Fatima Boolani, jointly Head of the Software Research team here at Citi, and I am excited to put a pin on a very successful day one of the Citi TMT Conference here with Rapid7. I have got the CFO, Rafe Brown, joining me this afternoon. Thank you so much for being here. Thank you for having us. Excellent. I want to get right into the meat and the heart of the matter here. Just a state of the union on the business. Rapid7 has been through a series of strategic and execution pivots, hoping you can give us an overview of where the business is, where it stands today, both strategically and financially, and actually, what has changed most meaningfully in the almost one year that you have been CFO. Yes. Thank you. I think the hands-down biggest thing is we recently had a new CEO join us, as well as a new head of Chief Product and Technology. I think those are the two most recent elements of what has been a pretty big shift in the management structure across the board. I joined in December of last year. Allan Peters joined. He runs our sales and marketing organizations. He joined in October. We have a very new team, but it is across the board. I think that speaks to the overall changes that we are seeing at Rapid7 that I would say the passion by a number of us, the good things we can do and that we need to work together on, but of significant changes, whether it is on the product, the go-to-market side of the house, just as we are embracing the markets. I would say, I think a background kind of core element, to stick to my own area for a minute though is, as I joined the organization, there was a few things we really wanted to take off the table, and that was we have a large convertible bond that's going to mature next year. We want to make sure we've addressed that. We now have more than enough cash on hand to do that. We wanted to make sure we could provide clarity to the parts of our business that we felt was core, our core offerings. We break that out each quarter. We've really tried to focus on our ability to express the story and make it really clear, because as we're going through the transition, we don't want any distractions from the good things we're doing. We want to demonstrate that to our investors. So you likely had a very long punch list of things that you wanted to address in. It's only nine months. Yeah. We're not quite at the one-year mark yet. So a lot of action in an action-packed nine months. In terms of that punch list, if you can help itemize for us, and facets where you are outperforming versus the areas that you feel still have some scope for improvement against kind of your original target list of these are the areas I'd like to focus on. Well, I think a few of the major priorities that just jumped off the page were, one, around how we guide the business both internally and externally. That was probably the hands-down biggest thing that I was asked to jump on. And we've really focused on that. The guidance is always somewhat difficult. You build the resources. But the team has really rallied around it in terms of our ability to forecast, and this is internal as well as the guidance we give publicly, really trying to be on top of that. That's been a big focus. I think we've made a lot of very good progress there. And then the clarity of the business. I think one of the things we would hear from investors a lot of times is the story was complex, right? Investors have many choices. They need to be able to see where we are, what we're doing, and being able to break that out. The core versus non-core business, the breaking out of the details even within core D&R versus exposure management. Getting those things unwrapped is really key. I think internally, we've really tried to drill into our overall data management side of the house so that we can express clearly to the board, to leaders of both the good and the bad in any given quarter. We've, I think, made some really nice enhancements there. All of these things you can keep going for the rest of your life on. Where that leaves us, though, is that the parts of the journey where finance is really much more of in a support role. On the product and technology side, on the go-to-market side, we're not on the front lines. Our partners are out doing that, and they've been doing some really good work. We're really digging in, given how new Dan is on the product side, that he's absorbing a lot of data, but he's now getting his feet under him with his organization. He's bringing in new leadership underneath him. That's really been very exciting for a lot of us. Setting that product strategy, we need to partner with him constantly to help. The finance person in me wants to jump right to an ROI, but frankly, the best thing I can do is help making sure he has the data he needs to make good decisions. As those products roll out or new changes come through, we'll of course monitor how that's going. Rafe, you alluded to this, and I started my opening comments and a question around this. The series of executive changes in the C-suite and the appointments alongside you in the last 12 months with Wael stepping into the CEO role. I think he's right about at the 100 days mark right now. Allan Peters joining the team as well. Where would you say we are in kind of the tenure and the stabilization of a lot of these changes here? Because I think from an investor standpoint, there tends to be a fear or a concern that there are second-order changes- Yeah ...coming down the pike. The mast head has changed, so we know that. But the second, third tier management and organizational changes, where are we in the cycle of kind of flushing that out? Yeah. I would say where I think we're