Hello, and welcome to the Rapid7 First Quarter 2025 earnings call. All lines have been placed on mute to prevent any background noise. After the speaker's remarks, there will be a question-and-answer session, and if you would like to ask a question during this time, please press star one on your telephone keypad. I would now like to turn the conference over to Elizabeth Chwalk, Head of Investor Relations at Rapid7. You may begin. Thank you, Operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's first quarter 2025 financial and operating results, in addition to our financial outlook for the second quarter and full fiscal year 2025. With me on the call today are Corey Thomas, our CEO, and Tim Adams, our CFO. We have distributed our earnings press release over the wire, and it is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast, and following the call, an audio replay will be available at investors.rapid7.com. During this call, we may make statements related to our business that are considered forward-looking under federal securities laws. These statements are made pursuant to the Safe Harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to the company's financial guidance for the second quarter and full year 2025, and the assumptions underlying such goals and guidance. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the future results expressed or implied in these statements due to a number of risks and uncertainties, including those contained in our most recent quarterly report on Form 10-Q filed today at May 12th, 2025, and in the subsequent reports that we file with the SEC. The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by applicable law. Our commentary today will primarily be in non-GAAP terms, and reconciliations between our historical GAAP and non-GAAP results can be found in today's earnings press release and on our website at investors.rapid7.com. At times, in our prepared comments or in responses to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results. Please be advised that this additional detail may be one-time in nature, and we may or may not update these metrics in the future. With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey? Hello, and thank you to everyone joining us this afternoon. Rapid7 ended the first quarter with revenue and operating income above our guided ranges, while our ARR fell short of our expectations, ending at $837 million, with 4% year-over-year growth. During the quarter, we saw continued strength in detection response, progress towards stabilizing our risk and exposure management business, and resilience and profitability and free cash flow. In a moment, I'll walk through the details of our performance, but first, I want to remind everyone of the expectations we shared on our last earnings call. We entered 2025 with a clear strategy and commitment to re-accelerate long-term growth and expand free cash flow over time. This strategy rests on three pillars. First, building on our scale and success in detection response, where we have strong customer demand and are well-positioned to sustain growth. Second, upgrading our large vulnerability management customer base to our exposure management platform, which will both increase retention and provide a valuable on-ramp to our DNR platform. Third, improving our underlying cost structure while continuing to innovate by leveraging our new operations center in India and streamlining our processes. In Q1, detection response continued as the core growth driver of our business from both an ARR and product expansion perspective. This business now represents over half of our total ARR and maintained mid-teens growth in the quarter. Our DNR performance would have been even better if not for a few seven-figure deals slipping into the second quarter, which have now since closed. However, our risk and exposure management business continued to see challenges, missing our expectations with continued growth deceleration. While Exposure Command continued to gain traction, this was offset by ongoing negative growth in our traditional Vulnerability Management offering. On a positive note, our investments to improve our cost structure remain on track, setting us up for profitability re-acceleration in 2026. Our performance took place in a more challenging macro environment than we anticipated entering the year. We observed customers becoming increasingly cautious and measured about their investments, both in terms of what they purchased and when. Extended deal cycles have become more common across multiple sectors, and many organizations are actively evaluating vendors, reprioritizing budgets, and implementing tighter spending controls. These dynamics are particularly evident in the North American mid-market enterprise segment, which has experienced slower deal cycles. This customer segment is demonstrating greater scrutiny and tighter budget control, trends that are reflected more broadly as customers reassess their priorities and spending commitments. As we've seen in previous periods of economic uncertainty, the pressure is more pronounced in our risk and exposure management products, while our detection and response offerings continue to show resilience. Now, let's examine our product-based performance in detail. Our detection response business continues to be our growth engine, anchored by strong momentum in our managed offering. We ended Q1 with over half of our ARR coming from detection response, growing in the mid-teens year-over-year. This growth is driven by persistent demand trends, particularly for MDR, which represents more than 75% of our DNR business, as customers seek enhanced visibility, broader coverage, and operational efficiency in managing an increasingly complex threat landscape. We believe the detection response market offers attractive and durable tailwinds, and we're still in the early innings of its development. We have spent years investing in laying the foundation to position ourselves to capitalize on this opportunity, and we continue to innovate and invest for growth. This includes our recently announced Intelligence Hub, which seamlessly integrates threat intelligence into our command platform experience and expanding our capabilities through our recently opened SOC and Innovation Center in India, which will scale over the coming quarters. These investments are helping us deliver services more efficiently while driving better customer outcomes. As organizations increasingly turn to Rapid7 to monitor and respond to threats across complex environments, our integrated platform and MDR expertise continues to stand out in a crowded marketplace. A great example is a first-quarter competitive win with a mid-size enterprise healthcare customer who consolidated their security stack with our Managed Threat Complete solution. They were seeking broader visibility, greater automation, and reduced operational complexity, challenges we were uniquely positioned to address. Our differentiation was clear across several dimensions. Our managed XDR capabilities