And we are targeting to return to historical performance in 2022 as we work with our customers to ensure their success and as we continue to further enhance our product portfolio. Increasing the percentage of our recurring revenue has been a focus of ours over the past 5 years, and recurring revenue is now 86% of our total revenue. We will continue to expand the subscription offerings of our on-premises products in 2021 and make new subscription sales a priority with our sales teams. As we said previously, we continue to explore the previously announced potential spin-off of our MSP business, now known as Enable and continue to target having that transaction occur in the second quarter of this year.

With that, I will now turn the call back over to Sudhakar for his closing remarks.

[Sudhakar Ramakrishna, executive]

Thank you, Bart. In my various executive assignments, I have sought to let humility, ownership, transparency, focused action and a bias towards customer success be my guiding principles. We are committed to practicing these principles actively at SolarWinds, and as we do, we will emerge stronger as a business. Over time, we see significant opportunities to increase our relevance to customers and to expand our market by leveraging our network, systems, applications and database analysis and monitoring tools, along with our excellent IT service desk and tools portfolio.

We intend to integrate our platforms and serve the evolving hybrid IT needs of our customers. We will enable ITOps, DevOps and SecOps professionals to have integrated experiences across automation and configuration, monitoring, visibility, alerting and remediation. These moves will further accelerate our progress towards a greater mix of subscription and recurring revenues. As we look to the next several quarters and years, we believe that we have a growing market opportunity, and we intend to organize our activities and plans to achieve and, in some segments, exceed market growth rates over the long-term even as we deliver strong EBITDA margins.

As a result of the operating leverage that we have created in our business to achieve a balance between sustained growth and strong profitability, we expect to take the following key actions: expand our international go-to-market investments to capture additional growth and market opportunities, accelerate our evolution to our customer success model and further enhance our sales team's ability to land new customers and expand. We believe this critical evolution will lead to a better customer satisfaction and, over time, increase the lifetime value of our customers, continue to nourish our high velocity go-to-market model while also expanding with the enterprise and global system integrated motions, we started in 2020.

We are embarking on additional portfolio integration and packaging efforts to support enterprise customers, accelerate our offering strategy to comprehensively address the needs of hybrid IT deployments with flexible deployments that is cloud, SaaS and on-premises with an associated evolution to a greater subscription mix. Selectively expand via inorganic investments that both round out our portfolio as well as enhance our ability to capture market opportunity faster.

I'll conclude again by thanking our employees, partners and customers for their commitment to and support of SolarWinds. Over 20-plus years, we have earned the trust of our customers by delivering powerful and affordable solutions, and I'm confident that going forward, we will be known for delivering powerful, affordable and secure solutions.

Bart and I will now be happy to address your questions.

[Howard Ma, executive]

Operator, we're ready for questions.

[Operator]

[Operator Instructions] And your first question comes from the line of Sterling Auty with JPMorgan.

[Sterling Auty, analyst]

You touched upon a number of the key elements, but I wanted to dive back in specifically around kind of the comments that you made about improvement through the year on kind of the demand picture in 2 ways. Number one, I want to make sure I understand how much are you kind of baking in, in terms of improvement in the small piece, which is the licensing. But more specifically, the subscription, are you expecting that the demand for subscriptions will bottom in March and then start to show some improvement through the year?

[J. Kalsu, executive]

Yes, Sterling, I mean, we talked about what we've done so far in the fourth quarter as it relates subscription sales being a 3% headwind to license revenue. That's fairly consistent with what we saw in the other quarters in 2020, right? And so we're expecting that headwind to continue in 2021. And like we said, we're going to make subscription sales a priority. So if anything, that headwind is only going to be even a little bit stronger as we move through 2021.

[Sterling Auty, analyst]

Right. But I guess what I'm asking is the demand impact from the breach, are you expecting the demand for your subscriptions, not the mix, but just demand for subscriptions in general to kind of hit a bottom here near term and then show improvement through the year?

[J. Kalsu, executive]

Yes, absolutely. As we've been building out our forecast for 2021, Sterling, we expect the biggest impact to be in the first quarter. And then as we move through the rest of the year, we expect demand to continue to improve.