furthest along would be in Allan Peters' organization. Allan, again, joined in October. He hustled to make some of the changes within his organization to get those in place by sales kickoff, right? To get the team started. I think he did a great job of it, and we've seen some nice increases in rep productivity develop over the first couple quarters of the year, right? That's a great sign of not only getting the team in, but having measurable, definitive success. That's been very exciting to us. With Wael joining, it's 100 days since he joined, but Wael was on the board prior to this, so I think that helps us to a great degree, but it is a big change. Fortunately, Corey, our prior CEO, is Executive Chair now, so he's still available to us, but it's very much Wael leading the organization on a day-to-day basis. Wael is very structured in how he approaches the new job. He's run a number of off-sites or, as he calls them, camps. We just had the third one where we start with the get alignment of him and his direct reports. We expand that out, then we expanded it out again. It's early stages at 100 days, but you see a big shift in the language we're speaking, in the goals we're setting, and some of the product development aspirations we have. We're rolling those out across the organization, and I think that's really helping us, if you will, to be on the same page. Hopefully, that helps us accelerate as we go through this change to start seeing the upside. And just as a related matter, this notion of sharper goals, higher resolution, focus on key areas. You have taken some actions on the workforce realignment and recalibration side. Again, where are we on that journey of stabilization as well? If you can kind of remind us about some numbers around that and how that looks. Yeah. So we announced on our last earnings call that about 12% of our employees were impacted by a restructuring. Prior to that, we had slammed the brakes on hiring. We had had a pretty deep hiring freeze going on, so there was a significant number of other heads that would have otherwise been in the budget that were limited, or were eliminated. Having that done and behind us is, I think, extremely helpful. One of the things that goes with that, though, is some of those dollars need to be reinvested back into the business, in particular on the product and engineering side. So we will see that play out in the coming quarters. But I think that the one thing that the restructure, one of the many things it did for us is it certainly assured our cash flow position, we have these couple bonds I mentioned, making sure we are in a great position to take those over off the table. I think the part of the story that is still in development, to be fair to everyone, is on that product and engineering side. As Dan digs in to his organization and the product challenges and is meeting with customers, that vision cannot help but be rounded out over the next few quarters. I will absolutely come back to this conversation as we talk about the profitability and the margin trajectory in the here and now and over the next 12 months. But going back to essentially a lot of the hard work that has gone into portfolio reconstruction, reconstitution in the last 12 months, there has been a lot of change there as well. Can you maybe step us through some of the most consequential changes that you have undertaken in portfolio reallocation and re-segmenting, both from an offensive strategy but also from a defensive strategy? And then any contours you can give us on the size of these businesses. I think you talk about the D&R business- Yeah. ...the exposure management business under command and control. So would love to have you put the finer points on that. But just more broadly, what have been the most consequential changes in that reconstitution of the portfolio? Sure. Just for everyone here, in the way we've communicated the business, we started really breaking out the business between our core offerings and our non-core offerings. That happens to be, to a very great extent, how we're going to market. It's not just in the way we talk about it to investors. We said our core offerings are going to be our D&R business and our exposure management business. Together, they're just over 80% of the business. The remainder, the non-core side of it, if you will, is actually a number of business. They're rather standalone solutions that have been important to us in many ways, but when we look at the future, where do the investment dollars need to go? Into that core solutions. Where are we going to put our go-to-market resource? Into those core solutions. We have to win with those products and solutions. If you look at within that, we've got the D&R business. It's growing at over 5%, or it's growing approximately 5%, and it's just over 55% of our overall business. That's really the biggest piece of the business and growing quite healthily. We think there's tremendous opportunity for us to accelerate the growth in that side of the business. We also think as we look at with the AI engines coming in, really impacting, finding so many vulnerabilities, it just underscores how important that core business is for us and how the two can work together and need to work together better over time as we look to unify the data streams better on the platform, as we look to overlay them with AI agents to help us be much quicker in the way we either help our customers directly, especially if you think on the exposure management side, or how we run our SOCs on the MDR side of the house. Everything about our business, whether it's product, whether it's go-to-market, whether it's the way we're talking about it