enabled seamless third-party detection response through native integrations with their existing tools. Our AI-powered SIM and log management offered unlimited ingestion and long-term retention, providing unmatched visibility. Our customizable analytics and automated alert triage streamlined their operations, and we delivered true defense in depth by correlating alerts across multiple sources, not just endpoints, creating a more robust security posture. This win was driven by our technology and strengthened by our partner collaboration and ability to support the customer's goals with speed and clarity. It exemplifies how our consolidated platform continues to drive success in highly competitive environments. With our proven brand, our track record, and the right capabilities to win, we remain excited about the future of this business and expect to continue to drive growth for Rapid7. Now, let's turn to our risk and exposure management business, which is where we experienced the most pressure during the first quarter. As we've shared in recent quarters, we are amid a deliberate shift, transitioning from a traditional standalone VM business to a consolidated integrated approach to risk and exposure management. We believe customers increasingly need unified visibility across their attack surface, which streamlines remediation and smarter risk prioritization. This is what Exposure Command delivers, bringing together vulnerability management, cloud-native application protection, and threat context into a cohesive experience by consolidating risk insights across hybrid environments, automating response workflows, and focusing teams on what truly matters: real, exploitable threats, while helping security teams efficiently secure their expanding attack surface. Our strategy to improve risk and exposure management is centered on driving adoption of Exposure Command across our VM customer base, and we continue to believe this will stabilize performance and ultimately position the business back to growth. We laid the right foundation in 2024 with our Exposure Command launch, and today we're actively working to transition our VM install base to this more modern integrated solution. While we've not yet made the full progress we hoped, we're resolute in our strategy, and the key consideration is around timing. The most significant variable in our near-term performance will be the velocity of the upgrade cycle and risk and exposure management. This is where we're focusing our efforts: accelerating migrations, enabling partners, and removing friction points to shorten time to upgrade in what is clearly a more competitive and measured environment. On the go-to-market side, we have completed initial partner and field enablement and are now refining our packaging and pricing to support clearer customer paths and more streamlined upgrades. We also recognize the need to better communicate the strength of our CNAPP capabilities, which remain a core differentiator but are still underappreciated in the market. On the product side, we continue to invest in innovation, including several recent enhancements that expand coverage, improve automation, and reinforce our leadership in unified exposure management across hybrid environments. Now, turning to our outlook for the remainder of the year, we remain confident that our strategy can position Rapid7 for sustainable growth and expanding cash flow in the years ahead. Our detection response business continues to perform and remains the primary growth engine for 2025 as we work to modernize our risk and exposure management platform and return that business to growth. That said, it's clear the environment is more dynamic and fluid than when we initially provided guidance in February. We're seeing greater variability in customer decision cycles, something we experienced firsthand with certain March deals slipping into April, and we recognize that broader policy and budget implications may take additional time to play out. Additionally, we've taken the opportunity to leverage the expertise and input from our new board members to help evaluate and enhance our guidance approach. Given the evolving backdrop and our slower start to the year, we're adjusting our ARR guidance by lowering the overall range and also widening the range to account for increased budgetary uncertainty. Importantly, we are maintaining our expectations for operating profitability, which is a reflection of the operating discipline, flexibility, and resiliency that we built into our model. As we look ahead, our focus remains clear and grounded in three strategic priorities. First, we will continue to drive industry-leading product innovation across both our growing DNR franchise and our established risk and exposure management business. Second, we remain committed to delivering successful outcomes for our customers, helping them navigate increasingly complex threat environments while ensuring clear returns to their security investments. Third, we're focused on driving profitable growth and strong cash generation, including through operational efficiency and continued leverage in our expanding partner ecosystem. Before I turn the call over to our CFO, Tim Adams, to discuss financials, I want to take a moment to welcome our newest addition to our board of directors, Ryle Muhammad, Michael Burns, and Kevin Gallagher. Each brings expertise that will support our efforts as we navigate a rapidly evolving landscape. We look forward to leveraging their experience to drive growth, enhance our industry leadership, and create value for all our shareholders. With that, I'll turn the call over to Tim to walk through the results in more detail. Thank you, Corey. And good afternoon to everyone. We appreciate you taking the time to join us on today's call. Before I turn to the results, a quick reminder that except for revenue, all financial results we will discuss today are non-GAAP financial measures unless otherwise stated. Additionally, reconciliations between our GAAP and non-GAAP results can be found in our earnings press release. Rapid7 ended the first quarter of 2025 with $837 million in ARR, representing growth of 4% over the prior year. ARR results came in below our expectations and reflect continued healthy growth in our detection and response business, offset by both macroeconomic headwinds and continued pressure in our risk and exposure management business. Softness in our standalone vulnerability management business and a few delayed new deals were the primary headwinds, combined with an incrementally more cautious customer spending environment, which muted potential upside drivers in the first quarter. Amid this, we delivered revenue and profitability that exceeded our guided ranges, and we continued to demonstrate strong operational discipline and free cash flow generation. Now, turning to the rest of our financial results for the quarter, year-over-year ARR growth in the first quarter was split fairly evenly between new and existing customers. ARR per customer grew 2% year-over-year to