[Sterling Auty, analyst]

And then just one follow-up on the maintenance. You gave us maintenance renewal rates, but I want to understand, when you think about the seasonality of when those maintenance renewal contracts come up, what does that mix look like? Because I would imagine that, that would be more weighted towards Q4. So are you expecting that the biggest maintenance hit might actually not come until Q4?

[J. Kalsu, executive]

Sterling, there's not really a lot of seasonality as it relates to our business. When I look at what our bookings are from a maintenance standpoint, they're consistent quarter in and quarter out. So although we have some of our customers that like to co-term to a fourth quarter maintenance renewal date, that's just not a trend that we've seen historically.

[Operator]

Your next question comes from the line of Brad Zelnick with Crédit Suisse.

[Brad Zelnick;Crédit Suisse;Analyst, analyst]

Sudhakar, I think it's pretty clear that SUNBURST is a wake-up call for the entire industry. This is not a SolarWinds issue but an industry issue, and it's good to see SolarWinds taking a leadership position in addressing these types of attacks. I wanted to ask a question that I think may be difficult for you to comment on. But just on the future liability and potential litigation related to SUNBURST, how are you thinking about any of these liabilities and customer claims and the degree to which SolarWinds might be covered by its licensing agreements?

[Sudhakar Ramakrishna, executive]

Thank you for the question. The point you made last is the most relevant one, which is much like most software companies we have covered through our end-user licensing agreement. And as you mentioned, SUNBURST is not just a SolarWinds' specific issue, but it's a broader industry issue. And as you also know, most software vendors, unfortunately have vulnerabilities that they disclose and correct on a go-forward basis. And so we have similar practices at SolarWinds as well.

[Brad Zelnick;Crédit Suisse;Analyst, analyst]

Okay. And maybe just a follow-up for Bart. I want to make sure I heard something that you called out, and I heard it correctly, which is $20 million to $25 million security -- in security-related initiatives. Can you maybe put a finer point to the time frame and the cost of remediation related to the incident versus ongoing changes to your business process related to SUNBURST?

[J. Kalsu, executive]

So yes, the $20 million to $25 million, Brad, is the cost that we expect to incur throughout all of 2021. And that's a combination of both security initiatives that Sudhakar talked about as well as just some general increases in some of our expenses such as we expect our insurance cost to go up in 2021. And then there's other charges, some of our professional fees will go up as a result of the cyberattack as well.

So really, just the $20 million to $25 million number was to give you some context of what we expected the increase in our expenses to be not just for '21, but as we move forward as well.

[Sudhakar Ramakrishna, executive]

And Bart, I'd also like to clarify that these are not necessarily related to remediation as much as we are looking at these as extensions and investments for us going forward. And as I mentioned in my remarks, that our aspiration is to support the broader needs of IT, dev and SecOps professionals.

[Operator]

Your next question comes from the line of Matt Hedberg with RBC Capital Markets.

[Matthew Hedberg, analyst]

Welcome Sudhakar. And thank you for the transparency on the cyberattack. I know it's a fluid situation, but I think we all appreciate the details here. Maybe the first question, can you talk -- I mean we're effectively 2 months into the Q1 quarter here. I'm wondering if you could talk about the pace of new business kind of the linearity through 2 months versus sort of what you would expect in a normal Q1? And then secondarily, on the maintenance side of it, you talked about mid, I believe, low to mid-80s renewals this year. Is there a difference between your public and private sector maintenance renewal rates?

[J. Kalsu, executive]

Matt, the renewal -- first of all, the renewal rates that we gave you, the low to mid-80s, that takes into account both our federal as well as our commercial customers. So that's not a renewal rate that we've historically broken out between those 2 pieces of our business. So the low to mid-80s range that we gave you reflects both of those as well. So -- and then as far as the pace of our business, the pace of our business in the first quarter, obviously, it's been impacted by the attack but we're seeing positive trends. And like I said, we expect the first quarter of 2021 to be the one that's the most heavily impacted as it relates to new license sales.