externally, is that segmentation around our core business. That's really key. For the non-core side of the house, it's a little tricky because there's a number of our customers that have core products, especially some of the older core products that they haven't yet upgraded as much as we want them to, but they also have some non-core solutions. Managing our way through that to help our customers along that journey is going to be very important to us. Some of that's going to rest in product, some of it is going to be the way we aggressively go about trying to upgrade and move the customers along. And just on the non-core side, I think the delineation is about 80/20. Roughly speaking. Roughly speaking. So how can investors get comfortable or what sort of roadmap can you give to investors that the 20% of the business has attained maybe the trough levels- Yeah. ...of performance? What's that line of sight? Because ultimately, yes, it's only 20% of the business, but it's also 20% of the business creating a significant drag That's right. on your total performance. So any visibility that you can share on when we should expect this to asymptote? Yeah. This is a question we wrestle with a great deal. It is going to take some time, some quarters for that to work through the system to be sure. What we are very much actively engaged on is trying to make sure we have a, for our customers, putting our customers first as we go through these changes is going to be key. I think from the investor perspective, the headache here is, of course, that you have this large piece of the business which is not being productive. It's offsetting the growth of the rest of it. But at least we can break that out so our investors can see where we are on that journey, because it is going to take time in every one of the scenarios we draw up. That said, if we can continue to sharpen our focus on core, re-accelerate that core, I think that's going to be what leads us out of this, and that's what's going to be ultimately the part that is driving overall business growth in the coming years. Just shifting to the core side of the portfolio on the Command Platform and some of the cross-sell dynamics there, what is that Command Platform strategy you have in place today? How is this approach helping you push the value proposition of the platform versus just the bits and bobs of the individual product uptake? Yeah, absolutely. Key to our business is this understanding that there is this great collapse that is happening between the moments that, in traditional times, an exposure would be found, it would be cataloged, you would have time to prioritize it, to fix it, to get that in your system. Then perhaps there was an exploitation, that is something you would detect. All of that is collapsing more and more. What we are very much trying to do is upgrade customers to much more of a unified platform. T here is very distinct functionality that are happening within that, but I think the Command Platform is the first part of this journey that is going to enable us to bring that functionality together, bring those datasets together, and to build the automation and hopefully, and eventually autonomous SOCs that help really drive a better business performance or better customer experience over time. It is because the attack path, it may be the same path, but it is shortened rather drastically, and there is a great fear in the world that it is going to continue to shorten. Bringing that functionality that does much more than two separate businesses and the process of managing exposures into a real-time effort where you are very much on top of them, things are happening much quicker, and that you have the insight of what the exposure management side of the house is doing should there be an attack detected on the D&R side of the house. Rafe, can you characterize for us what the internal barriers to adoption are to the full sum Command Platform versus the external barriers? Are there some technological limitations or capabilities that you are very close to solving and that will create the big unlock, or is it more awareness education? Yeah. And then as a related matter, how has the exposure management opportunity generally changed for you coming out and from beyond your classic vulnerability management roots, where I think the customer perception of that specific capability has changed and- Sure. ...evolved pretty dramatically? Well, I think on the technological side, one of the first things that I would point to is we did an acquisition of a company called Kenzo. It was very small. We did it earlier this year. But it was extremely focused on the technology and the technologists that came with that. But it speaks to bringing in that technology onto our platform that allows us to much more rapidly ingest a broader array of alerts from different infrastructure sets out there. So being able to much more quickly be able to bring more data into our platform and ingest into that platform, super important. But then that's setting us up for the next leg of the journey, being able to rationalize that and make sense of that data. This is one of those problems that all SOCs are facing, but the more data you can see coming into your system, the more alerts you can get, the better it can be. But it's also that much more data and alerts to have to work through. So that is the technology unlock that really is underway, but it's going to be a journey for, I think, everyone in our industry about how do we very quickly bring all that data in, quickly get our arms around it, and help separate out what are alerts for a myriad reasons that are fairly innocuous versus those that are real threats to your