approximately $72,000, and our total customer base grew 2% year-over-year to 11,685 customers globally. Revenue of $210 million for the first quarter grew 3% year-over-year and was above our guided range. Product revenue grew 4% year-over-year to $204 million. Professional services declined year-over-year, consistent with our decision to de-emphasize certain lower-margin service engagements. International revenue represented 25% of total revenue and grew 10% over the prior year. On operating and profitability measures, our product gross margin was 76% and total gross margin was 75%. Sales and marketing expenses were 34% of revenue, reflecting disciplined investments in growth initiatives. R&D and G&A expenses were 18% and 8% of revenue, respectively, and consistent with our plan to prioritize targeted investments behind our core security operations platform and scaling our India Innovation Center. Operating income for the first quarter was $32 million and above our guided range due to the timing of certain hiring and G&A expenses. We now expect these costs will be reflected in the later quarters. Adjusted EBITDA was $39 million in the quarter, and non-GAAP net income per share was $0.49. Turning to our balance sheet and cash flow statement, we ended the first quarter with cash, cash equivalents, and investments of $593 million. In early May, we fully repaid the remaining $46 million balance of our 2025 convertible notes, further simplifying our capital structure. Our existing convertible debt is attractively priced, and we plan to meet these obligations through a combination of cash on hand and free cash flow generated from the business. We believe this financial flexibility positions us well to continue investing in growth while maintaining a strong capital structure. Free cash flow for the quarter was $25 million. This brings us to our outlook for the remainder of the year. For the full year 2025, we are adjusting our ARR guidance to reflect the slower start to our year, along with increased uncertainty we're seeing in the market. While detection and response remains a consistent performer, the softness in our risk and exposure management business and lengthening sales cycles, particularly in March, have created more variability than we anticipated at the start of the year. As a result, we are lowering and widening our full year ARR range to $850 million-$880 million, growth of 1%-5% over the prior year, in order to better account for these dynamics. We continue to monitor the macro environment closely and are staying agile in our planning and execution. Given the changes in the ARR outlook, we now expect full year revenue of $853 million-$863 million, representing growth of 1%-2% over 2024. Recurring product revenue growth will outpace total revenue growth, offset partially by a year-over-year decline in professional services. On operating profitability, we are reiterating our full year operating income outlook of $125 million-$135 million. We are adjusting our full year free cash flow guidance to a range of $125 million-$135 million to reflect billings and collection dynamics associated with our lower ARR outlook. Non-GAAP net income per share is expected to be between $1.78 and $1.91, based on approximately 76.7 million diluted weighted average shares. For the second quarter, we expect revenue in the range of $211 million-$213 million, representing year-over-year growth of 1%-2%. We expect non-GAAP operating income between $30 million-$32 million and non-GAAP net income per share of $0.43-$0.46, based on approximately 75.3 million diluted weighted average shares outstanding. In closing, while the broader environment remains cautious, we are confident that the steps we are taking, driving innovation in our product portfolio, deepening customer relationships, and operating with financial discipline position us well to drive improved execution through the balance of 2025 and beyond. To close, I'd like to thank our teams for their hard work and continued focus as we execute against our long-term strategy. We remain committed to driving sustainable growth, expanding profitability over time, and reinforcing Rapid7's leadership in security operations. Thank you again for joining us today. Operator, we will now open the line for questions. Thank you. If you would like to ask a question, please press Star 1 on your telephone keypad. If you would like to withdraw your question, simply press Star 1 again. Please ensure that your phone is not on mute when called upon. We ask that you please limit yourself to one question and rejoin the queue if necessary. Thank you. Your first question comes from Saket Kalia with Barclays. Your line is open. Okay, great. Hey, guys. Thanks for taking my questions here. How are you? Good. Thanks, Sakit. Hey, guys. Maybe I'll stick to the rule just around one question and maybe make it for you, Corey. Can you just go one level deeper into why you think maybe the upgrade cycle on Exposure Command is just going a little bit longer than you expected? I mean, it's clearly a tough macro, but can you just maybe dig into some of the product considerations here as customers think about really consolidating multiple tools with that product? Yeah. If you look at the budgetary or if you look at sort of if you take a step back and say, like, why do customers want to upgrade to a product like Exposure Command? It's by and large, customers have a more complex risk environment. They have more cloud assets, more SaaS assets. They need to actually look at risk across the environment. They need to understand their environment. They need to model their attack surface, and they need to manage their remediation and their compliance across that complex environment. Complexity is the primary driver of demand. The reason that we actually have confidence in the cycle is we're seeing good interest in demand in solving the problem. What we are seeing, especially in our core mid-market install base, is not readily available budget. Part of how we think about the opportunity is where are we seeing budget that people can actually allocate and where are we not? As we entered the year, we actually looked at it across the board and thought that there will be a pace of upgrades across, which we still think that there will be a healthy pace of upgrades. We are seeing a difference between those that can actually afford the budget and those that cannot afford the budget. I'll remind you that we tend to have a heavily more heavy-weighted mid-market install base, especially in traditional VM. That is where we are expecting it to take a little bit longer on the time to actually get through that upgrade cycle because it is incremental expense. Got it. Very helpful. I'll hop back in queue. Thank you very much. The next question comes from Jonathan Ho with William Blair. Your line is open. Hi. Good afternoon. I guess one thing I wanted to understand a little bit better is when it comes to your expectations around the ARR side of things, I mean, clearly it's a bit more challenging here with the