Thanks, everybody, for showing up. So yeah, we've got Rapid7 next, CEO Corey Thomas. I've known Corey and the Rapid7 team for a long, long time, and Sunil Shah is around here somewhere. He'll be coming shortly, but thanks, Corey, for joining us. Matt, thanks for having me. Yeah, totally. You know, to begin with, you know, you guys, the reaction was to the quarter was positive. You guys have really started to transform the business, really for quite some time, but it feels like even more dramatically, you know, the last couple of quarters here. Can you talk about just the overall spending environment today? Obviously, cyber is always top of mind with folks, but just, you know, the health of the underlying market trends that you're seeing kind of as of the Q3 quarter. Yeah. So, it's interesting. So here's what I would say. The backlog of what CISOs want is as large as ever. Yeah. There's a lot of projects the CISOs have desirability to do, they wanna do. It's also true that CFOs are green-lighting at a slower pace. Yeah. You have this dynamic where there's a lot of things that CISOs wanna do, and you have CFOs green-lighting at a slower pace. Now, when you talk to CFOs, which I've started to do more recently, substantially, what they would point out is that cyber is the biggest area of expansion that they're investing in. Yeah. So even though it's at a slower pace than what the CISOs want, they would point that the projects are still getting green light, more than any other projects. I think all of those things are true. What that means, I think, is sort of like positive in the mid- to long-term, but it does create a little bit of noise in the here and now. What that means is, it's like people are gonna be spending on security for a good long while. Yeah. I think everyone, including boards and the C-suite, agree that security is a priority for expansion. I think that there's disagreement about what's the velocity and pace of that expansion. Sure. But that just means we're gonna have a healthy demand environment for a while, but also some noise- Yeah ... in there as people rationalize it. Yeah. Sunil, thanks for, thanks for showing up. Yeah. It's good to see you again. We just got started. Okay, so that's a helpful backdrop. How much of that then... So in other words, you know, despite that, you've been delivering, you know, I think your, your forecasting- Yeah ... has been really, really good, and you've delivered some upside to quarters, despite some of that volatility there. You know, what were some of the, Tim, or Sunil, you can probably, you know, talk about this. But, like, you know, when you think about sort of into Q4, and, you know, we're not gonna talk about beyond that as much. Mm. But, like, are the assumptions just like, you know, more of the same, kind of status quo into Q4 and- So I would say, look, we expect to have a constrained spending environment. We're not expecting a budget flush in Q4. We think projects will still move steadily. We think there's gonna be lots of scrutiny. We see no reason, we've seen no indicators that that'll change- Yeah in the short term. The strategy that's worked well for us is to actually anchor our offerings on the areas that are must-spend areas. Sure. You know, we've had this hierarchy that we started talking about a year ago. It's sort of really separating the spend categories into things that are nice to haves, should dos, and must dos. And what we've really anchored in on some must dos, and so you see lots of momentum in our detection and response business because it's a must do. You have to monitor your environment for attacks. We focus a lot on the attack surface monitoring with the Cloud Risk Complete. Those areas that we've actually aligned around are things that are higher in the priority stack for customers. And what that means is that those are projects that CISOs are easier to get budgets around. Yeah. That's been a strategy that's been successful for us. Lots of change and evolution for our sales teams, and our company over the last year, but the strategy is generating fruit. That's, that's helpful perspective. You guys started a restructuring effort. Was it Q1 or Q...? I don't remember when that was. Yeah. So the Q2, so the restruc- Q2? Yeah. Well, so the planning and the analysis really sort of goes heavy in Q2. The execution was in Q3. Q3. Yeah, Q3. So where are we in that? You know, 'cause ultimately, it gets down to, I think, you know, building a business that's right-sized on the expense side to- Absolutely ... to handle the growth. But then conversely, I wanna talk about, like, reinvesting in the business when the macros start to improve and some of those things- Exactly ... things improve. So where are we in that, kind of that cost evolution, cost rationalization to, to kind of build itself for the level of growth that you're seeing today? Yeah, look, I talked to the company about we had to be an efficient growth company. Yep. For lots of people, that's a new concept. For those that have been around a while, it's sort of like back to normal- Yep ... in some ways. So we actually were pretty aggressive in sort of... Look, I, I've gone through these things. I think it's taxing on the organization and the people, and the mentality if you actually do these things over many, many cycles. Sure. And so my take was, do it, do it once, and go deeper, create capacity to reinvest, create capacity for focus. And so we did a restructuring that affected 18% of our workforce. We said we were gonna reinvest up to half of that into high-growth