organization. So that's a tremendous amount of work that has to go on. Kenzo was a first big move in that direction, but it's part of this much longer journey, and that will ultimately manifest itself into a lot of platform work as we bring all of this together. That's really key. Along with that, I think, is that the external elements you talked about is helping customers understand the threats and understanding what they're facing, whether they like it or not. Making sure we're super clear on that. For us, one of the benefits is because of the AI impacts on cyber have been so well pronounced, these conversations are now much higher. There's not a board out there who There probably is one or two, but generally speaking, there's not a board out there where they're not asking about what's your cyber strategy, and I'm hearing about all these exploits, or I'm hearing about all these vulnerabilities that are being found. What are you doing about it? That shines a bright light on just how important the work we're doing is and the opportunity for us to get out in front of that. You've historically had pretty sizable market share in, again, the classically defined vulnerability management market. As the definitional expanse of vulnerability management has changed, i.e., the definition has expanded, it's exposure management, it's more encompassing, to capture more attack surfaces and attack surface area. How do you feel that the exposure management addressable market opportunity compares to the classic vulnerability management opportunity? Is the opportunity for you to capture more estate, so more volume of share, in a customer's organization, or do you believe that the lever is higher pricing, more pricing leverage or more premium pricing? Within exposure management, the first and the most obvious glaring thing for us to do is to capture more of that share. Our exposure management business is an opportunity for us to not need to do extraordinary things, but we need to get that business humming along, get it back up to where the market's growing. We've fallen behind that, and we have a lot of work to do on that place. People familiar with the story will know that the exposure management business is offsetting some of the growth of the D&R in recent quarters. We're very frustrated by that, extremely focused on it, but the path is very clear on the work we need to do that we think closes that gap, gets that business growing, and is a big contributor. I think that's where we really have to focus on. We're just getting more customers, bringing them onto the platform. That allows the engagement, they're earning their respect, their trust, and showing them the rest of the work we can do for them. Rafe, a little bit of an elephant in the room question as it relates to what some of the frontier labs are talking about by way of their advancements in their core technologies and their large language models. Very deliberate focus on shoring up the health of the exposure management SKU and franchise for you. But at the same time, the realities of the ground have changed as it relates to some of these large language models are very capable at very high speeds finding some of this, right. How do you jostle with that dynamic, which is clearly different and has evolved in the last six months and maybe wasn't necessarily an issue last year? Yeah, absolutely. I think first of all, we have to realize, all security companies have security teams that go out and find vulnerabilities. When we find a zero-day bug, it's a great source of pride. It comes from great professionals digging in and working that. But that's not what's driving our business on a day-to-day basis. These advancements you're speaking of makes that very clear that by and large, finding new vulnerabilities is a business that's commoditized and part of the past. The trouble is, they're very good at this, and so there is a tremendous volume of vulnerabilities that have become known, and teams are drowning, our customers or potential customers are drowning in just the sheer number of vulnerabilities that are out there. The pressure is super high. These are known vulnerabilities. What are you doing about it? They have to report to it quarterly to their boards and their audit committee meetings. All of a sudden, you have to acknowledge that from a money-making perspective, the finding vulnerabilities is commoditized, but the dealing with them to be able to rationalize them, prioritize them, manage the upgrades of them, has never, ever been more important. I think that's where we really make a big difference with our exposure management solution. Frankly, the other part of it, and I'm sure there's plenty of examples where this has happened, but we feel like it can get worse, is the bad actors are also being able to get these more vulnerabilities and use them against companies. And that's where it's going to be just the pressure to deal with the exposures, but also to monitor and detect attacks just is off the charts, and it causes a lot of stress in the industry. So on the one hand, parts of the way we thought of the business five, 10 years ago are completely different and even gone, if you will. The remainder of the business, the battle that has to be fought, has never been more important, and I think that's going to drive a lot of value to the industry. So it sounds like the voluminous amounts of CVEs that are kind of coming out as aided or facilitated by these labs actually, in theory, can provide a very lucrative bridge for your D&R business, right? Yeah. We believe so. Is what I'm getting at. So when we think about the broader opportunity in the security operations center, there's