macro and with what's happened around exposure management. What has to happen to sort of re-accelerate the ARR? What could maybe be some upside scenarios here as we look at sort of the environment? Thank you. Yeah. Thanks for the question, Jonathan. Look, we see two drivers, which is why we have a pretty wide range right now. The first driver is the continuation of what we're seeing right now. We've seen strong demand for detection and response. We just expanded the offering to be able to actually go after more customizable, more enterprise use cases that just launched off. We are expecting execution there. Now, those deal cycles are longer, and we are not forecasting or making that completely into the plan. We are definitely bullish on what we are seeing. Even with the performance in Q1, I would just say some things that were headwinds where deals got delayed in DNR, and they showed up in the early part of Q2. We had some customers that had M&A. We still saw very, very healthy performance on DNR, and we just significantly expanded the market opportunity and the TAM there. That is an area where we actually have a lot of confidence overall. The second part is that the ability to upgrade our install base, we do not have to get to material parts of the install base to see upside. We are incrementally more cautious about the U.S. mid-market. We still see lots of strength internationally and around the world. When we look at sort of what it takes to see re-acceleration, it is really sort of like, can we actually start to get the upgrade engine going? Keep in mind, the upgrade engine is a new engine for us. This is the first time in a long time that we have had the ability to upgrade a material part of the install base. Again, that is why we have a wide range. To simplify, continued DNR momentum, pursuing the expanded DNR opportunity, which we just opened up from a product portfolio, and we are well positioned to actually get. Then we need to actually see the upgrade cycle perform on the risk side. All of those give us plenty of room to actually achieve the upside. Timing is one of those things that we did not want to actually overcommit on the timing because the upgrade cycle, especially, could take a little bit of time. Thank you. Thank you very much. The next question comes from Matt Hedberg with RBC. Your line is open. Great. Thanks for taking my question, guys. I wanted to follow up on Sakit's first question at the start. It seems like, Corey, you outlined a couple of steps for improving risk and exposure management that you talked about, enabling partners and accelerating migrations. I'm just kind of curious, what sort of timeline should we think about for stabilization, if not improvement, in that business? That's a great question. This is one of the things that we focus a lot on. I would say if you look at the guidance range that we actually have now, we're expecting moderate stabilization over the course of this year. I would just say re-acceleration as we actually move forward. When we look at the core drivers, you really do have to break it down and say what's happening by a segment basis. What we're finding right now is that customers that actually have flexibility in budget, we're seeing movement, and we're continuing to see upgrade cycles, not at the pace that we would want to see, just to be clear, to offset the larger macro pressure. We are seeing momentum, and we are seeing the upgrades, and we are seeing the proof points around those. The deal cycles tend to be a little bit larger, which is one of our indicators that we're seeing more pressure in our core mid-market install base. There are some things that we're doing around packaging and pricing to actually try to ease that upgrade cycle for that core mid-market customer. To answer your core question, we expect, I would say, stabilization as we moderate stabilization as we actually go through the year. We are expecting to be more pressured than we actually expected as we started the year overall in the risk and detection business, but we're constantly focused on what it takes to unlock that. The steps that you outline are sales and channel enablement, honing and tuning the pricing and packaging, driving campaigns against the install base, and segmenting the install base, really focus on those who actually have the budget and the ability to actually upgrade overall. Most importantly, continuing to improve the product value proposition. Those are the keys that we actually see that drive the midterm cycle there. In the interim, we're not jamming the timing on that. We're focused on, and we're focusing on our sales teams and marketing teams on what's working. We have a strong value proposition in detection and response. We're really focusing on that as we actually continue to drive the systematic upgrade of the install base. Thanks, Corey. Super helpful. Thank you. The next question comes from Aaron Samuels with Susquehanna. Your line is open. Hey, good afternoon. Thank you very much for taking the question. I wanted to ask a little bit more about the macro. You mentioned some pressure from U.S. mid-market customers. Do you have any callouts in terms of customers that have been relatively more resilient, whether by customer size, geography, or industry vertical? Thank you. Yeah. It's a good question. It's interesting is that I would just say customers where security is required and mandated are clearly easier to actually sort of withstand and get the budgets more. So that's why we find it more in both highly regulated industries as well as slight, I would just say not large, large, but I would just say the larger end of our install base. When you think about that over a billion dollars of revenue customer set. And so there tends to be more we have to solve it. We actually do see real benefits and tailwinds from the fact that those customers also have to scale their operations. We think that there is a real opportunity, especially with our expanded enterprise MDR offering, to actually be able to drive growth and acceleration there. That is where we actually see opportunities. We also see lots of actually opportunities in Europe, especially outside of the U.S., where we continue to actually have healthy growth and healthy demand drivers overall. The places that we are seeing pressure are, unfortunately, places that are, I would say, critical to Rapid7's focus on resource-constrained buyers historically, as we see pressure in the healthcare sector. We see pressure in the education sector where, again, they are still moving forward, but those deals are definitely taking longer, and there are lots of budget concerns as you go around. Same with state and local sectors. We talked about sort of like the general mid-market. We see areas of strength. We also see areas of pressure. The one thing I'll say is you look across those things, we are seeing, even though it may take a little bit longer, the DNR projects are closing. Now, people want to make sure they get great value for what they're getting, but those DNR deals