areas. That was the focus. We went out, we targeted. So we've taken care of the cost side. We are now ramping back up the reinvestment, so we're reinvesting in the areas you would expect. We're accelerating investment in cloud. We're accelerating investment in the unifying the attack surface between the on-prem, the cloud, and the extended attack surface. We're focusing on accelerating our leadership position in the extended SOC with detection and response. Yep. We're also expanding our partner ecosystem. So those are the investment areas. Those investments will span out over the course of the next year. We also are being very diligent about our growth. So the way that I think about it, to get to your core question, is we've right-sized the cost structure in the near term. We still have margin expansion, by the way, left, but it'll be more, it won't be like the big chunk. Stepping stone. Exactly. It'll be more consistent improvements in the margin expansion. On the growth side, the strategy's very straightforward, is that we're focused on the long-term growth, which is really about sort of like our products and our services ecosystem. Customers need services from our partners, and some want from us. We have to deliver great products. We're investing aggressively to actually be more competitive in the products and technologies that win in the extended SOC. From a sales capacity, we are actually going to modestly our sales capacity, but we expect more productivity from our sales capacity in the near term, but we're not chasing growth in the near term. We're allocating lots of that investment into product differentiations, our distribution into with partner, and our services strategy. What that means is, as you think forward into next year, is that next year we're gonna actually deliver the free cash flow growth that everyone, I think, expects and we've actually talked about. We're gonna be investing heavily in sort of like the product and the services and the partner ecosystem and distribution, which is the key engine of long-term growth. We'll have very modest investments in expanding our our go-to-market. And as the economy comes back, we'll expand that go-to-market investment, but we'll do it from a place of further distinguishing ourselves from our competitors with the products, partnerships, and services ecosystem. That's helpful, Corey. From a product perspective, you guys have talked a lot about bundling and trying to drive more value in the customers, and I guess I'm wondering, you know, we hear that a lot with cyber vendors trying to do more with fewer- Yeah ... or consolidate. How do you see the customer conversation that you're having when, you know, maybe there's bigger vendors like a CrowdStrike or a Palo or somebody like that, also having consolidation questions or conversations in maybe some of these same customers? Like, how, how do you sort of differentiate what consolidation means maybe to a, you know, a Palo versus you, and, and how that can still resonate in, in a customer's mind? Yeah. So look, everyone has a center of mass. Everyone has a home. Yep. Our home is the extended SOC. So it is all about how do you actually monitor the attack surface, assess it for risk, monitor it for attacks, and how do you do that across? That is a whole bunch of micro markets. It's vulnerability management, it's cloud security, it is file integrity monitoring, it is GRC. Like, there's an alphabet soup of 10 different categories. And CrowdStrike, Palo Alto, those other folks are not focused in that extended SOC market. They have some plays in that market, but they're not consolidating that extended SOC market. The players that actually could do that well are sort of most of them, Splunk. You know, Splunk is Splunk. Yeah. They have what's happening there. IBM sort of, you know, is doing what they do. The ArcSight, lots of the early-stage companies are sort of like less competitive there. The one competitor that's actually sort of rising up is Microsoft. But if you think about that extended SOC market, we're executing quite well there. Our competitive position has improved. We're set up well, and it's not a lot of overlap with some of the traditional consolidators, and so I'll take that trade all day long. Microsoft's come into the market, I think, quite strong. I think they're doing quite well, but you've had more people decline it in the market than you actually have- Okay ... entrants coming in. So what I'm hearing is that this, that consolidation is a topic of conversation in customers, but these customers are consolidating lots of different areas of spend. Lots of areas. You guys happen to benefit in the SOC, extended SOC. Exactly. CrowdStrike might, you know, consolidate endpoints. Exactly. Uh- CrowdStrike, there's people doing identity consolidation. And so but, yes, I think that that's the thing. There's different categories and different areas. I wanna get into some product-specific questions- Yeah ... but I guess maybe just one more topic on the, or one more question on the topic of consolidation. We've had this discussion before, but longer term, fast-forward five, 10 years, do you see, you know, it's interesting, you didn't notice... I didn't hear you talk about Qualys, I didn't hear you talk about Tenable as like, you know, necessarily competitors in kind of the extended SOC. That's more of the VM side. Yep. But do you see, you know, this, let's just call it the VM market, which is I know not... I mean, it's a focus for you guys, but it's not sort of, I think, where you're kind of trying to