Rapid7 Delivers Third Quarter 2016 Financial Results with 42% Year-Over-Year Revenue Growth and Positive Operating Cash Flow

Rapid7, Inc. (NASDAQ:RPD), a leading provider of security data and analytics solutions, today announced its financial results for the third quarter of 2016.
“Our third quarter results showed fundamental strength in several important areas, including solid growth in our mid-market customer base, new product adoption, and uptake of our platform-based cloud analytics,” said Corey Thomas, president and chief executive officer of Rapid7. “Our pipeline is healthy and while the market demand environment remains strong, our total billings growth in the third quarter was lower than we expected due to larger enterprise and federal deals that did not close in the quarter. We continue to believe that Rapid7 is well-positioned to drive growth due to our continuous technology innovation, robust platform-based data and analytics solutions, as well as strong demand from the growing challenges facing IT and security practitioners.”
“We’re pleased to have performed well against our guided metrics for the third quarter and to have delivered another quarter of positive operating cash flow,” said Steven Gatoff, chief financial officer of Rapid7. “We continue to see the value of our unique data and analytics-centric model driving compelling economics with our customers and we remain positive about the underlying strength of our business and our ability to deliver strong revenue growth and improving loss from operations.”
Third Quarter 2016 Financial Highlights

• Continued Revenue Growth: For the third quarter of 2016, total revenue increased 42% year-over-year to $40.3 million. Approximately 87% of total revenue for the third quarter of 2016 came from deferred revenue on the balance sheet at the beginning of the quarter. Recurring revenue, which is comprised of content subscriptions, maintenance and support, cloud-based subscriptions, and managed services subscriptions, was 62% of total revenue in the third quarter of 2016.
• Growth in Deferred Revenue: Total deferred revenue at the end of the third quarter of 2016 was $149.3 million, an increase of 36% year-over-year with growth in both short and long-term deferred revenue.
• Positive Operating Cash Flow: In the third quarter of 2016, operating cash flow was $1.8 million as compared to operating cash flow of $2.3 million in the third quarter of 2015 and $1.9 million in the second quarter of 2016.
• High Customer Renewal Rates: The renewal rate for the third quarter of 2016, which includes upsells of purchased products and cross-sells of additional products, was 121% compared to 122% for the same period in the prior year. The expiring revenue renewal rate, which excludes upsells and cross-sells of additional products, was 89% in the third quarter of 2016 compared to 88% in the same period in the prior year.
• Strong Professional Services Gross Margin: For the third quarter of 2016, GAAP professional services gross margin increased to 36% as compared to 20% in the third quarter of 2015. On a non-GAAP basis, professional services gross margin in the third quarter of 2016 increased to 38% as compared to 22% in the third quarter of 2015. The company continues to gain scale efficiencies, driven by increasing demand for penetration testing as well as growth in its international services portfolio.
• Diversified Global Growth: For the third quarter of 2016, total revenue from North America increased 39% year-over-year to $34.5 million and comprised 86% of total revenue. Total revenue from international increased 69% year-over-year to $5.8 million and comprised 14% of total revenue for the third quarter of 2016.
• Improving Loss from Operations and Net Loss Per Share: For the third quarter of 2016, GAAP loss from operations was $(10.2) million, and non-GAAP loss from operations was $(5.3) million.  GAAP net loss per share was $(0.25) and non-GAAP net loss per share was $(0.13) for the third quarter of 2016.

Strategic Additions to the Board of Directors and Management Team:

• Judy Bruner, the former CFO of SanDisk Corporation, was appointed to the company’s Board of Directors, effective October 31, 2016. Ms. Bruner was also appointed as a member of the board’s audit committee, bringing additional financial and operational expertise that will be beneficial to Rapid7 and our shareholders. Ms. Bruner is a seasoned business executive with proven experience managing global enterprises and will play an important role as we continue to scale our business and execute the company’s long-term growth strategy.
• Andrew Burton, the company’s senior vice president of IT Search and former CEO of Logentries (the business that Rapid7 acquired in October 2015), was promoted to be Rapid7’s chief operating officer as the company continues to drive customer adoption and disrupt the cybersecurity and IT markets with its security data and analytics platform. In this newly-created role, Burton will report directly to the company’s president and chief executive officer, Corey Thomas, and will focus on Rapid7’s global go-to-market efforts.

