Good day. Thank you for standing by. Welcome to the Rapid7 second quarter 2021 earnings conference call. At this time, all participants are in to listen only mode. After the speaker's presentation, there will be a question and answer session. To ask a question during the session, you will need to press star one on your telephone. Please be advised that today's conference is being recorded. If you require any further assistance, please press star zero. I would now like to hand the conference over to Sunil Shah, Vice President of Investor Relations. Thank you. Please go ahead. Thank you, operator. Good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's Q2 2021 financial and operating results, in addition to our financial outlook for the third quarter and full fiscal year 2021. With me on the call today are Corey Thomas, our CEO, and Jeff Kalowski, our CFO. We've distributed our earnings press release over the wire, and it is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast, and following the call, an audio replay will be available at investors.rapid7.com until August 11th, 2021. During this call, we may make statements related to our business that are forward-looking under federal securities laws. These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to the company's positioning, our future goals, and financial guidance for the third quarter and full year 2021, and the assumptions underlying such goals and guidance. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the expectations contained in these statements due to a number of risks and uncertainties, including those contained in our most recent quarterly report on Form 10-Q and in subsequent reports that we file with the SEC. The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by applicable law. Our commentary today will primarily be in non-GAAP terms, and reconciliations between our historical GAAP and non-GAAP and guidance can be found in today's earnings press release. At times, in our prepared comments or in response to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or quarterly results. Please be advised that this additional detail may be one-time in nature, and we may or may not provide an update in the future on these metrics. With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey? Thank you, Sunil. Good afternoon, everyone. Thank you all for joining us for our second quarter 2021 earnings results call. I'm pleased to once again report sustained outperformance in our business as Rapid7 delivered strong second quarter results, exceeding both our growth and profitability goals for the quarter. Strong demand across our Insight platform drove year-over-year ARR growth of 29% into the quarter at approximately $489 million. As we shared a few weeks ago, this strong organic growth is a validation of both our strategy and our execution as we continue our journey to make the best in security operations accessible and achievable for all. Our ability to meet customers where they are in their SecOps journey with leading capabilities across vulnerability risk management, detection and response, and cloud security is resonating, as evidenced by two consecutive quarters of accelerating customer growth to start 2021. I'll share more on this momentum and our customer growth engine shortly, but I'd like to start today with some perspective on the security landscape and what we're hearing from our customers. If you think back to our Investor Day in March, I shared with you how we are in a fundamentally new dynamic right now when it comes to the pace of technology adoption. Companies of all sizes across industries and regions are dramatically increasing their focus on delivering world-class digital and remote experiences for their customers and employees as they look to keep up with the pace of innovation. However, alongside this rapid expansion of their technology footprints, customers are experiencing an evolving threat landscape. We are in an environment where the accelerated investment in digital transformation is turning every company into a technology company, driving an explosion in the surface area that customers must monitor and protect. This is being met by a shift in the attacker landscape over the past year, with escalating risk driven by a clear increase in both the scope and the impact of attacker activity. Against this backdrop, our strong 2021 performance to date is a clear indication that customers are recognizing how Rapid7's integrated Insight platform portfolio is designed to address the challenges of today's threat landscape. Let me take a moment to level set you on why we believe our strategy to build a unified SecOps platform experience in the cloud is well-positioned to address multiple aspects of this shifting threat landscape. Rapid7's vulnerability management solution remains a critical component of our customer security hygiene. Accelerating technology adoption is opening even more vectors of attack. Managing risk visibility is more important than ever for our customers. Many of today's threats continue to leverage known vulnerabilities, so having a best-in-class VM program remains foundational to protecting against pervasive threats such as ransomware. This is demonstrated by the durable growth we continue to deliver in VM, which saw an acceleration in ARR during the second quarter. A strong VM program is just a part of the equation. Remediating vulnerabilities takes time, an increasing trend with recent attacks is that people don't know about them until after the attack occurs. This is where customers increasingly need best-in-class detection response capabilities to alert them to suspicious activity. For the second year in a row, Rapid7's InsightIDR has been recognized as a leader in the Gartner Magic Quadrant for SIEM. We believe this is just one component of the IDR story. If we reflect back on the roots of IDR six years ago, we had a strong point of view that driving alerts off traditional logs like most SIEMs did then, and many continue to do today, was insufficient. This drove us to build a differentiated capability for SIEM. One that began with behavioral analytics and has since expanded to include logs, endpoint telemetry, network traffic visibility, attacker analytics, and cloud visibility, among other market-leading capabilities. The best validation of our winning formula with IDR, beyond its sustained high growth