Rapid7, Inc. — FY2016 Form 10-K Summary
Business context and reporting period
Rapid7 provides cybersecurity and IT operations analytics, including threat exposure management, incident detection and response, managed services, cloud subscriptions, and security advisory services. The filing covers the fiscal year ended December 31, 2016. Fourth-quarter 2016 results are also presented in the filing.
- Customers increased to 6,206 from 5,132; 38% of Fortune 1000 organizations were customers.
- International customers generated 14% of 2016 revenue.
- Rapid7 operated as one reporting segment and had 887 full-time employees at year-end.
Financial results and key metrics
| Metric | FY2016 | FY2015 | Change |
|---|---|---|---|
| Total revenue | $157.4 million | $110.5 million | +42.4% |
| Products revenue | $89.4 million | $63.4 million | +41.0% |
| Maintenance and support revenue | $37.4 million | $26.9 million | +39.0% |
| Professional services revenue | $30.6 million | $20.2 million | +51.5% |
| Gross profit | $117.7 million | $81.3 million | +44.8% |
| Gross margin | 74.8% | 73.5% | +1.3 points |
| Operating loss | $(49.0) million | $(46.6) million | Loss increased |
| Net loss | $(49.0) million | $(49.9) million | Loss narrowed modestly |
| Net loss per share | $(1.19) | $(4.00) | Improved |
| Operating cash flow | $9.1 million | $(1.9) million | Improved |
| Deferred revenue | $169.1 million | $130.3 million | +29.8% |
Operating expenses were $166.8 million, including $48.0 million of research and development, $90.5 million of sales and marketing, and $28.3 million of general and administrative expense. Stock-based compensation was $17.3 million, compared with $10.7 million in 2015.
Fourth-quarter 2016 revenue was $45.0 million, compared with $32.9 million in the fourth quarter of 2015. Fourth-quarter operating loss was $9.9 million and net loss was $9.8 million, compared with operating and net losses of $20.9 million and $21.1 million, respectively, in the prior-year quarter.
Liquidity, cash flow, debt, and commitments
- Cash and cash equivalents were $53.1 million at December 31, 2016, supplemented by $38.9 million of short- and long-term investments.
- Cash decreased from $86.6 million at year-end 2015, primarily because of $43.5 million used in investing activities, including $39.0 million of investment purchases and $4.5 million of capital expenditures.
- Operating cash flow turned positive, largely because deferred revenue increased by $38.7 million.
- The company reported no outstanding debt at year-end; its term loan had been repaid in July 2015.
- Working capital excluding deferred revenue was $101.5 million, and total liabilities were $201.3 million, including $169.1 million of deferred revenue.
- Contractual obligations totaled $25.8 million, consisting of $19.7 million of operating leases and $6.2 million of non-cancelable purchase obligations.
- Management stated that existing cash and operating cash flow were expected to fund requirements for at least the next 12 months, although the company expected to continue generating losses.
Material changes versus the prior comparable period
- Revenue growth remained strong, but net new customer additions declined to 1,074 from 1,399 in 2015.
- Recurring revenue represented 62% of total revenue. Revenue recognized from beginning deferred revenue increased to $87.3 million, or 55% of 2016 revenue, from $58.2 million, or 53%, in 2015.
- Gross margin improved as professional services utilization and maintenance and support scale increased, partially offset by lower product margins from a greater mix of cloud subscriptions and managed services.
- Operating loss increased despite higher revenue because the company continued investing heavily in sales, marketing, research and development, and infrastructure.
- Interest expense was replaced by modest interest income following repayment of the term loan.
- Logentries, acquired in October 2015, contributed a full year of operating costs in 2016 and was integrated into InsightIDR and the new InsightOps offering.
- Rapid7 launched InsightOps in beta in November 2016 and expected commercial availability in the first half of 2017.
- The company discontinued its Mobilisafe product in the third quarter of 2016 and accelerated amortization of its remaining net book value.
Guidance, outlook, commentary, risks, and unusual items
The filing does not provide a specific FY2017 revenue or earnings guidance range. Management expected continued investment in research and development, sales and marketing, international expansion, professional services, and public-company infrastructure, with losses expected to continue in the foreseeable future.
- Key operating risks include intense competition, dependence on Nexpose and Metasploit, renewal and expansion rates, unpredictable enterprise sales cycles, and reliance on channel partners, which generated approximately 37% of 2016 revenue.
- Rapid7 is exposed to cybersecurity breaches, service outages, cloud-hosting dependencies, product defects, false positives, and failures to detect vulnerabilities.
- International expansion creates exposure to foreign exchange, privacy, data protection, export controls, Brexit-related uncertainty, and other regulatory risks.
- The company disclosed a prior export-control compliance matter involving Metasploit downloads. OFAC issued a cautionary letter in 2015, and BIS issued a warning letter in January 2017; neither agency pursued a civil monetary penalty.
- Rapid7 was involved in litigation by a non-practicing entity alleging infringement of an expired patent. Management believed ordinary-course matters were not expected to have a material adverse effect, but litigation costs and uncertainty remained possible.
- A $0.4 million settlement and licensing agreement was recorded in general and administrative expense in 2016.
- A $0.6 million Invest Northern Ireland grant reduced operating expenses; a pro rata repayment could be required if employment-related compliance criteria are not met.
- Full valuation allowances were maintained against U.S., Ireland, and U.K. deferred tax assets because of expected future losses. Federal and state NOL carryforwards were $93.8 million and $69.2 million, respectively.
- Management concluded that disclosure controls and internal control over financial reporting were effective as of December 31, 2016. The independent auditor provided no Section 404(b) attestation because Rapid7 remained an emerging growth company.
Most important facts for investors to verify
- Whether revenue growth and deferred-revenue additions can continue as customer additions slowed and the business remains unprofitable.
- The sustainability of positive operating cash flow, which benefited materially from deferred-revenue growth.
- Progress and commercial traction for InsightIDR, InsightOps, managed services, and other newer offerings.
- Revenue concentration and renewal trends for Nexpose, Metasploit, and threat exposure management products.
- The impact of stock-based compensation, which rose to $17.3 million and remains a recurring expense.
- Liquidity after ongoing operating losses, capital expenditures, lease commitments, and potential acquisition or expansion spending.
- Potential effects of cybersecurity incidents, data privacy and export-control requirements, litigation, foreign exchange movements, and future accounting changes, including adoption of the new revenue recognition standard in 2018.