Recent Business Highlights      
Customer Momentum and Growth:

• Increased market adoption of Rapid7 product offerings by expanding relationships with existing customers and adding new customers, ending the third quarter of 2016 with more than 5,800 customers, an increase of 33% year-over-year.
• Added several new customers including EPIC Management, QuickPivot, and Xuji Group Corporation.
• Improved penetration into Fortune 1000 companies year-over-year from 35% to 37%.

Industry Recognition:

• Recognized by SANS for providing the most comprehensive coverage across the Center for Internet Security (CIS) Critical Security Controls for Effective Cyber Defense. The ranking found that Rapid7’s incident detection and response and threat exposure management solutions cover 19 of the 20 controls as defined by CIS. The controls focus on helping organizations minimize the risk they’re exposed to and harden resiliency.

Technology Platform and Product Innovation:

• Introduced policy view for Nexpose so customers can see at a glance how compliant they are and quickly understand where their biggest compliance issues are, to begin remediating.
• InsightIDR product enhancements were released, including several new detections, compliance dashboards, and the ability to write custom alerts. These capabilities are designed to give practitioners the ability to detect attackers earlier in the lifecycle and exemplify the power, agility, and versatility of the company’s cloud-based analytics engine.
• Announced new AppSpider functionality providing enhanced support for JavaScript Single Page Applications (SPAs) built with ReactJS, which is a significant release improvement given the rapid proliferation of SPAs and the challenges created for security teams.

Robust Technology Partnerships:

• Rapid7’s Nexpose is now integrated with both McAfee ePolicy Orchestrator (ePO) and McAfee Data Exchange Layer (DXL). Customers will now have always-on vulnerability management, visibility into their endpoints and entire IT environments, and the ability to prioritize remediation to maximize impact. The integrations will help organizations break down communication barriers between IT and security teams to collaboratively reduce the risk of a breach.
• Rapid7 has strengthened and expanded it’s Nexpose integration with ForeScout. Using the ForeScout Extended Module allows joint customers to leverage Nexpose to scan for vulnerabilities and mitigate threats stemming from potentially risky devices that join the network.

Fourth Quarter and Full-Year 2016 Guidance
Rapid7 anticipates total revenue, non-GAAP loss from operations, and non-GAAP net loss per share to be in the following ranges:
Fourth Quarter 2016:

The fourth quarter net loss per share (non-GAAP) calculation assumes 42.0 million basic and diluted weighted average common shares outstanding.
Full-Year 2016:

The full-year net loss per share calculation (non-GAAP) assumes 41.4 million basic and diluted weighted average common shares outstanding.
Guidance for the fourth quarter and full-year 2016 does not include any potential impact of foreign exchange gains or losses.
Conference Call and Webcast Information
Rapid7 will host a conference call today to discuss its results at 5:00 p.m. Eastern Time. The call will be accessible by telephone at 800-272-9104 (domestic) or 303-223-4376 (international). The call will also be available live via webcast on the company’s web site at https://investors.rapid7.com. A telephone replay of the conference call will be available at 800-633-8284 or 402-977-9140 (access code 21818989) until November 12, 2016. A webcast replay will be available at https://investors.rapid7.com.
About Rapid7
Rapid7 is a leading provider of security data and analytics solutions that enable organizations to implement an active, analytics-driven approach to cyber security. We combine our extensive experience in security data and analytics and deep insight into attacker behaviors and techniques to make sense of the wealth of data available to organizations about their IT environments and users. Our solutions empower organizations to prevent attacks by providing visibility into vulnerabilities and to rapidly detect compromises, respond to breaches, and correct the underlying causes of attacks. Rapid7 is trusted by more than 5,800 organizations across over 110 countries, including 37% of the Fortune 1000. To learn more about Rapid7 or get involved in our threat research, visit www.rapid7.com.
Non-GAAP Financial Measures
To supplement our consolidated financial statements, which are prepared and presented in accordance with generally accepted accounting principles in the United States, or GAAP, we provide investors with certain non-GAAP financial measures, including non-GAAP gross profit, non-GAAP operating loss, non-GAAP net loss and non-GAAP net loss per share, which we collectively refer to as non-GAAP financial measures. These non-GAAP financial measures exclude all or a combination of the following: stock-based compensation expense, amortization of acquired intangible assets, acquisition related expenses, and impairment of long-lived assets. The presentation of the non-GAAP financial measures is not intended to be considered in isolation or as a substitute for, or superior to, the financial information prepared and presented in accordance with GAAP. We use these non-GAAP financial measures for financial and operational decision-making purposes and as a means to evaluate period-to-period comparisons, and use certain non-GAAP financial measures as performance measures under our executive bonus plan. We believe that these non-GAAP financial measures provide useful information about our operating results, enhance the overall understanding of past financial performance and future prospects and allow for greater transparency with respect to metrics used by our management in its financial and operational decision-making. While our non-GAAP financial measures are an important tool for financial and operational decision-making and for evaluating our own operating results over different periods of time, you should consider our non-GAAP financial measures alongside our GAAP financial results.
We exclude stock-based compensation expense because of varying available valuation methodologies, subjective assumptions and the variety of equity instruments that can impact our non-cash expense. We believe that providing non-GAAP financial measures that exclude stock-based compensation expense allow for more meaningful comparisons between our operating results from period to period. We believe that excluding the impact of amortization of intangible assets allows for more meaningful comparisons between operating results from period to period as the intangibles are valued at the time of acquisition and are amortized over several years after the acquisition. We also exclude the impact of costs directly related to acquisitions and asset impairments as these costs are unrelated to the current operations and neither comparable to the prior period nor predictive of future results, which we believe allows for a more meaningful comparison between the operating results from period to period. Accordingly, we believe that excluding these expenses provides investors and management with greater visibility into the underlying performance of our business operations, facilitates comparison of our results with other periods and may also facilitate comparison with the results of other companies in our industry.
While a reconciliation of non-GAAP guidance measures to corresponding GAAP measures is not available on a forward-looking basis as a result of the uncertainty regarding, and the potential variability of, many of these costs and expenses that we may incur in the future, we have provided a reconciliation of GAAP to non-GAAP financial measures in the accompanying financial statement tables included in this press release for non-GAAP results for the three and nine months ended September 30, 2016 and 2015.
There are limitations in using non-GAAP financial measures because the non-GAAP financial measures are not prepared in accordance with GAAP, may be different from non-GAAP financial measures used by other companies and exclude expenses that may have a material impact upon our reported financial results. Further, stock-based compensation expense has been and will continue to be for the foreseeable future a significant recurring expense in our business and an important part of the compensation provided to our employees.
Cautionary Language Concerning Forward-Looking Statements
This press release includes forward-looking statements. All statements contained in this press release other than statements of historical facts, including, without limitation, statements regarding our future financial and business performance for the fourth quarter and full-year 2016, the quality of our sales pipeline, our ability to convert our sales pipeline into revenue, technical innovations, demand for our product offerings, market opportunity and plans and objectives for future operations , including our ability to drive continued revenue growth and positive operating and free cash flow and progress towards profitability, are forward-looking statements. The words “anticipate,” “believe,” “continue,” “estimate,” “expect,” “intend,” “may,” “will” and similar expressions are intended to identify forward-looking statements. We have based these forward-looking statements largely on our current expectations and projections about future events and financial trends that we believe may affect our financial condition, results of operations, business strategy, short-term and long-term business operations and objectives and financial needs. These forward-looking statements are subject to a number of risks and uncertainties, including, without limitation, risks related to our rapid growth and ability to sustain our revenue growth rate, the ability of our products and professional services to correctly detect vulnerabilities, competition in the markets in which we operate, market growth, our ability to innovate and manage our growth, our ability to integrate acquired operations, our ability to operate in compliance with applicable laws as well as other risks and uncertainties set forth in the “Risk Factors” section of our Quarterly Report on Form 10-Q filed with the Securities and Exchange Commission for the quarterly period ended June 30, 2016, and subsequent reports that we file with the Securities and Exchange Commission.  Moreover, we operate in a very competitive and rapidly changing environment. New risks emerge from time to time. It is not possible for our management to predict all risks, nor can we assess the impact of all factors on our business or the extent to which any factor, or combination of factors, may cause actual results to differ materially from those contained in any forward-looking statements we may make. In light of these risks, uncertainties and assumptions, we cannot guarantee future results, levels of activity, performance, achievements or events and circumstances reflected in the forward-looking statements will occur. We are under no duty to update any of these forward-looking statements after the date of this press release to conform these statements to actual results or revised expectations, except as required by law. You should, therefore, not rely on these forward-looking statements as representing our views as of any date subsequent to the date of this press release.