are closing and moving forward. We saw those in the month of April that slipped from March. Exactly. Yep. It was very positive. Thank you for the question. Thank you. The next question comes from Fatimo Bulani with Citigroup. Your line is open. Hey, good afternoon, team. This is Mark Owens for Fatimo. Thanks for taking our questions. Maybe just on the challenging macroeconomic environment and also the new upgrade cycle motion that you guys are seeing, can you maybe speak to the level of growth, churn, and attrition during the quarter? Any sense of observed disruptions from the upgrade cycle? Related to that, any color you could provide on NRR would be great. Thank you. Yeah. No, it's a good question. When you look at the churn that we actually saw, it's pretty consistent with what we actually saw exiting last year. If you think about the pressure from a net ARR perspective, the churn was consistent, especially in the risk business, with what we saw exiting last year. It was a pressured environment. We did not expect any major changes overall. I will say that we were pressured more on the new side of the equation in that core mid-market space. As you think about sort of like the traditional vulnerability management, while it's not a big factor, it's still sort of a factor when you think about total net ARR growth. Churn was relatively consistent to what we expected as we actually exited last year. The upgrade cycle hasn't been a major factor in the churn overall. If that's the core question, is this putting more deals up for risk? No, we're not seeing that at all. The next question comes from Patrick Colville with Scotiabank. Your line is open. Thank you so much for taking my question. I guess, Corey, I mean, this one's for you. I mean, in the quarter, we had RSA conference recently, and a large, I guess, platform cybersecurity company best known for its endpoint tool put into GA its network-based VM. I guess clearly too early to tell what that might mean. Can you just give us some thoughts on what this entrant could mean for Rapid7 and how you guys are going to compete against them to kind of lock them out? Thank you. Yeah. When we look at VM, we consider VM to be a hyper-competitive pressure, but also not a high growth space. We do have to actually defend and upgrade. Our strategy is pretty straightforward. We uniquely have a very differentiated approach to actually provide integrated risk visibility across the attack surface, which is what people are looking for now. I've said it before. If you're looking at monetizing just traditional standalone VM, it's going to be an unattractive business. Part of what we're doing as part of the upgrade cycle is we're drawing down the value of historical traditional standalone VM and providing more value from the ability to actually track all the assets, resources, technology across the attack surface, look at the integrated risk profile across the attack surface, manage remediation across the attack surface, and manage compliance across the attack surface. I looked at all the announcements at RSA. None of them are actually taking that truly integrated approach overall there. We think that our upgrade strategy, this is why we said that it is an imperative to upgrade our install base because we are upgrading in a way that actually makes us stickier. That is a no. We have to execute on it, but that's a no-no. The other part of it is there is a lot of focus on, I would just say, it is defense, and we are definitely declining on the overall traditional vulnerability management market, and that is the imperative to upgrade. The other part of that is to actually continue to play offense about what is working. The DNR growth engine also provides a stickier avenue and approach for those VM customers as they consolidate on the platform. If you think about our strategy of defense, it is too broad. If we have a bunch of, I would just say, stranded vulnerability management customers that do not have any sort of other compelling value, then that is at a higher risk for disruption. We acknowledge it. That is the imperative there. Either upgrade to Exposure Command or upgrade them to our de-integrated detection and response offering, those customers are much, much more stickier. We have already seen that with our overall DNR customer base. That is the strategy, and that is the approach. I would just say, regardless of what anyone does, standing still was never an option. We have known that. We could have managed to change better, but we have known that standing still was never an option. We are in the good place that we have massive momentum, and we are participating in a core growth market, and we are getting more than our share of that core growth market, which is DNR, as we actually then address the changes that are happening in the vulnerability management market overall, which we forecast and saw that coming. Very good. Thank you so much, Corey. The next question comes from Eric Heath of KeyBank Capital Markets. Your line is open. Hey, Corey. Hey, Tim. Thanks for taking the question. Corey, just curious to understand, maybe at a high level, how much of the success on DNR is dependent on the install basis of VM? Just can DNR continue to grow double digits if VM continues to decline? And Tim, if I could sneak one in, I think in the past you've given some guardrails on ARR for the upcoming quarter. Just curious if there's any guardrails on 2Q ARR. Thanks. To answer your core question, we've been pretty lucky with the DNR business is that the growth has actually come from both within our install base. I'll just point out that we saw a massive upgrade opportunity within our overall install base, both on the Exposure Command upsell basis, but also on the existing DNR and technology customers in the install base. We still have plenty of upgrade room. That's one of our under-leveraged opportunities that we're really focusing our sales engine on, building the motion about how do we actually expand and grow on the install base. To answer your questions, one, are we running out of room because of the VM dynamics? No, we have massive room in the VM install base. I think the second part of your question is, when I think about it, it's do you actually have a land motion independent of the install base? Yes. The unique thing about our DNR business, and this is what makes us very proud, is that we've always been able to actually add new land customers. I'm not saying that's like 10% or 20%. It's been pretty close to half of the install base has actually come from new land customers, which is much higher than we expected. We still have more than enough land engine to actually drive sustained growth as we go forward in that business overall. Even as we have opportunities to upgrade existing DNR businesses, our focus and what some of the stuff that we're launching later this year around AI for our DNR customers, we think will actually be a boon for both our technology customers, but also for our MDR customers who continue to want us to cover and manage more and more