drive long-term growth. Do you see that VM space consolidating over time and, you know, becoming part of a bigger, you know- Look- ... cross-sell bundling? What I would say is vulnerability management is a key capability, and feature for us and for our customers- Yeah ... is a part of the stack. Look, if you think about what we're doing from the extended SOC perspective, it's very straightforward. We give people mastery over their attack surface. We help them visualize and understand what's in the attack surface, assess the risk of that attack surface, and then monitor that attack surface for attacks. That is distinct and unique focus area from what CrowdStrike, Palo Alto, and other people do. They have some features that overlap in the area, but our goal is to actually give- be the best, most efficient, most cost-effective at giving customers mastery of that attack surface so they can actually manage their extended SOC well. Vulnerability management as the primary visibility tool on premise, I'll say that again, as a primary visibility tool on premise, is a key component of that. And so we're still investing in it. We have no fewer, engineers sort of like exiting this year, than we actually did coming in. Sure. Like, that's the focus- Yeah ... area, of our focus around that. So I would say vulnerability management is a key sort of like focus area. The concept of just selling standalone vulnerability management, I said it last year, it's just not a focus area. I wanna sell people the ability of how to actually get visibility into and manage the risk of that attack surface. And I wanna cover everything from the vulnerability management to the cloud security, to the external attack surface environment. I wanna give customers complete visibility in that environment, and I think that that is actually unique and focused, especially when you think about doing it for the mainstream enterprise- Sure ... at scale. So it's a nice segue into the success you've been seeing on risk and threat management offerings. I think it was, it was 40% of new ARR in on the Q3 quarter. Yep. Growing really nicely. Maybe for those that, well, think about, like, for folks that maybe aren't as familiar with kind of what when we talk about risk and threat management bundled offerings, what does that mean? Like, what's in, what are in some of these products, and why are they doing so well now? Yeah. So, I'll talk about where we are today in the evolution. Cloud Risk Complete is just how do you actually manage the risk of your attack surface? How do you actually know what your attack surface is? How do you collect data on it? How do you assess the risk from vulnerabilities, from misconfigurations? But how do you actually collect the data about your entire attack surface? On-premises, that's vulnerability management. That's what we do. On-premises is vulnerability management. In the cloud, it's cloud security posture management and cloud vulnerability assessment is how you actually think about that. There's also some stuff that we've been sort of, like, working on is the. It's also the application security, about how do you actually test your application vulnerabilities and securities? When we talk about Cloud Risk Complete, it is about how you actually assess and analyze your attack surface and the exploitability of your attack surface. Vulnerability management is key to that. Cloud security is becoming much more relevant to that, and that's why that's been a big focus area of ours. But that's what that solution is. The second one is Threat Complete, which is about how do you monitor that entire attack surface for attacks and indicators of compromise. You have to do that from the endpoint to the cloud. Again, it's distinct because, you know, your endpoint vendors are very focused on the endpoint. Yeah. But you actually have your traditional data center, you have your cloud environment, you have your SaaS services. You have to monitor that entire environment for attack, and that's one SOC team, and that's why we think about that as the extended SOC. And so that is our focus on the extended SOC, is how do we actually help people assess the risk and reduce the risk of the attack surface? And then how do we actually help people monitor that attack surface for attacks? So that's a helpful perspective. It feels like, you know, then from a go-to-market perspective, how are you equipping salespeople to have those conversations? 'Cause these are bigger strategic- They are ... conversations. Yeah. And it's, they don't happen, you know, in one quarter. They're multiple quarters. They're really complex, but it can be a very rewarding thing for you guys. How- It is. Look, and this is the thing, is that the first thing, and we weren't sure what the pace was, and frankly, the pace is well ahead of what we- Mm ... we expected is that the first thing that we actually helped our sales team understand is that, like, have the discussions that customers wanna have. And customers have lots of things that they actually wanna do, and so let's start with the most important things. And so, like, "Can you detect attacks against your environment?" So we anchor there, and then what we show customers is just, like, we offer the best economic solution for being able to actually detect attacks against that environment. Now, that solution really is, how do you actually do that across the entire attack surface, not just a traditional SIEM-based logs environment, but how do you actually look at it from the endpoint to the cloud, and beyond? And how do you actually make sure you have the service and support experience that you actually need around it for customers that are frequently overloaded? As we actually took that end-to-end solution and approach to the market, and we helped our employees understand that that's the customers that- that's the conversation that customers were willing to prioritize, it became a big focus area of our sales team. And then it reinforced the sales because they actually were able to actually get deals, get wins, achieve success at customers' own, and that success fed on it. So today, we're actually having a lot of success and momentum, as you actually indicated earlier, with that strategy of how do we actually help people manage that entire environment. What are some additional adjacencies then? 