a lot of movement and interesting sort of renaissance from a spending standpoint there. As enterprises, generally speaking, rethink their SOC stack, their architecture, their vendor strategy, where Rapid7 fits into that equation, and why you feel that you will have a right to win in taking more than your fair share of some of those very juicy budgets? Yes, absolutely. Well, I think if you think about our ideal customer profile out there, Rapid7's always had a strong presence in the commercial market, kind of that midsize business where they're big enough to have serious security needs, but they probably don't have the budgets. You also see where our data analysis makes it very clear that even in much larger organizations, for the right kind of organizations, those that are really, frankly, quite lean on the security side, we are a perfect fit. You look at that and say that problem exists today, and it's only getting profoundly worse. They have to rely on other vendors, and we're in this unique position with a ton of knowledge built into our organization and teams built in it, and we right now bring great product combined with human services, and we're investing like crazy on the product side of that. I think that's going to be this big differentiator, that a lot of companies, if you will, that outsource SOCs do it just person for person. They just throw bodies at that. We're already well past that, but the work we're doing right now only further enables us to ingest more, to see more, to make sense of more data. Plus, part of our proposition on the D&R side is when you are under attack, you're going to want to talk to a human who's going to have the experience and the maturity to help you manage through that. As the CFO, we hardcore trained to not want humans involved in things. This is an area when things are really going south on that side of it, you need some element. The key for us, though, is to be able to meet the scale and the demands without having to throw bodies at it over time. Throw technology at the scale, sort that down, identify the real attacks, and then have that differentiated service. That is something that our customers are extremely thankful for to get through very difficult times, but also to know that day in, day out, we're helping monitor their systems better than anyone else can. Rafe, you've pre-answered a little bit of my next question. Yeah. When we think about the managed detection and response subheader to the D&R business, what is the interplay and overlap with the overall SOC opportunity, and generally, how has your view evolved there? I think you were talking about, hey, there's maybe some labor efficiency that you can add to your value proposition. So how does AI enhance your revenue and operating leverage opportunities- Yeah. ...in this area, and then bubbling that back up to the D&R at large? Yeah, absolutely. Within our D&R, the vast majority of that is managed detection. and response as a business and how we really differentiate our value. I think first of all, as we continue to enhance our platforms and unite our platform and our data sets, it's going to provide a better service to our customers, right? Being able to see so many more alerts and find those correlations. One attack might trigger a number of alerts, but they're on different pieces of equipment, different systems. Very hard to rationalize for a human to do it other than going screen to screen to screen and being, frankly, just darn lucky. We can bring more of that together, and our goal is to keep adding to our capabilities there. So you have to start with, we think working with us, you can get a service that you can't get by yourself certainly running your own SOC by using other tools. And that's tremendously difficult. I think the thing that we're looking at for ourselves, and even in the Kenzo acquisition, this was part of the formulation when we looked at it, because we are our biggest customer in terms of running SOCs, is that we can bring tremendous value while enhancing the overall offering. Right? Making sure that we can scale the number of alerts that come into us, scale the company, without having to continue to do that person by person on the cost side of it. So I would say first and foremost, you have to differentiate and do something that just can't be done with other companies. But then I think we can continue to do that. We talk about wanting to make sure we're providing this managed detection response with software-like margins. And I think that's a real key calling for us as we look forward to the coming years, being able to deliver that extra value to our customers, but also to our shareholders in an efficient way that's driven by automation, but still has that differentiated service. Excuse me. Rafe, I wanted to talk about the path to growth re-acceleration and acceleration for ARR. I know we had a lot of different conversations in different pockets, right? So maybe just to distill it in terms of the order of operations of things that need to fall into place and go right so that ARR trends start to rehabilitate. Yes. Right? How would you stack rank the things that need to, again, fall into line for ARR to start coming up the curve? Yeah. Well, I think the vast majority of these are going to be on the product side. On the MDR, the investments we're making, the acceleration of our agentic work that we're doing on that, I think is going to make that solution much more competitive, more advantageous, driving growth in MDR. That would be the very first step. The exposure management, really drilling in on this, on the current customer base, the enhancements we need to make sure everybody gets upgraded