[Sudhakar Ramakrishna, executive]

And just to add on to Bart's comments, I have been spending a lot of my time with our customers, both in the public and in the private sector and especially with the federal government customers, spending time with their CIOs, CISOs, highlighting, as you put it transparently, the findings from SUNBURST as well as the remediation steps.

A lot of our customers, as I mentioned in my remarks, their reaction has been one of understanding. And many of our customers, including in the public sector have already upgraded to our remediated code.

[Matthew Hedberg, analyst]

That's great. And then on Enable, the MSP business. When I think of growth there, I think both expanding the number of MSPs but also expanding what you can sell to them. I guess on that second part, as we progress through this year and beyond, how do you think about adding more services to that business?

[Sudhakar Ramakrishna, executive]

I'll take that, Bart. So the Enable business, as we're going to be branding it going forward, we'll continue to expand its portfolio. We recently made some strategic announcements as it relates to our partnership with Sentinel as an example. So for a business that was largely focused on remote monitoring in the past, it has already evolved and continues to evolve into data protection, into security. And in the future, I'm sure we'll explore additional avenues like analytics and insights as well.

[Matthew Hedberg, analyst]

Actually, maybe, Bart, just a quick -- just last one here. Can you remind us again about your exposure to the federal segment? Roughly, what percentage of total revenue is that side? Federal, state, local kind of the...

[J. Kalsu, executive]

Yes. I mean that's not a number that we've historically broken out, Matt. It's -- our federal business is -- it obviously is a big piece of our revenue, but it's not a number that we've -- that's been big enough that we've had to disclose separately.

[Operator]

Your next question comes from the line of Sanjit Singh with Morgan Stanley.

[Sanjit Singh, analyst]

Congrats on the role Sudhakar and even bigger kudos for accepting the role, just given the headlines in December. But it does seem like the business is proving resilient. And I just wanted to dive into a couple of topics. One on sort of the comment around -- this could have happened to anyone. I think most of us would certainly agree. But is there any sort of -- as we sort of look at SolarWinds, was there any sort of things from an operations perspective that made the company more or less vulnerable relative to your peers, whether it comes from on the -- having distributed product engineering teams or anything that, like, the company is going to do better to shore up any potential vulnerabilities from the operations side? That's my first question.

[Sudhakar Ramakrishna, executive]

Sanjit, thanks for the welcome. As it relates to why we believe it could have happened to anyone as we deconstructed what the threat actors did, we found malware that essentially can be injected into any supply chain. That's the reason why we publicly disclosed it so that other companies can look at their own supply chains and potentially protect themselves from both current and future attacks.

As it relates to was there anything specific to the SolarWinds' environment, we could not find anything that was idiosyncratic to the SolarWinds' environment. And if anything, both our security hygiene, security posture, security tools are consistent with what is practiced in the industry.

[Sanjit Singh, analyst]

Got it. And then as you sort of manage through the SolarStorm compromise and work with your customers. I guess the larger question is, what is your vision for SolarWinds as the company sort of comes out of this? And as you look at what the company has been focused on, the strategy, how they sort of balance growth versus margins, should we see your tenure sort of extending that line of thinking? Or are you looking to change things fundamentally from a strategic perspective? What's sort of your initial thoughts on how the business will be run and managed going forward relative to the past?

[Sudhakar Ramakrishna, executive]

Definitely. My focus will be to essentially extend the strategy in the following way. I personally believe we have the broadest portfolio, if I may use that term in network, systems, application and database monitoring combined with our IT service desk as well as our tools portfolio. Going forward, what we intend doing is integrating them into a way that we can support the hybrid needs of our customers so that they can deploy on-premises or in the cloud, and we will be able to provide them consistent capabilities with one integrated platform.

Additionally, we feel there is a significant opportunity for us to expand our monitoring to first into the automation and configuration aspects of things, then on to alerting and remediation with our IT service desk as an integrated portfolio such that we are able to support the entire life cycle of our customers. That is what we see as a market opportunity for growth going forward.

And as we do that, we will continue to balance between growth and profitability and continue to demonstrate the operating leverage that we have created in our business.