of the environment. You're seeing some of the early indicators of that with our recently launched enterprise MDR customizable service and business, where we're using more and more AI for that. That's a great upgrade opportunity. Dietrich, your last point is, Tim, you can do a quick one on the thing because we're supposed to keep everyone on one question. Yeah. Eric, on Q2, I would say we're anticipating a modest increase from where we ended Q1. Our full year guide for the year is more second half weighted this year. Thank you. The next question comes from Greg Muskowitz with Mizuho. Your line is open. Okay. Thank you for taking the question. Corey, anecdotally speaking, why is it that the U.S. mid-market does seem particularly cautious about spending right now? For example, are customers deliberating for a longer period of time as they decide how significantly they may consolidate in cybersecurity and with which vendors? Were tariffs mentioned at all as an issue in late March or in April? Any additional color here would be helpful. Yeah. Look, I actually think it's general uncertainty. What we found in almost every cycle, we've had the—we're probably one of the few cyber companies and enterprise companies that had a mid-market business for longer. So we've seen a lot of these cycles. The mid-market tends to respond faster to economic pressures. It tends to shut off faster, come on faster. That is not anything new, which is why, as we saw things play out in the early part of the year, we actually did shift our position to take a more— and we talked to them and validated it would take a more cautionary approach. Now, to get down to the reasons is that they vary very differently across the industry. Manufacturers are, of course, worried about tariffs, their cost structures, pricing, how much they can accrue from their businesses. The mid-size healthcare companies are clearly worried about margins, whether you are a health provider or health insurer. That is a concern that you are actually going to have regardless. Retailers are very worried about their cost structure. Again, I will not say it is a formal survey, but we do do our pressure checks across a bunch of different segments. It does vary about what the pressure is. What I'll tell you is that we saw in the COVID cycle, we've seen in previous cycles, is retail customers tend to pause and wait to see what's happening much faster than some of the larger customers, some of the larger enterprises. One thing that's unique is we are seeing more pressure in the education sector this go around for obvious reasons. Exactly. Thank you. Thank you. The next question comes from Gray Powell with BTIG. Your line is open. Okay. Great. Thank you very much. Yeah, another question on the macro environment. I mean, everything you said makes a lot of sense, and I just really appreciate your being upfront with everybody. I am curious, can you give us a sense as to the tone of customer conversations in April and May? Just broadly speaking, my understanding was that people were pretty panicked the week after Liberation Day. I actually heard some people say it felt like March of 2020. Once the tariff pause went into place on April 9th, I was hearing that things started to fall out. I am just curious if you heard anything like that. Did any conversations start to improve the last few weeks? Yeah, absolutely. I mean, Tim said earlier, we have closed some of the deals that we were worried about. You can make an argument that things are stabilizing. I think anyone who would actually estimate that things stay stable in this environment is probably a little delusional because I think we are probably in an up and down cycle on the news cycle. I would just say there's just as much reason to actually see stabilization and upside as there is to see downside pressure. I just want to be clear as we're not, I would just say, overly pessimistic about the macro. We just realize that now there's a wider range of outcomes there. We have seen some customer deals progress and move. We see continued opportunity creation. It's not a negative read. I would just say, on balance, we see increased pressure. As you said earlier, as people do respond to actually what's in front of them, it feels like it's not the worst of the worst right now would be my read of it. I don't think we're yet what I would consider a stable macro environment. I think there's a lot of unknowns, and we're trying to reflect that. That's why you see we actually have a wider range here because we have the upside, and we have the base case, and we have the downside scenario, but that required a wider range. Understood. Thank you very much. Thank you. Thank you. The next question comes from Roger Boyd with UBS Securities. Your line is open. Awesome. Thanks for taking the questions. Corey, you mentioned confidence in the CNAPP product, and I understand there's a big opportunity there, but I think we've all kind of seen that it's incredibly expensive to compete there. There's been others in that space that have been there for a long time that are now looking to partner. Just how are you thinking about the health of the cloud security market, and how do you think about kind of the investment strategy to capitalize on the opportunity there? Thanks. Yeah, no, it's a great question. I would just say we've been very deliberate about how we think about it. Our primary focus is just upgrading the install base to an integrated offering. We have lots of, I would just say, leverage to actually pull there. This is not one where we're going to go out and spend a ton of money trying to acquire new land in cloud security. We think we can provide compelling economically leveraged upgrades for our customers and our install base. We think that our install base is underpenetrated of having any cloud security solutions there. That tends to just describe a little bit of that resource-constrained buyer that we have heavily in our install base. We see that as the primary opportunity, which is a much more efficient cost of sales and marketing. That's it. We are maturing in our ability to actually pursue that opportunity because this is probably the first time in a long time that we've had a big upgrade cycle in front of us. We are getting the engine ramped and targeted. I was talking to one of our sales leaders earlier today, and they said, "Listen, we're starting to actually progress and ramp it up the sales engineer." We are targeting a much more efficient growth opportunity there, which is really how do we grow the install base. I'll remind you is that to achieve success, we actually just need a moderate uplift across a moderate portion of our install base. That actually drives stability, which takes away negative growth engine and our overall risk and exposure management install base, puts it to net neutral to slightly positive. We can actually really leverage the tailwinds that we see on the traditional DNR side of the equation. That is the dual focus. In some ways, we have a talented city. Stabilizing and getting to