at scale, has been the emergence of the extended detection and response market, which espouses this view of comprehensive detection and response that spans across SIEM, EDR, SOAR, and now threat intelligence. Our recent addition of IntSights positions Rapid7 to lead the XDR movement, enabling our customers to drive comprehensive security transformation alongside their digital investments. As these digital transformation initiatives accelerate, businesses are increasingly leveraging the cloud to drive more innovation. As a result, cloud infrastructure usage is skyrocketing, and so too is the need for security teams to gain visibility and understand risk across these environments. Rapid7's newly released InsightCloudSec is leading the charge to provide customers a single cloud security solution that natively integrates Cloud Posture Management, cloud identity management, Infrastructure as Code, and Kubernetes workload protection. This fully integrated cloud-native security platform enables broad visibility across multiple cloud environments, enhancing cloud security programs by automating continuous security and compliance. We remain focused on innovating to help security and DevOps teams shift to the left, reducing noise and complexity, and protecting their container environments and automating workflows to drive better security outcomes as customers scale into the cloud. Each one of these mandates to provide foundational VM and visibility, to deliver comprehensive extended detection and response, and to enable continuous protection of complex cloud environments is top of mind for our team here at Rapid7. In fact, Rapid7 is one of the only vendors in the market today that can offer best-in-class products across each of these three critical security vectors. As the attack surface expands, Rapid7's platform is increasingly relevant because security teams are struggling to manage a myriad of independent security tools. Resource constraints and vendor sprawl are a critical concern in today's fast-moving threat environment, as customers are tasked with minimizing the visibility gaps that exist between their disparate products. Rapid7 is addressing this challenge by investing not just in building market-leading products in their respective categories, but natively integrating these solutions into our Insight platform and delivering them via a single unified experience in the cloud. This is why our strategy to build a unified SecOps platform in the cloud that reduces these gaps through an integrated, automation-driven experience is resonating with customers today. Customers are increasingly looking to consolidate down to a smaller number of critical security partners without sacrificing best-in-class security capabilities. As security teams look to minimize coverage gaps and respond faster to emerging threats, Rapid7's integrated platform experience is increasingly more relevant. You see this reflected in our business momentum to date in 2021. We continue to deliver strong ARR growth in our business, driven in part by our accelerating customer growth engine, which saw 13% year-over-year growth in customers during the second quarter. This is led by two fundamental drivers. First, we continue to add more new customers more efficiently, led by our ability to meet customers where they are in their SecOps journey by landing across any of our core platform pillars while demonstrating ease of expansion over time. Second, our aggressive investments in technology innovation are driving compelling customer value realization, enabling us to deliver ongoing strong and improving gross retention in our business as our platform scales. This is coupled with a compelling cross and upsell opportunity in our existing install base, which is a core driver of our sustained mid-teens growth in ARR per customer during the quarter. As our platform story increasingly resonates with customers, we have expanded the ability for more of our sales teams to sell more of our products, which should support durable growth in ARR per customer as we look ahead. A great example of this platform value realization was a competitive six-figure InsightONE deal during the quarter with a new international customer. As a brief reminder, InsightONE is an example of how we are looking to lower the barriers to platform adoption by making it easier for customers to purchase multiple Insight products. In this case, InsightVM, InsightIDR, InsightAppSec, and InsightConnect to deliver a unified SecOps experience. In this particular case, InsightONE's unified approach not only separated Rapid7 competitively versus other point products, but our platform value proposition accelerated the customer's future projects to leverage this broad set of Insight capabilities. Our single agent and one platform story resonated with the customer, who was looking for a leading security partner within their business. We're excited about the opportunity to continue partnering with customers like this to minimize their security coverage gaps as we further enable these platform-centric go-to-market motions during the second half of the year. Turning now to a brief update on the recent progress towards our enduring goals. First, we remain focused on leading the charge to enable customers to transform their security operations practices around the cloud. This is clearly demonstrated by our investments. In addition to accelerating our XDR vision and capabilities, the addition of Insight will deliver a differentiated SecOps experience in the cloud by elevating the capabilities across our Insight platform. We've already begun to see strong customer interest and momentum in this capability. Second, we continue to work on accelerating our platform distribution engine. The recent launch of InsightCloudSec, which brings together the cloud and workload security capabilities of DivvyCloud and Alcide into a seamless and integrated cloud security experience on our Insight platform, is a key milestone. This further accelerates our ability to drive sales leverage across our portfolio, particularly as we enable more of our sales team to sell the platform value proposition. We will continue to deliver on this, both from a product innovation standpoint as well as from a commercialization and go-to-customer perspective. Third, we are committed to driving long-term operating leverage in our business while investing for