'Cause you noticed you talked about... The headcount reduction is also was coupled with reinvestment. Yeah. It's not just about cutting costs, but it's about strategically reinvesting. I assume cloud security is- Cloud is a big one. If you look at it, cloud has been. It has still been what I consider a niche market in that, like, it's a few very large companies that are big buyers of cloud security. And so cloud security is a big business, but it's still, if you look at the grand scope of, like, the people, the number of companies that actually buy- Mm-hmm ... vulnerability management or the number of companies that buy SIEM, it's still a relatively small number of customers. You know, the urgency that we actually have is we have a good lead. We started investing in this in 2019. We did a couple acquisitions in 2020. But we believe that cloud security is about to become more mainstream. And when I think about mainstream, for example, I think about, like, the Russell 3000, or all the private equity firms, and, like, how do you actually sort of, like, get it where, like, every customer has it in their hands? And that's the opportunity for us. 'Cause if you look at it, we have good success. But if you look at the Wiz, the Orca, there's a bunch of, I would just say, startup private companies that have done really well in the niche space, but their pricing is well out of what most mainstream buyers want, and also it actually gives them fragmented visibility in the environment. So good companies, but our goal is to actually offer customers end-to-end risk management, end-to-end visibility of their attack surface, and do that for mainstream buyers. And so that is a big area of focus, that's a big area of investment, and part of our restructure was to accelerate that, because we think that that's a big opportunity. Likewise, in the detection and response space, you've had a bunch of micro markets that we've steadily actually consolidated into over time. The network detection and response, which we actually added as a feature of our platform. We've added some parts of the endpoint market as sort of features of the platform. We're gonna be focused on cloud detection and response, as a core part of that, which lots of people aren't doing. Again, we have a heavy focus about how we continue to expand and simplify for customers. So and then, yeah, you know, you noted some sort of apidly growing private cloud security vendors. Mm-hmm. How do you think about, like... Are there additional adjacencies? Because I think what people hear cloud security, and I think a lot of people don't know what that means. Like, how, what- Mm ... Like, what are the core problems of cloud security that you're solving today, and are there additional adjacencies- Yeah ... that could make sense? Yeah, the big problems that we solve today is around how do you actually get visibility into your cloud security, and how do you actually manage the policies of your cloud security? So and that's traditionally called, the visibility is called cloud vulnerability assessment, and the policy management is called security posture management. There are a bunch of what I would just call micro, adjacencies for different environments- Mm-hmm ... that you'll actually see. You have protection with container security. You have cloud identity, access, and entitlement. You have some of the data protection stuff, like, Palo Alto just bought a company- Yep ... in that space. You have a long list of things that are addressable for some companies and not addressable for others. So you gotta really look at where we are on the curve. Again, our goal is to be a mainstream provider. One solution, visibility across the enterprise and across the attack surface for mainstream enterprises. We think that that is an underserved market right now, and we think we could do it at better cost, better efficacy. And again, this is how we actually have built great business before. This is how we went after the SIEM market. This is how we actually got our position in the vulnerability management market. And for lots of us, our strategy is to upsell and upgrade our vulnerability management install base. This wouldn't be a Fireside Chat without generative AI, and we've waited 20 minutes to get to this. That was impressive. Yeah, I was- Yeah. just kind of killing time Yep ... until we got to generative AI. What... You know, you guys have focused on AI forever. You guys have a data-driven platform. Yeah. Does generative AI mean something different to you guys internally? And how do you think about either productizing or monetizing generative AI features? Yeah, I mean, it does mean something different. So one, we have a good data set. We've been doing, I would just say, machine learning and automation for a very long