Rapid7, Inc. — Q3 2023 Form 10-Q Summary
Business context and reporting period
Rapid7 provides cybersecurity software and services through its Insight Platform, including incident detection and response, cloud security, vulnerability risk management, application security, threat intelligence, and security orchestration. The filing covers the three and nine months ended September 30, 2023, compared with the same periods in 2022.
As of September 30, 2023, Rapid7 had 11,412 customers in 151 countries, including 41% of the Fortune 100. Recurring revenue represented 95% of total revenue for both the quarter and nine-month period. The company acquired Minerva Labs on March 14, 2023, for aggregate consideration of approximately $34.6 million; its contribution was not material to reported results.
Financial performance and liquidity
| Metric | Q3 2023 | Q3 2022 | 9M 2023 | 9M 2022 |
|---|---|---|---|---|
| Total revenue | $198.8 million | $175.8 million | $572.4 million | $500.6 million |
| Revenue growth | 13.1% | 25.6% | 14.3% | 30.4% |
| Gross profit | $141.0 million | $121.9 million | $400.4 million | $341.2 million |
| GAAP gross margin | 70.9% | 69.4% | 70.0% | 68.2% |
| Loss from operations | $(16.0) million | $(23.2) million | $(91.7) million | $(98.3) million |
| GAAP net loss | $(76.6) million | $(28.7) million | $(169.3) million | $(113.3) million |
| GAAP net loss per share | $(1.25) | $(0.49) | $(2.80) | $(1.95) |
| Operating cash flow | $3.7 million | $20.1 million | $40.8 million | $38.0 million |
| Free cash flow | $(0.6) million | $9.7 million | $23.8 million | $12.2 million |
Products revenue increased 14.0% in Q3 and 14.9% for the nine-month period, while professional services revenue declined 3.3% in Q3 but increased 4.3% year to date. Management attributed growth primarily to renewals, upsells, and cross-sells from existing customers.
Non-GAAP income from operations was $36.8 million in Q3 and $60.7 million for the first nine months, compared with $13.0 million and $10.9 million, respectively, in the prior-year periods. Non-GAAP operating margin was 18.5% in Q3 and 10.6% year to date. Adjusted EBITDA was $42.9 million in Q3 and $78.8 million year to date.
At September 30, 2023, cash and cash equivalents were $182.7 million, and investments totaled $190.0 million, including $139.4 million of short-term and $50.6 million of long-term investments. The company reported an accumulated deficit of $1.03 billion and stockholders’ deficit of $161.6 million. Management stated that available cash, investments, credit capacity, and expected operating cash flow should fund requirements for at least the next 12 months.
Debt and capital structure
- Rapid7 issued $300.0 million of 1.25% convertible senior notes due 2029, receiving net proceeds of approximately $292.0 million.
- The company used approximately $201.0 million to repurchase and retire $184.0 million of principal of its 2025 convertible notes.
- Net convertible debt carrying value at September 30, 2023 was approximately $928.9 million, comprising $45.5 million of 2025 Notes, $591.3 million of 2027 Notes, and $292.1 million of 2029 Notes.
- The 2025, 2027, and 2029 Notes had quoted fair values of $47.1 million, $511.1 million, and $290.7 million, respectively.
- The company recorded $53.9 million of non-cash induced conversion expense related to the 2025 Note repurchase, materially increasing reported interest expense.
- Rapid7 had no borrowings under its $100.0 million revolving credit facility, $9.0 million of letters of credit outstanding, and was in compliance with its covenants at quarter end.
Material changes versus the prior comparable period
- Revenue growth slowed to 13.1% in Q3 from 25.6% in the prior-year quarter and to 14.3% year to date from 30.4%.
- Gross margin improved by 150 basis points in Q3 and 180 basis points year to date, reflecting scale benefits and lower professional-services costs.
- Research and development expense declined 17.9% in Q3, primarily due to lower personnel and stock-based compensation costs following workforce reductions. Sales and marketing expense was broadly flat in Q3, while general and administrative expense declined 13.1%.
- GAAP operating loss improved, but GAAP net loss worsened because of the $53.9 million induced conversion expense, $15.5 million of cumulative change in fair value of derivative assets, restructuring charges, and lease-related impairment charges.
- The August 2023 restructuring plan reduced the workforce by approximately 17%. Q3 restructuring expense was $20.0 million, with $4.7 million accrued but unpaid at September 30, 2023.
- Long-lived asset impairment charges totaled $30.8 million year to date, including $3.6 million in Q3, primarily related to idle office space and associated lease assets.
- Annualized recurring revenue was $776.8 million, up 13.6% year over year. Customers increased 5.8% to 11,412, while ARR per customer increased 7.4% to $68.1 thousand.
Guidance, outlook, commentary, and risks
The filing discusses management’s use of guidance and forward-looking assumptions but does not provide a clear numerical quarterly or full-year guidance range in the supplied text. Management expects restructuring execution to be substantially complete by the end of Q4 2023, with approximately $3.5 million of additional restructuring charges expected in Q4, subject to local legal and consultation requirements.
Management expects research and development, sales and marketing, and general and administrative expenses to decline as a percentage of revenue in the near term. It also expects interest expense to primarily reflect contractual interest and amortization of debt issuance costs following the unusual 2023 Note transactions.
- Key operating risks include slower customer renewals, reduced upsell and cross-sell activity, lengthening sales cycles, macroeconomic weakness, inflation, higher interest rates, and reduced technology spending.
- Rapid7 faces intense competition from larger and specialized cybersecurity vendors, including Microsoft, CrowdStrike, Palo Alto Networks, Qualys, Tenable, Splunk/Cisco, and others.
- Cybersecurity incidents, service outages, product defects, third-party infrastructure failures, and privacy or data-protection noncompliance could damage reputation, reduce demand, and create liability.
- Convertible debt creates refinancing, liquidity, dilution, and potential cash-settlement risks. The notes may become convertible if specified conditions are met, although they were not convertible at the holder’s option as of September 30, 2023.
- The restructuring plan may produce additional cash costs, employee attrition, execution challenges, and further impairment charges.
- The company has significant accumulated losses and may continue to generate GAAP losses. Stock-based compensation was $84.8 million for the first nine months of 2023, a significant recurring non-cash expense.
- Ordinary-course litigation and claims were not expected to have a material adverse effect, but the filing notes that litigation can still cause defense costs and management distraction.
Investor verification points
- Verify the company’s current revenue-growth, ARR-growth, renewal, and customer-expansion trends following the Q3 slowdown.
- Assess whether the 17% workforce reduction and office-footprint actions deliver the expected sustainable margin benefits without impairing product development, sales execution, or customer support.
- Reconcile GAAP losses with non-GAAP profitability, particularly stock-based compensation, amortization, restructuring, impairment, derivative valuation, and induced conversion adjustments.
- Review the maturity, conversion conditions, potential cash requirements, and dilution exposure associated with the remaining convertible notes.
- Monitor cash generation after capitalized software costs, restructuring payments, acquisitions, and investment purchases.
- Confirm the timing and amount of the remaining estimated restructuring charges and evaluate the possibility of additional lease or goodwill impairments.
- Review cybersecurity, privacy, third-party hosting, foreign-exchange, competitive, and macroeconomic exposures described in the risk factors.