growth. A great validation point is that during the first half of 2021, we have delivered over 300 basis points of non-GAAP operating margin expansion over the first half of 2020, alongside improving free cash flow. This strong year-to-date operating profit performance, our solid growth execution, and our disciplined investment approach position us well to absorb the incremental expenses of the Insight acquisition while delivering on our prior operating profit expectations, notwithstanding the IntSights deferred revenue write-down. Jeff will share more details on this in his remarks. In summary, we're addressing the challenges of today's escalating threat landscape by delivering a unified SecOps experience in the cloud that helps to minimize visibility gaps, detect threats faster, and deliver automated responses. I could not be more proud of our team for their ongoing commitment to our customers as we work to deliver on our goals by making the best in security accessible and achievable to all. Finally, as I'm sure many of you saw from our press release, our CFO, Jeff Kalowski, has announced his intent to retire in 2022 once his successor is appointed. On behalf of the entire team, I want to thank Jeff for his outstanding leadership in helping us scale Rapid7 for the past five years. Jeff has been instrumental in our effort to transition and scale our recurring revenue business while also building a world-class culture and finance bench. He has served as a true partner to myself and the entire leadership team here at Rapid7, and I look forward to that continued partnership into the next year. With that, thank you, Jeff, and I will turn the call over to you. Thanks, Corey. Good afternoon, everyone. Before I begin, a brief reminder that except for revenue, all financial results we will discuss today are non-GAAP financial measures, unless otherwise stated, and reconciliations between our GAAP and non-GAAP results can be found in today's earnings press release. Turning to our results, Rapid7's strong momentum continued during the second quarter of 2021, driven by sustained high growth of over 40% in our security transformation solutions and acceleration in vulnerability management. Second quarter ending ARR of $488.9 million grew 29% over the prior year, reflecting strong overall demand for our Insight platform as customers look to transform their security operations around the cloud. As a result of this ongoing momentum, second quarter revenue of $126.4 million exceeded the high end of our guidance, accelerating to 28% year-over-year growth. Products revenue of $119.1 million exceeded our expectations and accelerated to 29% growth as our integrated platform opportunity is increasingly resonating with customers. We continue to execute well geographically, driving durable growth across our regions during the second quarter. North America revenue grew by 25% year-over-year and comprised 82% of total revenue in the quarter, while rest of world grew by 40%, representing 18% of total revenue. As I've shared with you on recent calls, we see a huge and growing market opportunity ahead, and so we are continuing to invest in our business as we execute against our durable growth goals, all while continuing to drive ongoing margin improvements as we scale. I will share more detail on this shortly, including how we intend to leverage our strong year-to-date growth and operating profit performance to fund the incremental expenses from our recent IntSights acquisition. During the second quarter, we demonstrated ongoing progress towards the fundamental financial goals we laid out at our Investor Day in March. In addition to strong ARR growth, our customer-centric innovation focus is paying off as we saw a second consecutive quarter of accelerating customer growth, led by our ability to meet customers where they are in their SecOps journey. As a result, we ended the quarter with over 300 customers globally, growth of 13% over the prior year. This sustained strength in our customer growth engine feeds ongoing long-term opportunity for our land to expand engine, which saw continued strong performance in the quarter with cross and upsell execution, driving 14% year-over-year growth in ARR per customer to end the period at approximately $52,500. These results demonstrate that our focus on delivering an integrated platform experience across our best-in-class detection and response, vulnerability risk management, and cloud security pillars is delivering a differentiated value proposition for customers. Turning now to some details on our operating results for the second quarter. Total gross margin for the quarter was 73%, consistent with the first quarter, and down modestly compared to the year-ago period, driven by faster than expected growth in our cloud-based products versus a year ago, as we continue to see strong demand for our Insight platform. Sales and marketing expenses grew 24% year-over-year, reflecting growth in headcount and improved to 40% of revenue compared to 41% in Q2 2020, as we see ongoing productivity improvements in the business. R&D expenses grew 31% over the prior year and represented approximately 20% of revenue, consistent with the prior year as we continue to invest in product and technology innovation. G&A expenses grew 14% and were 8% of revenue, down slightly from 9% in the prior-year period as we continue to scale our business. Our strong revenue overachievement in the quarter enabled us to continue investing in our business while still delivering record quarterly operating profit of $6.1 million, above the high end of our guidance range. Adjusted EBITDA for the second quarter was $10 million, and net income per share was $0.07, also ahead of guidance. Moving to our balance sheet and cash flows. We ended Q2 with cash equivalents, and investments of $613.2 million, compared to $616.9 million at the end of Q1 2021. This is before the net cash impact of approximately $308 million paid at closing for the IntSights acquisition in July. Our strong ARR growth and the associated strong billings in the quarter drove better than anticipated second quarter free cash flow of approximately $5 million. Shifting now to our updated guidance for the full year. Our strong year-to-date ARR growth reflects the success of our ongoing efforts to invest in driving durable growth in our business. These investments have positioned us to help customers