[Sanjit Singh, analyst]

Understood. That's a great overview. If I could sneak one in for Bart. My other question is, why is there sort of lingering hesitation on guiding for the full year? If I look at some of your cohorts that sell into similar segments, they sort of gotten back to annual guidance cadence. ARR accelerated this quarter. Your Q1 guidance is more or less in line with consensus. So the question is sort of what is the fear around providing guidance given that the business looks relative [ full year, having some ] impact, but it doesn't seem like there's tons of volatility in the numbers, at least so far.

[J. Kalsu, executive]

Yes. Sanjit, thanks for the question. We like to talk about the fact that recurring revenue is 85% or 86% of our total revenue. But we do still have a license piece, a license component as it relates to our revenue. And there's just enough variability in the full year of 2021 and enough -- there's enough uncertainty around what our new license sales are going to be that we just weren't confident to give -- enough to give a full guide. We like to be pretty precise when it comes to guidance. And there's just enough -- there's a broad enough range of outcomes that we just weren't confident to give a full year guide at this point.

[Operator]

Your next question comes from the line of Erik Suppiger with JMP Securities.

[Erik Suppiger, analyst]

Welcome Sudhakar. One, can you provide some context around the churn in the federal sector versus the -- your nonfederal sector? Clearly, this attack was primarily targeted to the federal customers, and it would be helpful for us to understand what impact this is having on the nonfederal sector in particular?

[Sudhakar Ramakrishna, executive]

Sure. I would say at this point, it's too early to quantify churn as it's been about a little over 2 months since this whole event occurred. The way I would describe our activities are one of engagement and one of helping customers remediate and look forward. So through our conversations -- and as I mentioned, I personally have had many conversations with both private and public sector customers. I would say some customers have taken a wait-and-see attitude, but not necessarily a focus on churn or replacement at this point in time.

Additionally, as I mentioned, the vast majority of the customers that I have spoken to and we continue to engage with have not only upgraded, but many of them also have renewed their contracts. So those are the indicators I can present to you at this point in time, not so much a specific churn indicator.

[J. Kalsu, executive]

And Erik, the expected renewal rates that we -- that I've provided you, the low to mid-80s for the full year. That includes both our commercial as well as our federal customers. So yes, we are seeing a lot of questions, when customers are up for renewal. But like Sudhakar said, right now, they're taking more of a wait-and-see approach. It's not that they've -- that they're immediately turning us off or not renewing their maintenance contracts.

[Sudhakar Ramakrishna, executive]

And I also believe that is because of 2 important factors. One is customers that we speak to and customers who have used multiple software vendors recognize and understand that vulnerabilities and software issues can happen to any vendor. That's number one. Number two, that it is a reflection of their confidence in the breadth of our portfolio and our ability to deliver their customers -- their success.

[Erik Suppiger, analyst]

Okay. Then real quick on the Enable spin-out. Can you tell us what the growth was in fiscal '19? And how that can -- obviously, it was 15% in fiscal '20. So just curious what the trajectory is there?

[J. Kalsu, executive]

So yes, the MSP business, Erik, just like a lot of other businesses, was impacted by the COVID pandemic in 2020. So 2019 growth would have been slightly higher than that 15% that we saw in 2020. But any of the impact as it relates to growth from 2019 to 2020 was really due to the pandemic and a little bit of the slowdown that we saw in the second quarter, and we saw really positive trends in our MSP business in Q3 and Q4.

[Erik Suppiger, analyst]

So can we assume that, that's a high teens type growth on a normalized basis?

[J. Kalsu, executive]

Yes. Yes, that's the goal.

[Operator]

Your next question comes from the line of Brent Thill with Jefferies.

[Luv Sodha, analyst]

This is Luv Sodha on for Brent Thill, and welcome Sudhakar to SolarWinds. I wanted to ask one quick one on -- there has been a bit of focus on the renewals. And are you sort of offering any concessions to the customers that are renewing? Or are these normal conversations that you would otherwise have?