time. And the one thing I would just say is that everyone tries to, it was like, when you actually had some of the prior waves of technology come out. Everyone wants to force-feed- Sure ... sort of like an approach. There's still lots of relevant use cases for machine learning. There's still lots of things we can actually do for automation, and we're still investing and very excited about that. The thing that actually generative AI is unlocking is a number of new use cases in our SOC. So, like, look, if you think about, like, detection, machine learning has actually been amazing. If you think about something like how do you actually manage the alert fatigue? Alert fatigue, for those who don't know, is just like, every technology generates a higher volume of alert than any of the humans that manage those environments have the process to actually sort of act. Well, generative AI is great for that because it takes the data, it can actually process it, it can actually do research. So doing, I would just say, think about, like, the junior analyst job that almost every security operations center has. Like, we actually have a team that's building essentially a junior analyst using generative AI to say, "Do all the investigative work that you actually need to do, that a junior analyst would do," which allows organizations to scale. Hmm. And so that's one of the use cases. That's not a machine learning use case. That's much more of a generative AI use case. It really feels like, especially in a SOC, they're just resource constrained to begin- There's resource constraints. So we are very excited and very optimistic about even some of the early stuff that we've actually seen, the ability to drive more scale and productivity out of that. We've got margins that we can talk about. We've got a couple other things. Yeah. I've got a question for you, Sunil. But before we get to that, I always say this, and I'm gonna give myself a little bit more time. Are there any questions out here from the audience for Corey or Sunil? If not, I can go, and you can queue me up later, but I'll pause here for a quick second. All right. No. Well, I guess- Let me know. Raise your hand. Raise your hand if you do. But all right, let's talk about... You know, I think the street recognized clearly the underlying profitability here. Yeah. When you talked, you talked about $60 million or $80 million of free cash flow going to $160 million of free cash flow. Yep. You know, talk to us about, you know, why that kind of that balanced approach to, to kind of durable growth is so intriguing to the board, to you guys, and, and does that mean that, you know, that's the long-term strategy? Is that just kind of what's in vogue now? Like, what, talk to us about the philosophy around margin expansion. Yeah, so and Sunil and I will talk to you. So first and foremost is that, you know, there was a recognition that in this economy that we're actually in, where, you know, the market growth rates have shifted down from where they were, you gotta say, like, what's the right cost structure for the environment that you're actually in? Yep. We could've went less. We could've went higher. What we actually picked is we said, "Listen," do two things when we actually did our restructure. We said, "First, take a deep, thoughtful look," which Sunil can actually talk about 'cause he's part of the team that led the effort there, about, like, what's the right sort of, like, cost structure for the business to be an efficient growth business? And we really want... Look, my belief is we should actually outgrow our competitors. We should be a growth business, but what's the long-term right cost structure for an efficient growth business- Mm-hmm ... that is growing healthily, you know, faster than what we're growing today, but is also efficient? And I think that we landed sort of, like, in that 20-ish% range, about, like, it's, it's the right starting spot. So we said, "Listen, let's not take, skip any steps. Let's actually go there." The second thing, though, is let's make sure that we're investing for growth. Now, this is where it actually got a little bit, I would say, more, where more the nuance. My belief is that growth comes from great solutions, great products, great services in a focused area. So when you think about the Extended SOC and that audience, about how do I actually understand what my attack surface is, how do I manage risk against it, and how I monitor it for attacks, that's my playground. I wanna be best in the world at that. and we said: All right, what does it take? Where are we today? We're well-positioned. I think we're doing better than most companies in that, in, in that space. It's a long-term space. It's a great market. We said, "Okay, we also need to actually make sure that we're setting ourselves up to be dominant in that space, to be great in that space." and so we went through and thoughtfully looked at, all right, what investments do we need to make, and what urgency and what pace do we need to make those investments? We did not have the capital to make all those investments that we wanted to make, so we actually went then and did a deeper cut to say that, like, "Listen, we have to find efficiency so we can actually self-fund- Mm-hmm ... those investments." And then the last piece of it was to say that, like, "Okay, let's also focus on long-term distribution and the sales engine." And so what you'll find is that for long-term durable growth, are we in the right market? Absolutely. People will have to manage. They'll have Extended SOCs. They'll