neutral to positive on the risk and exposure, which is really about upgrading the install base, even acknowledging some of the traditional churn pressure, while we actually continue to actually really focus on the massive growth engine that is that DNR business. Great. Thanks very much. Thank you. The next question comes from Joshua Tilton with Wolfe Research. Your line is open. Hey, guys. Can you hear me? Yes, we can. Hey, Josh. Great. Thanks for sneaking me in. I want to start by echoing Gray's comments. I appreciate you guys being upfront on what you're seeing out there. The one I had is just kind of parsing out some of the comments that have come out during the Q&A. I guess in the prepared remarks, you talked to DNR still being mid-teens growth, but some deals listed would have been better, but those deals have closed. I guess, was that a macro dynamic? Did you see a similar dynamic on the risk and exposure side of the business in the sense that you had a light quarter, but what has happened to those deals since? What's expected in the guide for everything that slips going forward? Thanks. Yeah. No, it's a very fair question. On the DNR deals that actually slipped, what I would describe is it was just very large deals, so it's easy to count. It's a handful of, not even a handful. It's a couple of deals that just happened to be very material in orientation. The reason that they slipped were probably, I would just say, macro pressure situation. One was a large educational institution, which really needed to see how things were going to actually play out. Another was in the retail sector. Those are sectors. We had a smattering of, I would just say, manufacturing companies too that I think most of those have actually since closed, not all. When you look at the risk exposure management side, keep in mind our strategy on the upgrade, it's just much smaller ASPs. It's not that you didn't have deal slippages on that side. It's just that it's not as concentrated. The DNR business tends to actually have larger average ASPs and then wider ranges overall. That's the read-through is that. On your question about what's in the guide and the expectation, look, our core guide is really anchored on, I would just say, consistent DNR performance, which is, I would just say, in line with what we saw in Q1. There are no real deltas that we're experiencing there overall. I would say the range of outcomes on the higher and the low is that do we actually get some acceleration in DNR based on the expanding offerings that we think are pretty competitive? That's upside there. Without the history, it does not make sense to make it into the range. We are more modest on balance on the pace of the upgrades, which can offset some of the VM pressure. We're working very, very hard to actually drive the upgrade cycle and operationalize that. I would just say incrementally versus the start of the year, we are expecting that cycle to actually take a little bit longer, and we're expecting to see continued pressure in the overall traditional vulnerability management business for all the reasons that we actually talked about earlier. Do we have upside there based on the upgrade cycle? Absolutely there. But we're at where we are based on what we've seen so far. Super helpful. Thank you. Thank you. The next question comes from Shrenik Kotari with Robert Baird. Your line is open. Great. Thanks for taking my question. Cory, you mentioned, of course, structural pressures in traditional VM and slower mid-market. Despite all of that, you've been able to drive MDR growth, which is anchored in, of course, lower TCO via AI automation, but also differentiating beyond cost. On the risk and exposure management, I hear you mentioned about, of course, packaging, pricing, partner enablement. In terms of messaging, right, you did touch upon that. How are you framing this broader risk and exposure management to differentiate your approach, Rapid7's approach, from other VM players? Had a quick follow-up after things. I think the question is, how are we differentiating versus traditional VM players? One, I would just say, listen, we have to recognize that the VM market has a lot of approaches, players, avenues. I would just say it overlaps with the cloud market in some ways. We've taken a very, very specific approach of focusing on integrated risk management. The way to think about that is that what's unique about us is we're one of the few players, and the only player I'm aware of that fully out of the box integrates all the assets, all the information, all the context in your environment. We actually consolidate risk across the environment, not just from our tools and technologies, but across the environment. We have open APIs. By the way, people can collect our data too. We believe in open APIs to support that, and that's good for the technology industry in general. We consolidate the remediation across the environment. We have some enhancements later that are going to accelerate our ability to process and help customers drive compliance, leveraging AI across the environment. We actually build automated workflows. In general, the way to think about what we're doing is when you think about the CTEM structure that Gartner recommends across, our big focus is about being the integration engine behind that and enabling the automation of the response and management of those processes. We see ourselves as highly differentiated. There are areas that we're catching up, like some of the long tail of the cloud capabilities that some of the cloud pure plays have actually done, as we're playing catch up in some of those areas. When we look in our core install base, while they may be more budget constrained, they may be more resource constrained, lots of them are trying to figure out how to actually get efficacy at scale. We think we have a great story and a great solution for that install base. The next question comes from Aiden Perry with Piper Sandler. Your line is open. Good afternoon. This is Aiden for Rob Owens. Thank you for taking my question. You mentioned earlier that complexity is a driver of demand. With the launch of MDR for enterprise, do you think these new capabilities will allow you to go after specific verticals with complex environments more effectively, or is this offering intended to address large customers more broadly? Thank you. It's intended to address large customers more broadly. There are also some large verticals that we see. We've gotten lots of demand from the manufacturing vertical, for example, which really has a massive amount to manage, and they're looking for scale help. Healthcare, we actually see on the larger end, real dynamics there. Think about our sweet spot here as very, very large customers that have to scale. Security is mandatory. They're looking for a partner. They have some security resources, but they're looking to scale. The unique thing that we do is we help them understand what their attack surface is. We actually help them monitor 100% of the attack surface at efficacy. They know that