[Sudhakar Ramakrishna, executive]

Our conversations on the renewal front have been normal other than the fact that, in some cases, we have had to explain to customers what we are doing, where we are headed, why they should feel secure, et cetera. If your question is related to pricing or promotion, I would say, our behavior has been per what it always has been.

[Luv Sodha, analyst]

Got it. And maybe one quick follow-up, if I may, on the -- you mentioned some of the investments you're making this year on the product side. I wanted to ask, are some of these investments, be it on the product or the go-to-market side, are they more longer term in nature? Or -- I'm trying to assess longer-term margins -- impact on longer-term margins.

[J. Kalsu, executive]

Yes, Luv. What we talked about on the -- what we've talked about primarily was expenses that related to the security incident. So Sudhakar talked a lot about our secure by design initiatives and there are going to be some costs associated with that. But like I said, we expect those costs to be in the $20 million range in 2021. So when you're thinking about what margins are going to be long term, what I would tell you is that we think that margins are going to be at their lowest level in Q1, and margins will improve as we move throughout the year.

And then as we look at 2022 and beyond, we're always going to -- we're going to always weigh investment decisions and try to decide between both growth and profitability.

[Sudhakar Ramakrishna, executive]

And to your question about whether some of these investments will yield returns this year versus longer term, some of the investments that I outlined are expected to yield returns this year, most likely in the back half of this year and on into 2022.

[Operator]

Your next question comes from the line of Kingsley Crane.

[William Kingsley Crane, analyst]

Welcome Sudhakar. And completely agree with you, I think the more we learn about the nature of this highly manual attack, the better we can appreciate. This could happen to anyone. So it's encouraging that customers are agreeing. But researchers also found that adopting zero trust is one of the more effective ways for customers and vendors to protect themselves from these types of attacks. So given your experience with zero trust while at Pulse Secure, do you see opportunities to leverage that experience in SolarWinds today?

[Sudhakar Ramakrishna, executive]

Absolutely. So as part of our secure by design initiative that I outlined, as I mentioned, I don't look at this as a remediation effort as much as an ability to set the stage for a leadership effort over several quarters and years. So one of the key aspects of secure by design or a couple of key aspects, I would say, is that it is premised on zero trust principles. And when I say that, that applies both to our infrastructure as well as how we plan to build products going forward. So some of the conversations that I've been having with customers, for instance, is how do we establish least privileged access models within both our products as well as other vendors' products that enable the safety and security of our customers.

So this is the point I was making, as I was describing, that one opportunity that comes up in our conversations with customers is not only how we protect them through our products, but also provide guidance to them across their environments that is rooted on least privileged access or zero trust principles and other related constructs.

[William Kingsley Crane, analyst]

Great. That makes perfect sense. That's very helpful. So one more just on the MSP side. I was encouraged to see the productivity of the name change to Enable in December. Would just love to hear a little bit more color on decision to adopt what's been a strong brand name for some time and how receptive customers have been so far?

[Sudhakar Ramakrishna, executive]

That’s for the reception, but from our partner community has been very strong in terms of the Enable brand. And as you know, the MSPs business primary objective is to enable partners to, in turn, enable our small, medium enterprise customers. So the partners find that this is a nod to the model and are redoubling and recommitted to expanding the business.

[Operator]

Your next question comes from the line of Rob Oliver with Baird.

[Robert Oliver, analyst]

Sudhakar, one for you, and then Bart, I had a follow-up for you as well. Just Sudhakar, on the subscription products. It does sound like demand is kind of coalescing nicely around the old Samanage product, ITSM and around database with VividCortex. Is that right? And are there other products in that portfolio of SaaS subscription products that you are optimistic about? Or perhaps you could take the opportunity to talk a little bit about how you view expanding that portfolio?

[Sudhakar Ramakrishna, executive]

Absolutely. The observations that you made on both the service desk and database are absolutely correct. In addition to that, I alluded to additional packaging and integration considerations that we are executing throughout this year. That applies broadly to our, call it, traditional products based on the Orion platform, including network and system management. So as a result of that, I expect the subscription mix of that business to continue to grow as well.