meet the challenge of an ever-expanding attack surface with an integrated platform experience across our best-in-class extended detection and response, vulnerability risk management, and cloud security solutions. We believe the acquisition of IntSights only amplifies this value proposition and further expands the opportunity for Rapid7. The combination of these drivers and our team's strong execution to date fuel our confidence in once again raising our full-year ARR expectations for 2021. We now expect to deliver full-year ARR of approximately $576 million, or growth of 33% over the prior year. This accounts for both an improved organic outlook of now over 25% ARR growth for 2021, a strong improvement over our prior outlook of 22% growth, plus the addition of the IntSights acquisition. As a reminder, IntSights ended the second quarter with approximately $27 million of ARR. Given the strong momentum in our business, we're raising full-year revenue guidance once again to account for an improved organic outlook in addition to the contribution of IntSights, and now anticipate revenue to be in the range of $520 million-$524 million, or growth of 26%-27% after taking into account the IntSights purchase account and deferred revenue adjustment. Turning to operating profit. As Corey shared, we've delivered strong execution in the first half of 2021, with over 300 basis points of margin improvement compared to the first half of 2020. This puts us in a great position to continue reinvesting to drive durable growth, enabling us to leverage our revenue and operating profit over performance to absorb IntSights operating expenses. As a result, we're adjusting our full-year operating profit guidance strictly to account for the IntSights purchase accounting deferred revenue adjustment of approximately $5 million, and now anticipate full-year operating profit of approximately $7 million. I will reiterate that if we were able to recognize IntSights' full deferred revenue balance, we would anticipate delivering full-year operating profit in line with the low end of our prior operating income guidance of approximately $12 million, consistent with our growth and profitability framework. We believe these investments position us well to drive ongoing durable growth in our business as we look to accelerate our path to become a $1 billion business with the acquisition of IntSights. Factoring all this in, we now anticipate non-GAAP loss per share for the full year to be a loss of approximately $0.09 per share. This is based on an anticipated 55.3 million basic weighted average shares outstanding. Turning to cash flow, we remain focused on investing for growth while scaling free cash flow generation over time. I'm pleased to report that given our strong ARR performance to date, coupled with our updated guidance, and even after accounting for the IntSights acquisition, we are raising our full-year free cash flow expectations and now anticipate delivering free cash flow of approximately $20 million this year. This is a great validation of the long-term free cash flow potential of our business. Moving now to quarterly guidance. Note that our third quarter guidance also includes the impact of the IntSights acquisition. For the third quarter of 2021, we anticipate total revenue to be in the range of $133.4 million-$135 million, growth of 27%-28%. We anticipate non-GAAP operating income for the third quarter to be a loss of approximately a half million dollars as we invest in the business and absorb a partial quarter of IntSights expenses. We anticipate non-GAAP net loss per share to be a loss of approximately $0.07 per share, which is based on an anticipated 56.1 million basic weighted average shares outstanding. In summary, the first half of 2021 is a great validation of our ability to execute against our goal of driving durable growth while scaling profitability and free cash flow as we continue to invest to close the security achievement gap on behalf of our customers. Finally, I'd like to express my gratitude and appreciation to the entire Rapid7 team. It has been a privilege to work with Corey and the talented leadership team here for the past five years, and I'm extremely proud of everything we've accomplished. I look forward to ensuring a smooth transition when the time comes. In the meantime, I look forward to continuing to work with all of you until then. With that, we appreciate your time and support, and we'll now open the call for any questions. Operator? To ask a question, please press star then one. If your question has been answered and you'd like to remove yourself from the queue, press the pound key. Our first question comes from Rob Owens with Piper Sandler. Your line is open. Great, thank you guys for taking my question. Corey, wanted to touch a little bit on the acceleration in new logos. I know you've been adding additional capacity and leaning in has been part of the story, what are you seeing in terms of sales productivity as well with the preexisting sales force? If you can characterize where the environment is right now relative to these additions, that'd be great. Thanks. Thanks, Rob. It's a good question. There's really two big factors. One is what I talked about earlier. It's a demand environment. It's a healthy demand environment for cybersecurity, but especially for the security operations innovations that we're offering to the market. That's always helpful for sales productivity. The second one is we have a very disciplined model that as we introduce new products or we do acquisitions, as we actually prove out and hone the sales process, we start out with specialized, and then we add more of those offerings to our sales teams over time. That is a positive tailwind to sales productivity. The last thing, as you all noted, is that we're also investing in optimizing our product. In fact, we're very early in the journey there, but that's also been a positive tailwind to sales productivity. All those things are coming together, allowing us to actually grow our ARR and our raw sales productivity, and that's being reflected both in the new customer growth, but it's also being reflected in the ARR of our customers. Great. Then second question for Jeff, I guess. If I look at your Days Billings Outstanding, it was far less than we had expected and obviously helps cash flow. Does that reflect the linearity of the quarter, or was