they have to monitor not just the endpoints. They know they have to monitor the identities, all the cloud resources, which are incredibly noisy across that environment. They know that they actually have to process all the security telemetry together. They have to reconcile the data. We're leveraging both AI and our talent to actually do that. We're adding real scale to those organizations, and we're assisting them in a way that works for them. This took a lot of effort and investment to actually be able to do that in a way that had healthy gross margins but could operate in a way that customers want. We are incredibly excited about the launch. That is one of the upside drivers for the year. We had a nice warm reception from our initial pilot customers and some of the customers at RSA. That is a growth driver. I would just say think about very, very large resource-constrained buyers. We offer the best economic solution to actually get efficacy at scale. The next question comes from Joe Gallo with Jefferies. Your line is open. Hey, guys. Thanks for the question. Last quarter, you announced heavy investments for DNR, which seems justified. Maybe can you just talk a little bit about your overall profit versus growth framework? Are some of these investments fluid if growth doesn't accelerate? And then maybe how should we think about sales capacity as well? No, there's a lot of questions built in there. Let me just sort of hit a couple of ones. One, look, like any company, we need to invest behind growth opportunities. In detection and response, we have a massive market. We have a healthy position, and we can actually create an even stronger position and, frankly, expand our addressable market there. That's a clear, I would just say, profitable growth opportunity. In almost any definition, you actually invest for profitable growth in the growth opportunity. When you think about the allocation of resources across, again, we're not trying to be all things to all people. We're focused, when we think about outside of that, on things that reinforce our overall stack. We're going to be the best at actually integrating telemetry across the environment. That's both the entity data, the risk data, and the monitoring data. Our integration engine is a core investment prioritization that we're focused on across the environment. We're going to make sure that we actually have the right capabilities to serve our core mainstream customer when it comes to the risk and the exposure at the best economics. We have a rational allocation view. It takes focus. It takes discipline around it. We are invested in the areas that actually have the best growth profile. You'll continue to see us sort of both innovate, partner to actually drive success in the overall market. Yeah. Hey, Joe, it's Tim. I would just underscore something Corey brought up earlier. Selling into the installed base, as you know, we're just under 12,000 customers. That really creates a large market opportunity for us with customers that we have a good relationship with on the expansion motion. That does come at a lower cost of sale for us. That's one area where we can see leverage in the future. Yeah. Our go to market motions are pretty straightforward. If you look at what we're doing, we are driving the integrated land motion, about looking at how customers look at integrated security operations. We're upgrading our install base of VM to Exposure Command. We're driving adoption as our big thrust in detection and response. Thank you. The next question comes from Adam Borg with Stifel. Your line is open. Awesome. Thanks for fitting me in. Maybe just building off of Joe's question. When we think about the new SOC in India, maybe Corey or Tim, you could talk a little bit more about how that's supposed to help, not just from an innovation perspective, but also from an efficiency perspective as well. Thanks. Yeah. There's a couple of elements. One, if you think about our operations in India, India is another global development center, just like we have a couple of them in the U.S. We have one in the U.K. We just opened up a development center specifically in Prague. Now we'll have a global operations center in India that'll have some development, some security operations. I would just say, just to be clear, the number one driver of the center that we're doing for the SOC, when you think about the SOC in India, is that we've had significant growth in EMEA and APAC in our core detection and response business. Having people that are in regions that have overall hours of lapse that can actually do multiple times on coverage is a response to customer demand. That's the number one driver. It happens that that also has some economic benefits. I just want to recognize that the customer benefits are massive and significant because that's where the growth is. Again, our thesis is very clear. Just invest behind the growth. We see great growth internationally in those regions and we're invested behind it. That said, when you think about how do we actually scale DNR, and we have big MDR demand, we're customizing more of it. You have to engineer that in. You have to have a product-based approach. Also, it's a combination of technology and sort of the cost of the talent there. I want to be clear. There's definitely cost, talent, arbitrage stuff in there. If you say, "What's the majority of the cost efficacy that's going to allow us to continue to scale this business as it actually serves more and more customer use cases?" it's definitely the investments that we're making in our adoption of AI technology, which was a big part of the investment thesis that Tim laid out earlier. Again, I met with our teams over the last couple of weeks. That is on track and frankly accelerating the investments that we're actually having. Our belief is that our technology and the AI investments that we've actually already made and that are in the SOC, and frankly, we're going to make available to our broader customer base a little bit later this year, are already yielding massive dividends that are allowing us to actually run at better operating margins from a traditional MDR player. If you say where most of the gains is going to come from, it's going to come from the technology innovation side of the equation. Yes, there'll be lower cost talent that's going to actually play a factor there. We are seeing real gains from sort of our ability to leverage both AI and automation to drive the efficacy of the SOC. That will be the dominant driver of how we continue to actually have better margins than most traditional MDR players. Corey, and we're already seeing that in the numbers on international. It's 25% of revenue, and it's growing faster than what we saw in the U.S. It's only at 10%. As part of how we're actually able to actually, even with some of the wider ranges, continue to manage profitability this year because we're already seeing some of those benefits. That is all the time we have for questions. This concludes today's call. Thank you for joining. You may now disconnect.