Now if you take a perspective of a few quarters out, as we integrate our platforms into much more of a singular motion, then increasingly, our primary motion will become subscription on that particular platform. So over time, the goal is to improve the mix and expand it from the current 86% to something higher going forward.

[Robert Oliver, analyst]

Okay. Great. That's helpful color. And I think that ties directly, Bart, into what my follow-up question with you is going to be, which is you guys traditionally have been agnostic as to how your customers bought. And so clearly, you change here on this call. And I guess your comment relative to prioritizing subscription would go hand-in-hand with what Sudhakar said. Are there incentives built in there for the sales force? And any other changes relative to the go-to-market? And I would assume you're going to do this and keep consistent with sort of the kind of lean, like go-to-market model that SolarWinds has always pioneered.

[J. Kalsu, executive]

Yes, Rob, I mean, as it relates to our subscription offerings, like you said, we've been agnostic. At the end of the day, we want the end user to have the ability to purchase in either -- under either in a subscription arrangement or under our traditional license maintenance agreements, right? And we're not going to change that. However, from an investment standpoint, we are going to put more dollars behind some of our on-premises products, and we're going to try to make that a priority as we move forward.

[Operator]

Your next question comes from the line of Kirk Materne with Evercore ISI.

[Peter Burkly, analyst]

This is actually Peter Burkly on for Kirk. My first one is, and apologies if I missed this in your prepared remarks, but just wondering if you guys have any update just on the timing of the spin-out of the MSP business?

[J. Kalsu, executive]

So yes, we're still expecting that spin-out to happen sometime in the second quarter.

[Peter Burkly, analyst]

Okay. Great. Awesome. And then just one quick follow-up. Just wondering, I mean, it sounds like the cyberattack had more of an impact on the licensing piece of the business, which makes sense. But just wondering if it had any impact on the MSP business at all as well?

[J. Kalsu, executive]

There was a slight impact in January, just as some of our MSP partners and some of our -- some of their end customers assessed the potential impact. Once we were able to assure them that none of our MSP products were part of the cyberattack, we've started to see the MSP business get back to its form.

[Operator]

Your next question comes from the line of Mohit Gogia with Barclays.

[Mohit Gogia, analyst]

I was just wondering if you can -- I mean when you initially discussed and announced the spin-off last year, you had a framework for the SolarWinds stand-alone post the spin-off and the MSP business, what the growth and profitability framework and profile will look like, right? And obviously, things have changed somewhat. I mean you're discussing some incremental investments in security and also product-related investments, right?

So just wondering, if you can sort of like maybe touch upon if any goalposts have moved. So I think SolarWinds stand-alone, you had discussed a low to mid-single-digit store. In the mid to long-term MSP business, I think you had discussed mid to high teens. But just curious, as to if you can update us how you're thinking about the 2 separate businesses post the spin-off in terms of growth versus profitability? And then I have a follow-up question.

[J. Kalsu, executive]

Yes, Mohit. I mean one of the reasons why we didn't provide full year guidance is because there's still a certain amount of uncertainty as it relates to the revenue side of our business. The goal is to continue -- when we split the MSP business and the core IT business, to have 2 separate companies, they'll have 2 somewhat different financial profiles. The core IT business, we talked about being a mid to high single-digit grower. That will obviously be impacted as it relate to the cyberattack in 2021. But we think that those impacts will be short term in nature. And we think as we move into 2022, we will continue to look like the company we talked about when we announced the MSP spend last year.

[Operator]

You do have a follow-up with Sterling Auty with JPMorgan.

[Sterling Auty, analyst]

So just -- actually on the spin, I've gotten a number of questions from investors around if there's any change or update in thinking in terms of how the 2 companies would be capitalized. In other words, where would the debt actually go? And would there be any need for any financing actions along through that process?

[J. Kalsu, executive]

Sterling, we're still looking at the potential capital structures of both of the businesses long term and post spin. So when we move into the second quarter, we'll have more discussion around that.

[Operator]

There are no other questions at this time.

[Sudhakar Ramakrishna, executive]

Okay. Thank you, again, everyone, for joining us, and we'll be in touch.

[Operator]

This concludes today's conference call. You may now disconnect.