there something unique relative to collections this quarter versus historic? Thanks. Yeah, we had favorable linearity in the quarter, but I think we've seen dramatic improvement over the last couple of quarters and really due to our internal efforts in improving Days Billings Outstanding. I wouldn't say that it's really dramatically different on linearity other than we did see some improvement. I think it's more. All right. Thank you both. Yep. Our next question comes from Matt Hedberg with RBC Capital Markets. Your line is open. Oh, hey guys, thanks for taking my questions. Well done on the quarter, and also, Jeff, congratulations on your retirement. It sounds like you're not leaving anytime soon, but we've enjoyed the ride here with you, so best of luck at the next chapter of your career. Yeah. Appreciate that, Matt. Yeah, it's been fun. I think it was, you said five years, so it's been a fun journey. I'll still be here for a bit longer. We'll enjoy that. Corey, I wanted to follow up on Rob's question. At Analyst Day, you talked about 5%-10% was sort of the target level for new logo adds. Obviously, you added 13% growth this quarter. I just want to frame that with your Analyst Day. Is this sort of a new normal? Was there anything unique with the customer adds this quarter? I mean, is kind of 5%-10% kind of where you continue to expect, because those numbers seem a lot better than you talked about previously. Yes. I think there's a couple of important things. One is, keep in mind that the analyst discussion was a CAGR over four to five years. In fact, earlier this year we saw a little bit of performance above that. You can expect it sort of like a decay or it's an average over as the same time period. The other thing to keep in mind is that we're doing an intentional move and migration to more strategic customers, and we've talked about that before, and I think that's continuing apace. What I would actually say is we have very good confidence in the near term that we see trends in the double digits, and continue momentum there in the very near term. I would say, I don't think our long-term CAGR has changed material. Got it. Okay. That's helpful. Then, in your prepared remarks, you talked a little bit about InsightCloudSec, which is, I think, DivvyCloud now. I know it's still early for that, and it carries higher ACV dollar values than your base, but can you talk about the level of penetration in your base and how are you successful? What's the recipe when you're able to cross-sell that back into your existing customer base? Keep in mind, like all of our solutions, especially our big main pillars around detection and response, cloud security, and vulnerability management, they're all landable solutions. That said, we're seeing increasing growth and traction on the cross-sells. To give your specific question, the catalyst for cross-sell is digital transformation. It is when we talk to a customer that is looking to actually roll out a big digital transformation initiative, and they cross a critical threshold where they've changed enough of their IT infrastructure from a digital perspective. Security is a priority and they need to actually get the visibility to actually stay abreast, and the management to stay abreast, and the automation to stay current with that. That's the catalyst for those things. Our sales team is quite patient. We're seeing good growth and good momentum and good excitement there, but we like having that tied to digital transformation. It puts us in a position where it's not just a current growth driver, but that actually gives us a long-term growth dynamic. If you look at any industry reports, both cloud security, but especially the driver of a digital transformation, is expected to grow over the longer term horizon. Got it. Super helpful, guys. Thanks again. Our next question comes from Saket Kalia with Barclays. Your line is open. Okay, great. Hey, guys. Thanks for taking my questions here. Jeff, I'll echo Mike. Congrats on retirement. Very well deserved. Thanks, Saket. Corey, maybe just to start with you. That was an interesting example of InsightONE, that bundle example that you talked about during the prepared remarks. I was just wondering if you could just talk a little bit about how bundles are working, what some of the data points are on that that you'd be able to share? Without preannouncing anything, are there any other bundles that might make sense to explore? That's a good question. I won't go into the numbers on it. It's just too premature to actually drill the numbers, but I will talk about trends a little bit. One, we have a number of pilots out there. I've talked before about some of the SOC automation where you actually have IDR, network traffic analysis, the enhanced endpoint telemetry, and SOAR together, and that's quite positive. We have several other things that we actually are piloting that are out there. Most importantly, we're moving forward with think about it as sort of a 2-pronged strategy, is One, it is a strategy that allows us to do bundling. The thing about bundling is primarily deals at the time of sale, when people are really looking to upgrade their overall security program. Subsequently, I'm sure we're going to do upgrades to bundling programs. One focus of bundling is deals at the time of sale. The example that I gave here was a customer that said, "Hey, listen, I'm looking to do a significant upgrade to my security program." They wanted to actually look at the economics of the investment and the results across multiple categories. It made complete sense there. The only thing that I would say, just to be clear, is that I am not concerned, our team is not concerned with how customers buy. If they buy upfront because they actually are looking to actually do a big shot in the arm and improve their security quickly, that's great. If they do it slowly over time, that's great also. On the slowly over time, that gets to the third point that I'd actually emphasize, is that we also are investing in our packaging and pricing solutions to make it both predictable and economical for customers to actually plan for and build out and upgrade their security operations over time. Those are the three areas of strategy. I would say that they're having traction. We're getting validation, so therefore we're accelerating. I would not call them massively material to the success to date from the