have to manage their attack surface. They'll have to do that for long term.... We're leaning into investing, and we think in this cycle of noise that's actually happening in the broader market, we think that we're leaning heavily into R&D and our services ecosystem around that. And then we're actually focused on long-term, I would say, distribution and the cost of sales and marketing. So that's kind of how I think about it. It's not focused on chasing near-term growth in sales and marketing. It's differentiate now, build the growth engine, but build that steadily. Yeah, I think that's right. Because, I mean, as we think about growth or the multiple different vectors that we wanna think about, but certainly taking the opportunity, particularly in this period of time, this was a period of scale in the business where we were always focused on driving some focus on profitability and scaling profitability. I think the opportunity in the environment we're in drove the chance for us to look at how we accelerate that point of view on growing not just the top line, but scaling free cash flow and becoming one of the most durable free cash flow growers as we look forward, you know, to the future of the company as well. Mm. Okay, fast-forward a few years, what does Rapid7 look like? Is it, you know, seen as a destination, a consolidator? Is it part of a bigger entity? I mean, what are you trying to like build the company today to look like in the future? What does Rapid7 look like in the future? Yeah, look, I actually think that we're gonna be the leading company for how people manage their extended security operations center. If you think about... Look, I think everyone has to have a home base, and it actually has to be relevant first and foremost. There is definitely space for a relevant leader who actually focuses on security data that actually serves the security operations center. If you look in the broader market right now, you have a bunch of people that do a great job in their core markets, and they do a little bit of data, but there's not a data consolidator around security operations in the market. I think Microsoft's doing an attractive job there, but still somewhat focused on their ecosystem, although they're starting to expand that out. Our goal is when you think about the mainstream enterprise, when you think about, like, not just the Fortune 500, but when you think about the Russell 3000, when you think about that massive universe of private equity companies, when you think about managed services providers, we will have the most efficient technology in the world for actually monitoring environments end to end, prioritizing risk across those environments, automating remediation, and detecting and responding to attacks. That's the center, and we're gonna consolidate in there as well through innovation, through partnerships, but that's the focus that we actually have, and that's distinct from the endpoint market, it's distinct from the network market, it's distinct from the identity market. We have our core customer base, and also we have momentum. Like, that's part of the reason that we actually highlighted that we had over $300 million of business growing over 25% in the core detection and response model, 'cause that's the anchor solution in that market. We're continuing to actually have momentum there. So we're picking a market that we actually have momentum in, that has long-term strategic relevance, that has some overlap, but is still strategically differentiated. I think that's the market we're gonna lead in. Maybe just to wrap up here, what we've talked about a lot of growth drivers, both on the growth side, but also the profitability side as well- Yeah ... building sort of an enduring durable growth company. What's the single biggest thing that you're excited about when you say, "This is," like, if you could just, "This is the one thing that I would focus on if I were evaluating Rapid7," you know, what is there one thing that you'd sort of leave us with? Yeah, look, I think that from an investor standpoint, so I, I mean- Yeah ... Look, I get to spend time with lots of friends in technology. I do not have the problem of relevance. Like, we are solving a problem that is relevant and strategic, which I consider a blessing. So I get to focus just on execution, and the how and differentiation. So that's my- Yeah ... personal excitement and gratitude there. Look, from an investor standpoint, I actually think that in an uncertain environment, I actually think that Rapid7 is incredibly well-positioned. We are expanding our profitability, but we're actually setting up for long-term growth and growth upside. So you know that you're actually gonna have expanded profitability. Sunil's talked about our goal is to be one of the better free cash flow growers, which is gonna be a mix of growth and margin expansion. We still have room for margin expansion, but we're not actually short-term... We're not sacrificing the long term for the short. We're investing aggressively in our product differentiation in a market that's strategic and long term, and so what that means is you have long-term upside, but in the near term, you actually have a backstop because we are profitable. Yeah. Feels a little bit like a coiled spring- Yeah ... to some regards- Exactly ... on the reinvestment side, and- That's it ... doing it in a very thoughtful manner. That's the strategy. Cool. All right. Well, from all of us at RBC, thanks, guys. Thank you very much. Appreciate it, Corey. Thank you, Sunil. Thanks. Thanks for your time.