to the latest versions of the technology, and then continuing that platform expansion, that brings that. If we stopped right there, focus on MDR, focus on exposure management on the product side, I think that gets us there in the overall story. But that is the biggest driver. We do have these non-core offerings, and it gets a little more nuanced there because there's several different solutions. But the biggest thing is making sure that platform is so strong, has enough of those features that we can migrate those customers over to it and make sure they're happy. I think that's going to help with the story. Some of the non-core offerings, getting through the decline quicker is probably the best thing that possibly can happen to us. We just want to do it in the way that's best for our customers. Just as a related matter, because it's a good segue into the next question I wanted to ask you about managing a very disciplined cost envelope as you navigate some of these dynamics. You've still been able to produce operating efficiency in the business, right? Driven a lot of rigor in terms of managing the cost. I don't think 20% operating margins have been out of the realm of possibility, right? Can you help us appreciate how much more scope is there to essentially run the non-core portfolio at a much more efficient level from here? Is that going to be the preponderance of the input to ongoing operating leverage? Because the core business is going to get all the love in terms of investment, right? Sure. Just in terms of the factors of influence on your ability to continue to drive operating leverage at or above 20%. Sure. With the restructure we just did, we did talk about. We had been talking all year long about improving margins as we exit 2026. With this restructuring behind us, we are able to call in the last call that we think we can exit the year with margins in that range. I think that's a big first step. A good deal of the cost rationalization was able to come out of the non-core. I think that's very, very clear that to the extent we have some of these non-core offerings, we have to make sure they're contributing to the investment that's going on in the core. I think there's big opportunity that's already underway. I think there's ongoing opportunity as we move forward. What will help us as an organization is having that crystal focus of where should each new dollar be invested. Frankly, to go through the budget cycles, where should every dollar be invested in terms of making the strongest solution for our customers, then taking that to market. When we started the year, it was before we had really broke out this core versus non-core, but already intuitively, the company was gravitating towards that direction, putting better sales incentives around selling core. That's only going to get sharper and sharper as we move forward. I think that is what's going to ultimately help us get the most bang for our bucks when we're putting in dollars, whether it's on the product side, whether it's on the go-to-market side, and getting results and returning them to the business. Rafe, my last question for you is managing the business and setting expectations as Rapid7 moves through a period of tremendous change. You talked about data management, data quality, stronger signals being filtered into your guidance. How should investors think about the quality of the inputs going into the pie that you're baking for all of us as it relates to guidance, setting expectations? And then related to that, what are three things that give you a lot of confidence that you are going to see over the next 12 months, this real rehabilitation in the trajectory of the business? Well, I think in terms of the inputs, a lot of it is. At the end of the day, it comes down to good teams working very hard together. I think one of the things we've done is, between Allan's organization and my team working together, we review forecasts every Friday. We go over that, and we work very hard to dig into those elements of it and really understand the nuances of the deals that we're looking at, of the customer renewals that are coming up. To some great extent, it's spending a lot of time together and frankly, creating competitive modeling within the team. So you're talking about why there are difference and really wrestling. If nothing else out of the debate, you understand where your risk items are. And doing that across the organization on financial data, I think is tremendously important. We also have brought in some new leadership. We've moved people around within the finance organization to crispen up how we forecast the business, how we bring it together to our teams. Then I very much try very hard to lean in with my business partners to bring them into the discussions, even when the discussions are tough quite early. We've met repeatedly with Dan and Allan about what next year's plan is shaping up. It's extremely preliminary. But to do next year's plan, we have to have a very clear view of where the products are, when the releases are happening, how Allan and his team are looking at it. All of that feeds into being able to give much better data. Then ultimately, my confidence for the future very much rests in the individuals we work with. We're blessed by strong leaders who have very strong opinions, and so we get to exercise those freely. But you get guys like Dan and Allan in the room, you get the teams together, that's what makes you build, like, we can do this. The path is so clear how to make things better, and as we make them better, we'll continue to help make them great. I appreciate that, Rafe. Thank you so much. My pleasure. Thank you. Great conversation.