new packaging perspective, but I would say very, very positive momentum, such that our sales team is coming back to us that these things are working, it's resonating well with customers, and therefore, we're actually continuing to actually roll out the further phases of that. Got it. That's helpful. Jeff, maybe for my follow-up for you, can you just remind us how fast that newly acquired Insight business is growing? I think we said it was about $27 million in ARR. How fast is that growing? Maybe as part of that question, just zooming out a little bit, when you look at that ARR base at the end of this year, I think the guide is for about $576 million, how do you roughly think about the mix of VM versus that broader security transformation bucket? Does that make sense? First off, it is $27 million that we acquired as of the acquisition date. At Analyst Day, excuse me, we said that VM was a bit over 50% and security transformations was about 40%. Security transformation, we're saying, is going to grow over 40% this year. It will become a bigger piece of the pie by the end of the year. We're not going to pick a specific percentage, but VM, since it's growing slower, will become less of the total pie. I think we said at our call is that IntSights was growing over 40%, and that will be included in our security transformation products, which, even without IntSights, will still grow over 40% this year, is what we're projecting. Got it. Very helpful. Congrats again, Jeff. Thanks. Our next question comes from Brian Essex with Goldman Sachs. Your line is open. Hi. Good afternoon. Thank you for taking the question. Jeff, congrats from me as well. Well done. Thanks, Brian. Perhaps, Corey, what I maybe want to touch on is with the acquisitions that you've done over the past several years, and if we think about things in these three pillars, how is your sales force aligned with regard to maturity and where you're incentivizing them in terms of which ones of these buckets are more accretive to the bottom line versus others might have better unit economics? Are you just looking for a sales force that has the maturity across the platform to put all the arrows in that quiver, so to speak? It's a good question. I think there's two distinct parts of it. The first thing is, when we acquire or we build, how do we actually think about rolling it out in the sales force? Right What we do is we always start with a dedicated team to make sure we have mastery of selling, because what we really want to make sure is that we understand what the sales motion is and how to optimize the sales productivity. As we get the mastery of selling that, then we actually broaden the number of sales team that can sell that. That's not a one shot where you just sort of dump it to the sales force. That is a steady expansion out through the sales team. We're constantly expanding the selling capacity of our sellers and what they can actually sell, but we want to do it in a way that we actually really have mastery of the sales, which allows us to actually steadily drive up total sales productivity over time. That's actually worked out quite well. The second part that I think that you're referring to is how do we actually incentivize or focus the sales teams on which product offerings. While we actually track and manage that ourselves, we do not target the sales team, either from an existing customer versus a net new customer or from a product perspective to say, "You should sell this product to that." Now, we have occasional spiffs that happen where we may be doing something with a particular partner at some point in time, but by and large, we don't do it. The reason for that is we have two leverages. One is we actually sell, but because we are such an innovation engine, we're constantly updating the profitability from an engineering perspective of the things that we actually sell, too. Both of those are changing over time. We want our sales team to just be focused on going out and meeting customers where they are. You hear us say that term a lot, meeting the customer where they are, because we don't want them introducing friction that actually says that, "I want to steer you in this way." That creates a lot of customer credibility for our sales team, because they can take the customer's pain points and then actually focus on and deliver them a solution for that pain point. That's the strategy that we have. When we look at our customers, we are focused on how do we actually do things more and more profitable over time, which is why we've been able to do the margin expansion. Got it. That's super helpful. I appreciate it. Maybe Jeff, to follow up, could you maybe reconcile the adjustment to free cash flow guide for us? It seems like you're bumping it up by about $5 million, but you've already got a deferred revenue write-off and a cash from the IntSights acquisition, and the cost associated with that business. What are the puts and takes that gets you more confident bringing free cash flow guide up? Yeah. The biggest driver is the increased ARR performance, but I believe for the first half, about $23 million. We are projecting a net income loss for the second half, which is around $7.5 million, the implied loss. If you deduct that from the $23, really, the balance is really what we can realize in cash flow from the incremental ARR with the raise from the previous guidance. Got it. Super helpful. Thank you. Our next question comes from Michael Turits with KeyBanc. Your line is open. Hey, guys. This is Eric Heath on for Michael. Thanks for taking the Q, and Jeff, congratulations as well. Thank you. Corey, you've shown good progress increasing that ARR per customer metric as you do larger lands, but could you talk more about how you're progressing on educating customers in the sales force on the power of the combined unified platform to really drive expansion among those customers and increase attach rates? Yeah. I would say that we're taking it steadily, not in one big go. My take is that just prove it to customers, don't just sell it to them. What we're looking for as we expand and we think about our expansion engine is taking customer pain points and showing them why we actually extend their leverage of their existing investments. No matter where we start, if you say, "Hey, I have an IDR customer, and they have an incremental pain point on cloud or on VM or on applications," we're able to say, "Okay, listen, here's how your existing investment scales up." Frame it as a scale up. Again, it's not a big go buy more. It's more about you made an investment, and we can actually scale that investment more efficiently and more effectively than anyone else. Again, we're still in the early innings here because lots of our engineering work right now and lots of our product and packaging work is about making it much easier for customers to recognize incremental pain points and scale up much more naturally and plan for that scale much more naturally. Got it. That's helpful. I just wanted to touch upon VM. You mentioned it accelerated this quarter. Would you attribute that to some of the breaches we've seen this year? Obviously, it's top of mind right now, do you think this is a sustained elevated level demand that you could see VM continue to accelerate for the rest of the year? Our fundamental outlook on VM hasn't shifted. We've always thought it was actually a sustainable market and market expansion. I would say that we continue to see vulnerability management as sustainable. It did accelerate, and that's a positive thing, but we feel pretty confident that it's going to have the long-term market demand that we saw. One aspect of that acceleration is that we continue to overall, including the VM, see customers stay with us and have higher levels of commitment. We talked before about the lower churn and the higher retention of customers, and that's also a factor of the growth. Sorry. Did you hear me? Yep. Great. Thank you. Okay. Thank you. Our next question comes from Jonathan Ruykhaver with Baird. Your line is open. Yeah. Hi, good afternoon. I just have one question. Obviously, you've made a pretty marked shift from talking about IDR as a SIEM to talking about it as XDR just in the last several months. Corey, I know you touched on that evolution in your opening comments, but I'm wondering if you could just dig deeper into those capabilities that you believe are critical to this XDR category. Maybe touch on some of those that you have today, some that you might not have today and might need in the future for competitive positioning. Yeah. Well, when you think about extended detection and response, which is what XDR is, it's really about reducing the gaps that you actually have in your security operations environment. If you think about why so many companies and organizations invest in security but still are so able to be compromised and attacked, it's because there's just lots of blind spots in that environment. No matter where you start, the idea of XDR is actually minimizing those gaps in the overall security operations environment. For us, very specifically, it actually starts with gaps in data. It's the ability to actually see not just the log data, which is the traditional SIEM, but also to actually see the endpoint data, to be able to see the network data. Now to be able to see the external data in the environment. That's hugely valuable. It starts with data. The second thing is that when you actually have the data, you actually have to be able to process. If you think about the initial innovation that we did with user behavioral analytics, it was about a different way of actually processing data to look for attacks in the environment, understanding the user context. We added attacker behavior analytics, but again, it was another way to actually make sure we were minimizing the gaps in the overall environment. The last area that you really have to focus on is, all right, I have the information. How do I make sure that I don't have gaps in my workflow? Whether that's my investigation workflows, my forensics workflows, or my remediation workflows, and that's where the SOAR technology comes in with the automation. When we think about Extended Detection and Response, it's about minimizing the gaps. That's why you have the extended there in the data, in the analytics, but also in the workflows, and the automation around that. That's why I claim it as our vision of IDR has always been about minimizing those gaps. I just think that the XDR market is recognizing today the value of that strategy. We're being recognized along with that, which is a big part of the team's success. Corey, one last item that I think is important. I'd love to hear your thoughts. It's just the ability to leverage intelligence. How do you view that, and where is that in the product portfolio today? Intelligence. You said intelligence. Yes. I think about that as part of two things, the data context, which is what's happening in the external environment, but I also think about it is the analytic context. One of the things that you actually have as you do digital transformation, you just have not just an expanding attack surface, you have so much more data, which has the potential to create a lot more noise. What we're doing predominantly, we have a massive amount of engineers that just have to figure out how do you actually continuously up the game on pulling out the signal from the noise. The threat intelligence is another key tool and another key technology, another key strategy that allows us to actually pull out the signal from the noise. Those are the two places where it actually shows up. Okay. That's helpful. Thank you. Thank you. Our next question comes from Gregg Moskowitz with Mizuho. Your line is open. Okay. Thank you, Jeff. I know you're not going anywhere just yet, but you've done a terrific job and will most certainly be missed. I appreciate that. Thanks, Gregg. Of course. Corey, I guess I had a follow-up to that last question. In light of all of the increased customer awareness of XDR, do you believe that most customers today are looking at the XDR and SIEM areas as an or as an and, when it comes to their deployment of these technologies? Well, I think, one is the market taxonomy is sort of developing. Most customers are looking at how do they actually reduce the gaps in their operations. That's really clear. That stands out more than anything. Now, I think as part of that, what you have is companies that have actually had an XDR bias, which is like someone said earlier, is we haven't used the term XDR before, but we were clearly getting massive customer adoption there. Why? Because customers were focused on that. Really, you could think about XDR as a proxy for does it allow me to actually consolidate and improve my security operations with less gaps in my ability to manage my security operations? That, customers have definitely shifted to. Now, my belief, because of that, is that XDR-centric offerings and security, which means I'm able to consolidate, I'm able to actually minimize gaps in my ability to be able to manage my security infrastructure. I think people that do that are more likely to win in the future. yes, I think XDR-centric SIEMs are much more likely to take share in the overall security analytics of the SIEM market as you actually move forward. That's because they're actually providing a real business value proposition, which is taking things that are highly manual, have lots of gaps in the environment, and simplifying it for customers, even as it becomes more complex, as the scale and volume increase. All right. That's very helpful. Thanks, Corey. Then just for Jeff, are you able to say roughly how much revenue from IntSights you're expecting for Q3 and Q4? Obviously, ARR is the most important metric. Just trying to get a sense of how much of the revenue guide increase is organic versus acquired. Yes. Figure about high single digits, upper single digits for the half, for the second half. For the second half. Okay, perfect. Thank you, guys. Our next question comes from Brad Reback with Stifel. Your line is open. Great. Thanks very much. Corey, over the last few calls, you've called out retention gains broadly. Just wondering where you are in that process, if you think you've gotten most of that and it's incrementalism from here, or if there's still meaningful gains to be had. We have steady improvements in all of our different customer retention metrics. I would say as we execute on our strategy, I would say we have upside and opportunity as we actually go forward. I just think you see that most reflected in ARR per customer metric, which is, again, that and net customer adds are our primary metrics. We've made clear commitments and expectations that we expect our ARR per customer to go steadily up over time. You could expect that to have either stable or increasing retention as a fundamental underlying assumption. That's great. Thank you very much. Our next question comes from Alex Henderson with Needham. Your line is open. Thanks. I just wanted to follow up on that last question a little bit. The ARR per customer statistic is a great statistic, but I was wondering if you could update us relative to the ARR of new customers, whether they're coming in near the average and that's helping boost that ratio, or if they're coming in well below and still have a lot of room to move to the upside. Can you just give us that piece of the puzzle? Yeah, Alex, they come in below the average of $52.5. They start smaller and they grow with us. There hasn't been a big change in that new. It's going up a little bit with additional platform products and higher ASPs, but it's still less than the $52.5. Yeah. I would say that's especially true on a like-for-like basis when you compare company sizes. The one thing I would say that could draw it up over time is we've always had strength in the mid-market, but we continue to have strong strength in our enterprise expansion, and that's been a continuing trend for the last 4 or 5 years. I'd say you see strength across that segmentation. The environment clearly has changed quite significantly over the course of the last six, nine, maybe call it 12 months, as a result of an incredible number of attacks and the breadth of those attacks, as well as presidential edicts and things of that sort, that have really moved the perception of perimeter defense down multiple notches and the need for defense in depth up a lot of notches. How has that been impacting your business? Is that part of the acceleration in customer wins? Is that something that is accelerating or is it static in terms of impact? Can you give some sense of what the environment looks like as a result of all of these hacks? Yeah. It's tough to do specific attribution to different levels. What I would say is that, and you saw this, we actually gave commentary coming out of the second half of actually last year. It was very clear that the demand environment had actually been improving. I would say that the focus, the discussion, the seriousness, the fact that this is a topic at both the board levels and at the executive levels of companies is clearly making the demand environment more favorable. I think you see that most in some of our security transformation solutions categories, where if you look back two years ago, I would say security was not a must-have in the default digital transformation discussion. I would say today you're seeing security much more as a default in the digital transformation discussion. Now, I can't say whether that's the government, whether that's the press, whether that's the breaches, but I would say that the tie between digital transformation and the security transformation upgrade has gone up materially over the course of the last year. I think there's some correlation there. It's just tough to do direct attribution. I see. Thank you very much. Thank you. Our next question comes from Hamza Fodderwala with Morgan Stanley. Your line is open. Hey, guys. Thank you for taking my question, and, Jeff, congrats again on the retirement. Just 1 quick question from my end, just on gross margin. You mentioned that it's down slightly year-over-year. When could we expect that to start to normalize? What range should this normalize at, mid-70s? Is that something that we should expect over the next few quarters? I just want to remind you that because of deferred revenue haircut, we may have a little bit of headwind in the second half because we have the cost, but we can't recognize all the revenue. We would expect to still be in that mid-70% range. Is that near or longer term? For product margins. Got it. Overall, in that 73% range. No significant change. Okay. Thank you. There are no further questions. I'd like to turn the call back over to Corey Thomas for any closing remarks. Thank you all for joining us today on our call. I appreciate the fact that many of you shared the sentiments of how grateful we are for Jeff. You will still be hearing from him. That's right. Thank you, and we look forward to chatting with you over time. Thank you very much. This concludes the program. You may now disconnect. Everyone, have a great day.